|
 |
fe0dde |
From a89f73985d5d92acc75229004bafdc931f5ed750 Mon Sep 17 00:00:00 2001
|
|
|
fe0dde |
From: Gabriel Becker <ggasparb@redhat.com>
|
|
|
fe0dde |
Date: Thu, 3 Sep 2020 18:09:53 +0200
|
|
|
fe0dde |
Subject: [PATCH 1/2] Introduce new rule sssd_ldap_configure_tls_reqcert.
|
|
|
fe0dde |
|
|
|
fe0dde |
---
|
|
|
fe0dde |
.../ansible/shared.yml | 6 +++
|
|
|
fe0dde |
.../bash/shared.sh | 6 +++
|
|
|
fe0dde |
.../oval/shared.xml | 24 ++++++++++++
|
|
|
fe0dde |
.../sssd_ldap_configure_tls_reqcert/rule.yml | 39 +++++++++++++++++++
|
|
|
fe0dde |
...rovider_and_reqcert_never.notapplicable.sh | 7 ++++
|
|
|
fe0dde |
.../tests/correct_value.pass.sh | 5 +++
|
|
|
fe0dde |
.../id_provider_is_set_to_ad.notapplicable.sh | 6 +++
|
|
|
fe0dde |
...ldap_id_provider_and_reqcert_never.fail.sh | 6 +++
|
|
|
fe0dde |
.../tests/ldap_tls_reqcert_not_there.fail.sh | 6 +++
|
|
|
fe0dde |
rhel7/profiles/stig.profile | 1 +
|
|
|
fe0dde |
shared/references/cce-redhat-avail.txt | 2 -
|
|
|
fe0dde |
tests/shared/sssd.conf | 1 +
|
|
|
fe0dde |
12 files changed, 107 insertions(+), 2 deletions(-)
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/ansible/shared.yml
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/bash/shared.sh
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ad_id_provider_and_reqcert_never.notapplicable.sh
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/correct_value.pass.sh
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/id_provider_is_set_to_ad.notapplicable.sh
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_id_provider_and_reqcert_never.fail.sh
|
|
|
fe0dde |
create mode 100644 linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_tls_reqcert_not_there.fail.sh
|
|
|
fe0dde |
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/ansible/shared.yml
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..891b3e2f97
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/ansible/shared.yml
|
|
|
fe0dde |
@@ -0,0 +1,6 @@
|
|
|
fe0dde |
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol
|
|
|
fe0dde |
+# reboot = false
|
|
|
fe0dde |
+# strategy = unknown
|
|
|
fe0dde |
+# complexity = low
|
|
|
fe0dde |
+# disruption = medium
|
|
|
fe0dde |
+{{{ ansible_sssd_ldap_config(parameter="ldap_tls_reqcert", value="demand") }}}
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/bash/shared.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/bash/shared.sh
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..62c2febc46
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/bash/shared.sh
|
|
|
fe0dde |
@@ -0,0 +1,6 @@
|
|
|
fe0dde |
+# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+# Include source function library.
