0090-ldap-uninstalled-LDAP Installed¶

Rule ID¶

• 0090-ldap-uninstalled

Category¶

• system

Level¶

• warn

Supported Versions¶

• Linux

Description¶

• The Lightweight Directory Access Protocol (LDAP) is introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• If the system does not need to act as an LDAP server, it is recommended to remove the software to reduce the potential attack surface.

Risk Items¶

• Increased attack surface

Audit Method¶

• Run the following command to verify that the corresponding component is not installed:

  # rpm -q openldap-servers
  package openldap-servers is not installed
  

Remediation¶

• Run the following command to remove the corresponding package:

  # yum remove openldap-servers
  

Impact¶

• For more detailed documentation on OpenLDAP, please visit the project homepage: http://www.openldap.org.

Default Value¶

• None

References¶

• None

CIS Controls¶

• Version 7

  9.2 Ensure Only Approved Ports, Protocols, and Services Are Running Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.