<Group id="ldap">
<title>LDAP</title>
<description>LDAP is a popular directory service, that is, a
standardized way of looking up information from a central database.
Red Hat Enterprise Linux 5 includes software that enables a system to act as both
an LDAP client and server.
</description>

<Group id="openldap_client">
<title>Configure OpenLDAP Clients</title>
<description>This section provides information on which security settings are
important to configure in OpenLDAP clients by manually editing the appropriate
configuration files.  Red Hat Enterprise Linux 5 provides an automated configuration tool called
authconfig and a graphical wrapper for authconfig called
<tt>system-config-authentication</tt>. However, these tools do not provide as
much control over configuration as manual editing of configuration files. The
authconfig tools do not allow you to specify locations of SSL certificate
files, which is useful when trying to use SSL cleanly across several protocols.
Installation and configuration of OpenLDAP on Red Hat Enterprise Linux 5 is available at
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/Deployment_Guide/ch-ldap.html.
</description>
<warning category="general">Before configuring any system to be an
LDAP client, ensure that a working LDAP server is present on the
network.</warning>

<Rule id="ldap_client_start_tls" severity="medium">
<title>Configure LDAP Client to Use TLS For All Transactions</title>
<description>Configure LDAP to enforce TLS use. First, edit the file 
<tt>/etc/ldap.conf</tt>, and add or correct the following lines:
<pre>ssl start_tls</pre>
Then review the LDAP server and ensure TLS has been configured.
</description>
<ocil clause="no lines are returned">
To ensure LDAP is configured to use TLS for all transactions, run the following command:
<pre>$ grep start_tls /etc/ldap.conf</pre>
</ocil>
<rationale>The ssl directive specifies whether to use ssl or not. If
not specified it will default to no. It should be set to start_tls rather
than doing LDAP over SSL.</rationale>
<ref nist="DCNR-1" disa="1453" />
<ident stig="GEN007980" />
<oval id="ldap_client_start_tls" />
</Rule>

<Rule id="ldap_client_tls_cert" severity="medium">
<title>Configure Certificate Directives for LDAP Use of TLS</title>
<description>Ensure a copy of a trusted CA certificate has been placed in
the file <tt>/etc/pki/tls/CA/cacert.pem</tt>. Configure LDAP to enforce TLS 
use and to trust certificates signed by that CA. First, edit the file 
<tt>/etc/ldap.conf</tt>, and add or correct either of the following lines:
<pre>tls_cert /etc/pki/tls/CA</pre>
or
<pre>tls_cert /etc/pki/tls/CA/cacert.pem</pre>
</description>
<ocil clause="there is no output, or the lines are commented out">
To ensure TLS is configured with trust certificates, run the following command:
<pre># grep tls_cert /etc/ldap.conf</pre>
</ocil>
<rationale>LDAP can be used to provide user authentication and account information, 
which are vital to system security. Communication between an LDAP server and a host 
using LDAP requires authentication.</rationale>
<ref nist="DCNR-1" disa="185" />
<ident stig="GEN008000" />
<oval id="ldap_client_tls_cert" />
</Rule>

<Rule id="ldap_client_tls_checkpeer" severity="medium">
<title>Configure Certificate Trust Validation</title>
<description>Ensure LDAP server connections have a valid trust path. 
Configure LDAP to enforce validation of LDAP server certificates for trust. 
First, edit the file <tt>/etc/ldap.conf</tt>, and add or correct the following line:
<pre>tls_checkpeer yes</pre>
</description>
<ocil clause="there is no output, or the lines are commented out">
To ensure TLS is configured to check for trusted certificates, run the following command:
<pre># grep tls_checkpeer /etc/ldap.conf</pre>
</ocil>
<rationale>The NSS LDAP service provides user mappings which are a vital component 
of system security.  Communication between an LDAP server and a host using LDAP for 
NSS require authentication.</rationale>
<ref nist="DCNR-1" disa="185" />
<ident stig="GEN008020" />
<oval id="ldap_client_tls_checkpeer" />
</Rule>

<Rule id="ldap_client_tls_crlcheck" severity="medium">
<title>Configure Certificate Revocation Validation</title>
<description>Ensure LDAP server connections have a valid certificate that is not revoked. 
Configure LDAP to enforce validation of LDAP server certificates for revocation. 
First, edit the file <tt>/etc/ldap.conf</tt>, and add or correct the following line:
<pre>tls_crlcheck all</pre>
</description>
<ocil clause="there is no output, or the lines are commented out">
To ensure TLS is configured to check for revoked certificates, run the following command:
<pre># grep tls_crlcheck /etc/ldap.conf</pre>
</ocil>
<rationale>LDAP can be used to provide user authentication and account information, which 
are vital to system security. Communication between an LDAP server and a host using LDAP 
requires authentication.</rationale>
<ref nist="DCNR-1" disa="185" />
<ident stig="GEN008040" />
<oval id="ldap_client_tls_crlcheck" />
</Rule>

<Rule id="ldap_client_bindpw" severity="medium">
<title>LDAP Passwords Are Stored In Clear Text</title>
<description>Ensure the LDAP configuration does not include any passwords stored in clear text. 
Edit the file <tt>/etc/ldap.conf</tt>, and remove any lines that include the 
<tt>bindpw</tt> directive.
</description>
<ocil clause="there is no output, or the lines are commented out">
To ensure no passwords are stored in clear text, run the following command:
<pre># grep bindpw /etc/ldap.conf</pre>
</ocil>
<rationale>The authentication of automated LDAP connections between systems must 
not use passwords since more secure methods are available, such as PKI and Kerberos. 
Additionally, the storage of unencrypted passwords on the system is not permitted.</rationale>
<ref nist="IAIA-1,IAIA-2" disa="196" />
<ident stig="GEN008050" />
<oval id="ldap_client_bindpw" />
</Rule>

</Group><!--End <Group id="openldap_client"> -->

</Group>
