>From d3601930f23be03901ae22d9c59d5450e2e81048 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 16 Nov 2012 07:24:47 -0500 Subject: [PATCH 09/13] DISA FSO provided copy editing of RHEL6/input/services/ldap.xml DISA FSO provided copy editing of RHEL6/input/services/ldap.xml --- RHEL6/input/services/ldap.xml | 50 ++++++++++++++++++++-------------------- 1 files changed, 25 insertions(+), 25 deletions(-) diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml index 32ee060..633d352 100644 --- a/RHEL6/input/services/ldap.xml +++ b/RHEL6/input/services/ldap.xml @@ -28,12 +28,12 @@ network. Configure LDAP to Use TLS For All Transactions Configure LDAP to enforce TLS use. First, edit the file -/etc/pam_ldap.conf, and add or correct the following lines: +/etc/pam_ldap.conf, and add or correct the following lines.
ssl start_tls
Then review the LDAP server and ensure TLS has been configured.
-To ensure LDAP is configured to use TLS for all transactions, run the following command: +To ensure LDAP is configured to use TLS for all transactions, run the following command.
$ grep start_tls /etc/pam_ldap.conf
The ssl directive specifies whether to use ssl or not. If @@ -50,14 +50,14 @@ than doing LDAP over SSL. Ensure a copy of the site's CA certificate has been placed in the file /etc/pki/tls/CA/cacert.pem. Configure LDAP to enforce TLS use and to trust certificates signed by the site's CA. First, edit the file -/etc/pam_ldap.conf, and add or correct either of the following lines: +/etc/pam_ldap.conf, and add or correct either of the following lines.
tls_cacertdir /etc/pki/tls/CA
or
tls_cacertfile /etc/pki/tls/CA/cacert.pem
Then review the LDAP server and ensure TLS has been configured.
-To ensure TLS is configured with trust certificates, run the following command: +To ensure TLS is configured with trust certificates, run the following command.
# grep cert /etc/pam_ldap.conf
The tls_cacertdir or tls_cacertfile directives are required when @@ -84,7 +84,7 @@ securing an OpenLDAP infrastructure nonetheless. Uninstall openldap-servers Package The openldap-servers package should be removed if not in use. -Is this machine the OpenLDAP server? If not, remove the package: +Is this machine the OpenLDAP server? If not, remove the package.
# yum erase openldap-servers
The openldap-servers RPM is not installed by default on RHEL6 machines. It is needed only by the OpenLDAP server, not by the @@ -93,9 +93,9 @@ intended for use as an LDAP Server it should be removed.
To verify the openldap-servers package is not installed, -run the following command: +run the following command.
$ rpm -q openldap-servers
-The output should show: +The output should show the following.
package openldap-servers is not installed
Unnecessary packages should not be installed to decrease the attack surface of the system. @@ -130,7 +130,7 @@ ensure that the configuration files are protected from unauthorized access or modification.

Edit the ldap configuration file at /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif. -Ensure that the configuration file has reasonable permissions: +Ensure that the configuration file has reasonable permissions.
# chown root:ldap /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif
 # chmod 640 /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif
Protect configuration files containing the hashed password the same way you would protect other files, such as @@ -146,14 +146,14 @@ Protect configuration files containing the hashed password the same way you woul Is this system an OpenLDAP server? If so, ensure that the RootDN uses a secure password.

-Generate a hashed password using the slappasswd utility: +Generate a hashed password using the slappasswd utility.
# slappasswd
 New password:
 Re-enter new password:
This will output a hashed password string.

