If the system is using LDAP for authentication or account information, the system must use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for protecting the LDAP connection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-23828	GEN007970	SV-46284r1_rule	DCNR-1	Medium

Description
LDAP can be used to provide user authentication and account information, which are vital to system security. Cryptographic modules used by the system must be validated by the NIST CVMP as compliant with FIPS 140-2. Cryptography performed by invalidated modules is viewed by NIST as providing no protection for the data.

STIG	Date
SUSE Linux Enterprise Server v11 for System z	2012-12-13

Details

Check Text ( C-36824r1_chk )
Determine if the system uses NSS LDAP. If it does not, this is not applicable. If the system does use NSS LDAP then the "tls_cypher" must be a FIPS 140-2 validated cryptographic module. The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy. Procedure: # grep -v '^#' /etc/nsswitch.conf \| grep ldap If no lines are returned, this vulnerability is not applicable. Examine the content of "/etc/ldap.conf". If the "tls_cipher" line is commented or uncommented and the cipher is not a FIPS 140-2 validated cryptographic module (operating in FIPS mode), this is a finding.

Check Text ( C-36824r1_chk )

Determine if the system uses NSS LDAP. If it does not, this is not applicable. If the system does use NSS LDAP then the "tls_cypher" must be a FIPS 140-2 validated cryptographic module. The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy.

Procedure:
# grep -v '^#' /etc/nsswitch.conf | grep ldap
If no lines are returned, this vulnerability is not applicable.

Examine the content of "/etc/ldap.conf". If the "tls_cipher" line is commented or uncommented and the cipher is not a FIPS 140-2 validated cryptographic module (operating in FIPS mode), this is a finding.

Fix Text (F-31662r1_fix)
Configure the system to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for protecting the NSS LDAP connection.