SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

The SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide (V1 R12) has 550 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

550STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R12

CurrentPublished Fri Oct 26 2018

If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must not have an extended ACL.

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Assessment Title

Rule Text

If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must not have an extended ACL.

Description

Discussion Text

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-22570

Rule

SV-46037r1_rule

Severity

medium

Rule Version

GEN008280

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Determine the certificate file.
# grep -i '^tls_cert' /etc/ldap.conf
Check the permissions.
# ls -lL <certpath>
If the mode of the file contains a '+', an extended ACL is present. This is a finding.

Implementation Procedure

Fix Text

Remove the extended ACL from the certificate file.

Procedure:
For each certificate file found remove all extended permissions.

# setfacl --remove-all <certpath>

STIG check 290 of 550 in the SUSE Linux Enterprise Server v11 for System z STIG checklist

← Previous · V-22569If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must have mode 0644 or less permissive.Next · V-22571 →If the system is using LDAP for authentication or account information, the LDAP TLS key file must be owned by root.