|
|
|
fe0dde |
+. /usr/share/scap-security-guide/remediation_functions
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+{{{ bash_sssd_ldap_config(parameter="ldap_tls_reqcert", value="demand") }}}
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..9d3db0488f
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml
|
|
|
fe0dde |
@@ -0,0 +1,24 @@
|
|
|
fe0dde |
+<def-group>
|
|
|
fe0dde |
+ <definition class="compliance" id="sssd_ldap_configure_tls_reqcert" version="1">
|
|
|
fe0dde |
+ <metadata>
|
|
|
fe0dde |
+ <title>Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server</title>
|
|
|
fe0dde |
+ {{{- oval_affected(products) }}}
|
|
|
fe0dde |
+ <description>Configure SSSD to request a valid certificate from the server to protect LDAP remote access sessions.</description>
|
|
|
fe0dde |
+ </metadata>
|
|
|
fe0dde |
+ <criteria>
|
|
|
fe0dde |
+ <criterion test_ref="test_sssd_ldap_tls_reqcert" />
|
|
|
fe0dde |
+ </criteria>
|
|
|
fe0dde |
+ </definition>
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+ comment="Ensures that LDAP TLS requires certificate is set"
|
|
|
fe0dde |
+ id="test_sssd_ldap_tls_reqcert" version="1">
|
|
|
fe0dde |
+ <ind:object object_ref="object_sssd_ldap_tls_reqcert" />
|
|
|
fe0dde |
+ </ind:textfilecontent54_test>
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+ <ind:textfilecontent54_object id="object_sssd_ldap_tls_reqcert" version="1">
|
|
|
fe0dde |
+ <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
|
|
|
fe0dde |
+ <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*ldap_tls_reqcert[ \t]*=[ \t]*((?i)demand)[ \t]*$</ind:pattern>
|
|
|
fe0dde |
+ <ind:instance datatype="int">1</ind:instance>
|
|
|
fe0dde |
+ </ind:textfilecontent54_object>
|
|
|
fe0dde |
+</def-group>
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..4dee11bcfb
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml
|
|
|
fe0dde |
@@ -0,0 +1,39 @@
|
|
|
fe0dde |
+documentation_complete: true
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+prodtype: ol7,ol8,rhel7,rhel8,wrlinux1019
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+title: 'Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server'
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+description: |-
|
|
|
fe0dde |
+ Configure SSSD to demand a valid certificate from the server to
|
|
|
fe0dde |
+ protect the integrity of LDAP remote access sessions. By setting
|
|
|
fe0dde |
+ the ldap_tls_reqcert option in /etc/sssd/sssd.conf
|
|
|
fe0dde |
+ to <tt>demand</tt>.
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+rationale: |-
|
|
|
fe0dde |
+ Without a valid certificate presented to the LDAP client backend, the identity of a
|
|
|
fe0dde |
+ server can be forged compromising LDAP remote access sessions.
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+severity: medium
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+identifiers:
|
|
|
fe0dde |
+ cce@rhel7: CCE-84061-1
|
|
|
fe0dde |
+ cce@rhel8: CCE-84062-9
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+references:
|
|
|
fe0dde |
+ stigid@ol7: OL07-00-040190
|
|
|
fe0dde |
+ disa: CCI-001453
|
|
|
fe0dde |
+ nist: SC-12(3),CM-6(a)
|
|
|
fe0dde |
+ srg: SRG-OS-000250-GPOS-00093
|
|
|
fe0dde |
+ stigid@rhel7: RHEL-07-040190
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+ocil_clause: 'the TLS reqcert is not set to demand'
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+ocil: |-
|
|
|
fe0dde |
+ To verify the LDAP client backend demands a valid certificate from the server in
|
|
|
fe0dde |
+ remote ldap access sessions, run the following command:
|
|
|
fe0dde |
+ $ sudo grep ldap_tls_reqcert /etc/sssd/sssd.conf
|
|
|
fe0dde |
+ The output should return the following:
|
|
|
fe0dde |
+ ldap_tls_reqcert = demand
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+platform: sssd-ldap
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ad_id_provider_and_reqcert_never.notapplicable.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ad_id_provider_and_reqcert_never.notapplicable.sh
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..3b82743f8d
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ad_id_provider_and_reqcert_never.notapplicable.sh
|
|
|
fe0dde |
@@ -0,0 +1,7 @@
|
|
|
fe0dde |
+#!/bin/bash
|
|
|
fe0dde |
+# profiles = xccdf_org.ssgproject.content_profile_stig
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+. $SHARED/setup_config_files.sh
|
|
|
fe0dde |
+setup_correct_sssd_config
|
|
|
fe0dde |
+sed -i 's/ldap_tls_reqcert = demand/ldap_id_use_start_tls = never/' /etc/sssd/sssd.conf
|
|
|
fe0dde |
