If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22556	GEN008000	SV-38830r1_rule	DCNR-1	Medium

Description
LDAP can be used to provide user authentication and account information, which are vital to system security. Communication between an LDAP server and a host using LDAP requires authentication.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-37083r1_chk )
Check if the system is using LDAP authentication. #grep LDAP /etc/security/user If no lines are returned, this vulnerability is not applicable. Check if the useSSL option is enabled. #grep ^useSSL /etc/security/ldap/ldap.cfg If ‘yes’ is not the returned value, this is a finding. Verify a certificate is used for client authentication to the server. #grep –I ‘^ldapsslkeyf’ /etc/security/ldap/ldap.cfg If no line is found, this is a finding. List the certificate issuer with IBM GSK. #gsk7cmd –cert –list CA –db -pw Make note of the client Key Label #gsk7cmd –cert –details –showOID –db -pw -label If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.

Check Text ( C-37083r1_chk )

Check if the system is using LDAP authentication.

#grep LDAP /etc/security/user
If no lines are returned, this vulnerability is not applicable.

Check if the useSSL option is enabled.
#grep ^useSSL /etc/security/ldap/ldap.cfg
If ‘yes’ is not the returned value, this is a finding.

Verify a certificate is used for client authentication to the server.
#grep –I ‘^ldapsslkeyf’ /etc/security/ldap/ldap.cfg
If no line is found, this is a finding.

List the certificate issuer with IBM GSK.
#gsk7cmd –cert –list CA –db -pw

Make note of the client Key Label
#gsk7cmd –cert –details –showOID –db -pw -label

If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.

Fix Text (F-32355r1_fix)
Create a key database with DoD PKI or DoD-approved certificate. #gsk7cmd OR #ikeyman Edit /etc/security/ldap/ldap.conf and add or edit the ldapsslkeyf setting to reference a file containing a client certificate issued by DoD PKI or a DoD-approved external PKI.