Navigate

Check: SRG-APP-000172-AS-000121

Application Server SRG: SRG-APP-000172-AS-000121 (in versions v3 r4 through v2 r2)

Title

The application server must utilize encryption when using LDAP for authentication. (Cat II impact)

Discussion

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. Application servers have the capability to utilize LDAP directories for authentication. If LDAP connections are not protected during transmission, sensitive authentication credentials can be stolen. When the application server utilizes LDAP, the LDAP traffic must be encrypted.

Check Content

Review application server documentation and configuration to determine if the application server enforces the requirement to encrypt LDAP traffic. If the application server is not configured to meet this requirement, this is a finding.

Fix Text

Configure the application server to encrypt LDAP traffic.

Additional Identifiers

Rule ID: SV-204753r879609_rule

Vulnerability ID: V-204753

Group Title: SRG-APP-000172

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000197	The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
IA-5 (1)	Password-Based Authentication