If AIX is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-215174	AIX7-00-001007	SV-215174r877397_rule		High

Description
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.

STIG	Date
IBM AIX 7.x Security Technical Implementation Guide	2023-05-17

Details

Check Text ( C-16372r293973_chk )
Examine the LDAP configuration file "/etc/security/ldap/ldap.cfg" for possible clear-text password for "bindpwd". From the command prompt, run the following command: # grep ^bindpwd: /etc/security/ldap/ldap.cfg The above command should yield the following output: bindpwd:{DESv2}57AEE2BCED 764373462FC7B62736D9A If the returned entry has an unencrypted password (the output line does not start with "bindpwd:{DES"), this is a finding. Examine the LDAP configuration file "/etc/security/ldap/ldap.cfg" for using stashed password for SSL key database (KDB). Check for "ldapsslkeypwd" in LDAP config file using the follow command: # grep '^ldapsslkeypwd' /etc/security/ldap/ldap.cfg If the command returned a line, this is a finding.

Check Text ( C-16372r293973_chk )

Examine the LDAP configuration file "/etc/security/ldap/ldap.cfg" for possible clear-text password for "bindpwd".

From the command prompt, run the following command:
# grep ^bindpwd: /etc/security/ldap/ldap.cfg

The above command should yield the following output:
bindpwd:{DESv2}57AEE2BCED 764373462FC7B62736D9A

If the returned entry has an unencrypted password (the output line does not start with "bindpwd:{DES"), this is a finding.

Examine the LDAP configuration file "/etc/security/ldap/ldap.cfg" for using stashed password for SSL key database (KDB).

Check for "ldapsslkeypwd" in LDAP config file using the follow command:
# grep '^ldapsslkeypwd' /etc/security/ldap/ldap.cfg

If the command returned a line, this is a finding.

Fix Text (F-16370r293974_fix)
To remove the clear-text password for "bindpwd", do the following two steps: Edit "/etc/security/ldap/ldap.cfg" to remove the "bindpwd" line and save the change; Re-config the LDAP client using the "mksecldap" command: # mksecldap -c -h -A -D -d -a -p -k -w Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: "gsk8capicmd" (used below), "gsk8capicmd_64" and "gsk7cmd". To use the stashed password for SSL key database (KDB), do the following two steps: Edit "/etc/security/ldap/ldap.cfg" to remove the "ldapsslkeypwd" line and save the change; Run the "gsk8capicmd" to create a stashed password file for the SSL KDB: # gsk8capicmd -keydb -stashpw -db -pw

Fix Text (F-16370r293974_fix)

To remove the clear-text password for "bindpwd", do the following two steps:
Edit "/etc/security/ldap/ldap.cfg" to remove the "bindpwd" line and save the change;

Re-config the LDAP client using the "mksecldap" command:
# mksecldap -c -h -A -D -d -a -p -k -w

Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: "gsk8capicmd" (used below), "gsk8capicmd_64" and "gsk7cmd".

To use the stashed password for SSL key database (KDB), do the following two steps:
Edit "/etc/security/ldap/ldap.cfg" to remove the "ldapsslkeypwd" line and save the change;

Run the "gsk8capicmd" to create a stashed password file for the SSL KDB:
# gsk8capicmd -keydb -stashpw -db -pw