If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22556	GEN008000	SV-38830r1_rule	DCNR-1	Medium

Description
LDAP can be used to provide user authentication and account information, which are vital to system security. Communication between an LDAP server and a host using LDAP requires authentication.

STIG	Date
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2017-12-08

Details

Check Text ( C-37083r1_chk )
Check if the system is using LDAP authentication. #grep LDAP /etc/security/user If no lines are returned, this vulnerability is not applicable. Check if the useSSL option is enabled. #grep '^useSSL' /etc/security/ldap/ldap.cfg If yes is not the returned value, this is a finding. Verify a certificate is used for client authentication to the server. #grep -I '^ldapsslkeyf' /etc/security/ldap/ldap.cfg If no line is found, this is a finding. List the certificate issuer with IBM GSK. #gsk7cmd -cert -list CA -db -pw Make note of the client Key Label. #gsk7cmd -cert -details -showOID -db -pw -label If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.

Check Text ( C-37083r1_chk )

Check if the system is using LDAP authentication.

#grep LDAP /etc/security/user
If no lines are returned, this vulnerability is not applicable.

Check if the useSSL option is enabled.
#grep '^useSSL' /etc/security/ldap/ldap.cfg
If yes is not the returned value, this is a finding.

Verify a certificate is used for client authentication to the server.
#grep -I '^ldapsslkeyf' /etc/security/ldap/ldap.cfg
If no line is found, this is a finding.

List the certificate issuer with IBM GSK.
#gsk7cmd -cert -list CA -db -pw

Make note of the client Key Label.
#gsk7cmd -cert -details -showOID -db -pw -label

If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.

Fix Text (F-32355r1_fix)
Create a key database with DoD PKI or DoD-approved certificate. #gsk7cmd OR #ikeyman Edit /etc/security/ldap/ldap.conf and add or edit the ldapsslkeyf setting to reference a file containing a client certificate issued by DoD PKI or a DoD-approved external PKI.