Check: OL6-00-000253
Oracle Linux 6 STIG:
OL6-00-000253
(in versions v2 r7 through v1 r9)
Title
The LDAP client must use a TLS connection using trust certificates signed by the site CA. (Cat II impact)
Discussion
The tls_cacertdir or tls_cacertfile directives are required when tls_checkpeer is configured (which is the default for openldap versions 2.1 and up). These directives define the path to the trust certificates signed by the site CA.
Check Content
If the system does not use LDAP for authentication or account information, this is not applicable. To ensure TLS is configured with trust certificates, run the following command: # grep cert /etc/pam_ldap.conf If there is no output, or the lines are commented out, this is a finding.
Fix Text
Ensure a copy of the site's CA certificate has been placed in the file "/etc/pki/tls/CA/cacert.pem". Configure LDAP to enforce TLS use and to trust certificates signed by the site's CA. First, edit the file "/etc/pam_ldap.conf", and add or correct either of the following lines: tls_cacertdir /etc/pki/tls/CA or tls_cacertfile /etc/pki/tls/CA/cacert.pem Then review the LDAP server and ensure TLS has been configured.
Additional Identifiers
Rule ID: SV-219564r793821_rule
Vulnerability ID: V-219564
Group Title: SRG-OS-000250
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000776 |
The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts. |
CCI-001453 |
The information system implements cryptographic mechanisms to protect the integrity of remote access sessions. |
Controls
Number | Title |
---|---|
AC-17 (2) |
Protection Of Confidentiality / Integrity Using Encryption |