Edit the file /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif, and add or correct -the line: +the line.
olcRootPW: {SSHA}hashed-password-string
Be sure to select a secure password for the LDAP root user, since this user has permission to read and write all LDAP data, so a compromise of the LDAP root password will probably enable a full compromise of your site. @@ -166,23 +166,23 @@ In addition, be sure to use a reasonably strong hash function. The default hash Protect LDAP Certificate Files -Create the PKI directory for LDAP certificates if it does not already exist: +Create the PKI directory for LDAP certificates if it does not already exist.
# mkdir /etc/pki/tls/ldap
 # chown root:root /etc/pki/tls/ldap
 # chmod 755 /etc/pki/tls/ldap
Using removable media or some other secure transmission format, install the files generated in the previous -step onto the LDAP server: +step onto the LDAP server.
  • /etc/pki/tls/ldap/serverkey.pem: the private key ldapserverkey.pem
  • /etc/pki/tls/ldap/servercert.pem: the certificate file ldapservercert.pem
-Verify the ownership and permissions of these files: +Verify the ownership and permissions of these files.
# chown root:ldap /etc/pki/tls/ldap/serverkey.pem
 # chown root:ldap /etc/pki/tls/ldap/servercert.pem
 # chmod 640 /etc/pki/tls/ldap/serverkey.pem
 # chmod 640 /etc/pki/tls/ldap/servercert.pem
Verify that the CA's public certificate file has been installed as /etc/pki/tls/CA/cacert.pem, and has the -correct permissions: +correct permissions.
# mkdir /etc/pki/tls/CA
 # chown root:root /etc/pki/tls/CA/cacert.pem
 # chmod 644 /etc/pki/tls/CA/cacert.pem
@@ -209,7 +209,7 @@ LDAP server process would need to be restarted manually whenever the server rebo Create Top-level LDAP Structure for Domain -Create a structure for the domain itself with at least the following attributes: +Create a structure for the domain itself with at least the following attributes.
dn: dc=example,dc=com
 objectClass: dcObject
 objectClass: organization
@@ -225,7 +225,7 @@ any other entries for the domain.
 
 
 Create LDAP Structures for Users and Groups
-Create LDAP structures for people (users) and for groups with at least the following attributes:
+Create LDAP structures for people (users) and for groups with at least the following attributes.
 
dn: ou=people,dc=example,dc=com
 ou: people
 structuralObjectClass: organizationalUnit
@@ -274,7 +274,7 @@ but only for user accounts which are to be shared across machines, and which hav
 
 
 Create Unix Groups
-For each Unix group, create an LDAP entry with at least the following attributes:
+For each Unix group, create an LDAP entry with at least the following attributes.
 
dn: cn=groupname ,ou=groups,dc=example,dc=com
 cn: groupname
 structuralObjectClass: posixGroup
@@ -298,7 +298,7 @@ or which are shared across systems.
 
 Create Groups to Administer LDAP
 If a group of LDAP administrators is desired, that group must be created somewhat differently.
-The specification should have these attributes:
+The specification should have these attributes.
 
dn: cn=admins ,ou=groups,dc=example,dc=com
 cn: admins
 structuralObjectClass: groupOfUniqueNames
@@ -320,9 +320,9 @@ auditing and error detection, it is recommended that LDAP administrators have un
 
 
 Configure slapd to Protect Authentication Information
-Use ldapmodify to add these entries to the database. Add or correct the following access specifications:
+Use ldapmodify to add these entries to the database. Add or correct the following access specifications.
 1. Protect the user's password by allowing the user himself or the LDAP administrators to change it,
-allowing the anonymous user to authenticate against it, and allowing no other access:
+allowing the anonymous user to authenticate against it, and allowing no other access.
 
olcAccess: to attrs=userPassword
     by self write
     by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
@@ -332,7 +332,7 @@ olcAccess: to attrs=shadowLastChange
     by self write
     by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
     by * read
-2. Allow anyone to read other information, and allow the administrators to change it: +2. Allow anyone to read other information, and allow the administrators to change it.
olcAccess: to *
     by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
     by * read
@@ -349,7 +349,7 @@ be able to change data without an explicit access statement. Correct Permissions on LDAP Server Files -Correct the permissions on the ldap server's files: +Correct the permissions on the ldap server's files.
# chown ldap:root /var/lib/ldap/*
Some manual methods of inserting information into the LDAP database may leave these files with incorrect permissions. This will prevent slapd from starting correctly. @@ -384,10 +384,10 @@ by connecting to the primary port and issuing the STARTTLS command. Configure Logging for LDAP
    -
  1. Edit the file /etc/rsyslog.conf. Add or correct the following line: +
  2. Edit the file /etc/rsyslog.conf. Add or correct the following line.
    local4.*
  3. -
  4. Create the log file with safe permissions: +
  5. Create the log file with safe permissions.
    # touch /var/log/ldap.log
     # chown root:root /var/log/ldap.log
     # chmod 0600 /var/log/ldap.log
    @@ -396,7 +396,7 @@ by connecting to the primary port and issuing the STARTTLS command.
    /var/log/ldap.log
    to the space-separated list in the first line.
  6. Edit the LDAP configuration file /etc/openldap/slapd.conf and set a reasonable set of default log -parameters, such as: +parameters, such as the following.
    loglevel stats2
-- 1.7.1