Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

The LDAP client must use a TLS connection using trust certificates signed by the site CA.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

The LDAP client must use a TLS connection using trust certificates signed by the site CA.

Description

Discussion Text

The tls_cacertdir or tls_cacertfile directives are required when tls_checkpeer is configured (which is the default for openldap versions 2.1 and up). These directives define the path to the trust certificates signed by the site CA.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-219564

Rule

SV-219564r793821_rule

Severity

medium

Rule Version

OL6-00-000253

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If the system does not use LDAP for authentication or account information, this is not applicable.

To ensure TLS is configured with trust certificates, run the following command: 

# grep cert /etc/pam_ldap.conf

If there is no output, or the lines are commented out, this is a finding.

Implementation Procedure

Fix Text

Ensure a copy of the site's CA certificate has been placed in the file "/etc/pki/tls/CA/cacert.pem". Configure LDAP to enforce TLS use and to trust certificates signed by the site's CA. First, edit the file "/etc/pam_ldap.conf", and add or correct either of the following lines: 

tls_cacertdir /etc/pki/tls/CA

or 

tls_cacertfile /etc/pki/tls/CA/cacert.pem

Then review the LDAP server and ensure TLS has been configured.

STIG check 233 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-219563The system clock must be synchronized to an authoritative DoD time source.Next · V-219565 →The noexec option must be added to removable media partitions.