+sed -i 's/id_provider = ldap/id_provider = ad/' /etc/sssd/sssd.conf
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/correct_value.pass.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/correct_value.pass.sh
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..82bff74acf
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/correct_value.pass.sh
|
|
|
fe0dde |
@@ -0,0 +1,5 @@
|
|
|
fe0dde |
+#!/bin/bash
|
|
|
fe0dde |
+# profiles = xccdf_org.ssgproject.content_profile_stig
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+. $SHARED/setup_config_files.sh
|
|
|
fe0dde |
+setup_correct_sssd_config
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/id_provider_is_set_to_ad.notapplicable.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/id_provider_is_set_to_ad.notapplicable.sh
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..21f3af4c96
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/id_provider_is_set_to_ad.notapplicable.sh
|
|
|
fe0dde |
@@ -0,0 +1,6 @@
|
|
|
fe0dde |
+#!/bin/bash
|
|
|
fe0dde |
+# profiles = xccdf_org.ssgproject.content_profile_stig
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+. $SHARED/setup_config_files.sh
|
|
|
fe0dde |
+setup_correct_sssd_config
|
|
|
fe0dde |
+sed -i 's/id_provider = ldap/id_provider = ad/' /etc/sssd/sssd.conf
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_id_provider_and_reqcert_never.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_id_provider_and_reqcert_never.fail.sh
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..0fe620475e
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_id_provider_and_reqcert_never.fail.sh
|
|
|
fe0dde |
@@ -0,0 +1,6 @@
|
|
|
fe0dde |
+#!/bin/bash
|
|
|
fe0dde |
+# profiles = xccdf_org.ssgproject.content_profile_stig
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+. $SHARED/setup_config_files.sh
|
|
|
fe0dde |
+setup_correct_sssd_config
|
|
|
fe0dde |
+sed -i 's/ldap_tls_reqcert = demand/ldap_id_use_start_tls = never/' /etc/sssd/sssd.conf
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_tls_reqcert_not_there.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_tls_reqcert_not_there.fail.sh
|
|
|
fe0dde |
new file mode 100644
|
|
|
fe0dde |
index 0000000000..0e01fafb6f
|
|
|
fe0dde |
--- /dev/null
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/ldap_tls_reqcert_not_there.fail.sh
|
|
|
fe0dde |
@@ -0,0 +1,6 @@
|
|
|
fe0dde |
+#!/bin/bash
|
|
|
fe0dde |
+# profiles = xccdf_org.ssgproject.content_profile_stig
|
|
|
fe0dde |
+
|
|
|
fe0dde |
+. $SHARED/setup_config_files.sh
|
|
|
fe0dde |
+setup_correct_sssd_config
|
|
|
fe0dde |
+sed -i '/ldap_tls_reqcert/d' /etc/sssd/sssd.conf
|
|
|
fe0dde |
diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
|
|
|
fe0dde |
index b820d30608..1b41b85857 100644
|
|
|
fe0dde |
--- a/rhel7/profiles/stig.profile
|
|
|
fe0dde |
+++ b/rhel7/profiles/stig.profile
|
|
|
fe0dde |
@@ -236,6 +236,7 @@ selections:
|
|
|
fe0dde |
- sssd_ldap_start_tls.severity=medium
|
|
|
fe0dde |
- sssd_ldap_configure_tls_ca_dir
|
|
|
fe0dde |
- sssd_ldap_configure_tls_ca
|
|
|
fe0dde |
+ - sssd_ldap_configure_tls_reqcert
|
|
|
fe0dde |
- sysctl_kernel_randomize_va_space
|
|
|
fe0dde |
- package_openssh-server_installed
|
|
|
fe0dde |
- sshd_required=yes
|
|
|
fe0dde |
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
|
|
fe0dde |
index 4609b82680..7ab5eb179e 100644
|
|
|
fe0dde |
--- a/shared/references/cce-redhat-avail.txt
|
|
|
fe0dde |
+++ b/shared/references/cce-redhat-avail.txt
|
|
|
fe0dde |
@@ -650,8 +650,6 @@ CCE-84057-9
|
|
|
fe0dde |
CCE-84058-7
|
|
|
fe0dde |
CCE-84059-5
|
|
|
fe0dde |
CCE-84060-3
|
|
|
fe0dde |
-CCE-84061-1
|
|
|
fe0dde |
-CCE-84062-9
|
|
|
fe0dde |
CCE-84063-7
|
|
|
fe0dde |
CCE-84064-5
|
|
|
fe0dde |
CCE-84065-2
|
|
|
fe0dde |
diff --git a/tests/shared/sssd.conf b/tests/shared/sssd.conf
|
|
|
fe0dde |
index dc51456425..6903a25d37 100644
|
|
|
fe0dde |
--- a/tests/shared/sssd.conf
|
|
|
fe0dde |
+++ b/tests/shared/sssd.conf
|
|
|
fe0dde |
@@ -9,6 +9,7 @@ ldap_search_base = dc=com
|
|
|
fe0dde |
ldap_tls_cacertdir = /etc/openldap/cacerts
|
|
|
fe0dde |
cache_credentials = True
|
|
|
fe0dde |
krb5_store_password_if_offline = True
|
|
|
fe0dde |
+ldap_tls_reqcert = demand
|
|
|
fe0dde |
|
|
|
fe0dde |
|
|
|
fe0dde |
[sssd]
|
|
|
fe0dde |
|
|
|
fe0dde |
From daf742ec9dad984e17e8a99bd7793bc9f44a32c4 Mon Sep 17 00:00:00 2001
|
|
|
fe0dde |
From: Gabriel Becker <ggasparb@redhat.com>
|
|
|
fe0dde |
Date: Mon, 21 Sep 2020 17:24:08 +0200
|
|
|
fe0dde |
Subject: [PATCH 2/2] Use oval_metadata macro and update text of rule
|
|
|
fe0dde |
sssd_ldap_configure_tls_reqcert.
