The LDAP client must use a TLS connection using FIPS 140-2 approved cryptographic algorithms.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The LDAP client must use a TLS connection using FIPS 140-2 approved cryptographic algorithms.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
RHEL-06-000250	RHEL-06-000250	RHEL-06-000250_rule		Medium

Description
The ssl directive specifies whether to use ssl or not. If not specified it will default to no. It should be set to start_tls rather than doing LDAP over SSL.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2013-02-05

Details

Check Text ( C-RHEL-06-000250_chk )
If the system does not use LDAP for authentication or account information, this is not applicable. To ensure LDAP is configured to use TLS for all transactions, run the following command: $ grep start_tls /etc/pam_ldap.conf If no lines are returned, this is a finding.

Fix Text (F-RHEL-06-000250_fix)
Configure LDAP to enforce TLS use. First, edit the file "/etc/pam_ldap.conf", and add or correct the following lines: ssl start_tls Then review the LDAP server and ensure TLS has been configured.