SV-37632r1: If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate with a valid trust path to a trusted CA. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate with a valid trust path to a trusted CA.

Description

Discussion Text

The NSS LDAP service provides user mappings which are a vital component of system security. Communication between an LDAP server and a host using LDAP for NSS require authentication.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000185

Additional Details

Responsibility

System Administrator

IA Controls

DCNR-1

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:422
# If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate with a valid trust path to a trusted CA.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# The system is using NSS LDAP
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '^[^#

]*ldap' '/etc/nsswitch.conf' &>/dev/null
}
# The LDAP TLS connection must require that the server provides a certificate and that this certificate has a valid trust path to a trusted CA.
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -Pq '^[^#]*tls_checkpeer[ 	]+yes' '/etc/ldap.conf' &>/dev/null
}

if ! ( test_1 || test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# oval:mil.disa.fso.rhel11:def:422 compliant Shell script
if grep -q "^[^#]*tls_checkpeer[ \t]+yes" /etc/ldap.conf; then echo "PASS"; exit 0; fi; echo "FAIL"; exit 1

Remediation

Edit "/etc/ldap.conf" and add or set the "tls_checkpeer" setting to "yes".