|
|
|
fe0dde |
|
|
|
fe0dde |
---
|
|
|
fe0dde |
.../sssd_ldap_configure_tls_reqcert/oval/shared.xml | 7 ++-----
|
|
|
fe0dde |
.../sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml | 4 ++--
|
|
|
fe0dde |
2 files changed, 4 insertions(+), 7 deletions(-)
|
|
|
fe0dde |
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml
|
|
|
fe0dde |
index 9d3db0488f..688cf17abb 100644
|
|
|
fe0dde |
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml
|
|
|
fe0dde |
@@ -1,10 +1,7 @@
|
|
|
fe0dde |
<def-group>
|
|
|
fe0dde |
<definition class="compliance" id="sssd_ldap_configure_tls_reqcert" version="1">
|
|
|
fe0dde |
- <metadata>
|
|
|
fe0dde |
- <title>Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server</title>
|
|
|
fe0dde |
- {{{- oval_affected(products) }}}
|
|
|
fe0dde |
- <description>Configure SSSD to request a valid certificate from the server to protect LDAP remote access sessions.</description>
|
|
|
fe0dde |
- </metadata>
|
|
|
fe0dde |
+ {{{ oval_metadata("Configure SSSD to request a valid certificate from the server to protect LDAP remote access sessions.",
|
|
|
fe0dde |
+ title="Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server") }}}
|
|
|
fe0dde |
<criteria>
|
|
|
fe0dde |
<criterion test_ref="test_sssd_ldap_tls_reqcert" />
|
|
|
fe0dde |
</criteria>
|
|
|
fe0dde |
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml
|
|
|
fe0dde |
index 4dee11bcfb..731b7c0846 100644
|
|
|
fe0dde |
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml
|
|
|
fe0dde |
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml
|
|
|
fe0dde |
@@ -6,7 +6,7 @@ title: 'Configure SSSD LDAP Backend Client to Demand a Valid Certificate from th
|
|
|
fe0dde |
|
|
|
fe0dde |
description: |-
|
|
|
fe0dde |
Configure SSSD to demand a valid certificate from the server to
|
|
|
fe0dde |
- protect the integrity of LDAP remote access sessions. By setting
|
|
|
fe0dde |
+ protect the integrity of LDAP remote access sessions by setting
|
|
|
fe0dde |
the ldap_tls_reqcert option in /etc/sssd/sssd.conf
|
|
|
fe0dde |
to <tt>demand</tt>.
|
|
|
fe0dde |
|
|
|
fe0dde |
@@ -31,7 +31,7 @@ ocil_clause: 'the TLS reqcert is not set to demand'
|
|
|
fe0dde |
|
|
|
fe0dde |
ocil: |-
|
|
|
fe0dde |
To verify the LDAP client backend demands a valid certificate from the server in
|
|
|
fe0dde |
- remote ldap access sessions, run the following command:
|
|
|
fe0dde |
+ remote LDAP access sessions, run the following command:
|
|
|
fe0dde |
$ sudo grep ldap_tls_reqcert /etc/sssd/sssd.conf
|
|
|
fe0dde |
The output should return the following:
|
|
|
fe0dde |
ldap_tls_reqcert = demand
|