Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/services/ldap.xml | 351 +++++------------------------------------
1 files changed, 37 insertions(+), 314 deletions(-)
diff --git a/RHEL6/input/services/ldap.xml b/RHEL6/input/services/ldap.xml
index e9bf33e..6eb1368 100644
--- a/RHEL6/input/services/ldap.xml
+++ b/RHEL6/input/services/ldap.xml
@@ -2,31 +2,29 @@
<title>LDAP</title>
<description>LDAP is a popular directory service, that is, a
standardized way of looking up information from a central database.
-It is relatively simple to configure a RHEL6 machine to obtain
-authentication information from an LDAP server. If your network
-uses LDAP for authentication, be sure to configure both clients and
-servers securely.</description>
+RHEL 6 includes software that enables a system to act as both
+an LDAP client and server.
+</description>
<Group id="openldap_client">
<title>Configure OpenLDAP Clients</title>
-<description>This guide recommends configuring OpenLDAP clients by
-manually editing the appropriate configuration files. RHEL6
-provides an automated configuration tool called authconfig and a
-graphical wrapper for authconfig called
-<tt>system-config-authentication</tt>. However, these tools do not give
-sufficient flexibility over configuration. The authconfig tools do
-not allow you to specify locations of SSL certificate files, which
-is useful when trying to use SSL cleanly across several protocols.
-They are also overly aggressive in placing services such as
-netgroups and automounter maps under LDAP control, where it is
-safer to use LDAP only for services to which it is relevant in your
-environment.</description>
-<warning category="general">Before configuring any machine to be an
+<description>This section provides information on which security settings are
+important to configure in OpenLDAP clients by manually editing the appropriate
+configuration files. RHEL 6 provides an automated configuration tool called
+authconfig and a graphical wrapper for authconfig called
+<tt>system-config-authentication</tt>. However, these tools do not provide
as
+much control over configuration as manual editing of configuration files. The
+authconfig tools do not allow you to specify locations of SSL certificate
+files, which is useful when trying to use SSL cleanly across several protocols.
+Installation and configuration of OpenLDAP on RHEL 6 is available at
+https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-Directory_Servers.html.
+</description>
+<warning category="general">Before configuring any system to be an
LDAP client, ensure that a working LDAP server is present on the
network.</warning>
<Rule id="ldap_client_start_tls" severity="medium">
-<title>Configure LDAP to Use TLS For All Transactions</title>
+<title>Configure LDAP Client to Use TLS For All Transactions</title>
<description>Configure LDAP to enforce TLS use. First, edit the file
<tt>/etc/pam_ldap.conf</tt>, and add or correct the following lines:
<pre>ssl start_tls</pre>
@@ -47,9 +45,9 @@ than doing LDAP over SSL.</rationale>
<Rule id="ldap_client_tls_cacertpath" severity="medium">
<title>Configure Certificate Directives for LDAP Use of TLS</title>
-<description>Ensure a copy of the site's CA certificate has been placed in
+<description>Ensure a copy of a trusted CA certificate has been placed in
the file <tt>/etc/pki/tls/CA/cacert.pem</tt>. Configure LDAP to enforce TLS
-use and to trust certificates signed by the site's CA. First, edit the file
+use and to trust certificates signed by that CA. First, edit the file
<tt>/etc/pam_ldap.conf</tt>, and add or correct either of the following
lines:
<pre>tls_cacertdir /etc/pki/tls/CA</pre>
or
@@ -74,11 +72,9 @@ site CA.</rationale>
<Group id="openldap_server">
<title>Configure OpenLDAP Server</title>
-<description>This section contains guidance on how to configure an
-OpenLDAP server to securely provide information for use in a
-centralized authentication service. This is not a comprehensive
-guide to maintaining an OpenLDAP server, but may be helpful in
-securing an OpenLDAP infrastructure nonetheless.
+<description>This section details some security-relevant settings
+for an OpenLDAP server. Installation and configuration of OpenLDAP on RHEL 6 is
available at:
+https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-Directory_Servers.html.
</description>
<Rule id="package_openldap-servers_removed">
@@ -98,80 +94,25 @@ run the following command:
The output should show the following:
<pre>package openldap-servers is not installed</pre>
</ocil>
-<rationale>Unnecessary packages should not be installed to decrease the attack
surface of the system.</rationale>
+<rationale>Unnecessary packages should not be installed to decrease the attack
+surface of the system. While this software is clearly essential on an LDAP
+server, it is not necessary on typical desktop or workstation systems.
+</rationale>
<ident cce="26858-1" />
<oval id="package_openldap-servers_removed" />
<ref nist="CM-7" disa="366"/>
<tested by="DS" on="20121024"/>
</Rule>
-<Rule id="ldap_server_config_olcsuffix">
-<title>Configure Domain-Specific Parameters</title>
-<description>The <tt>ldap</tt> server should be configured to use a
domain specific suffix.
-Is this system an OpenLDAP server? If so,
-edit the ldap configuration file at
-<tt>/etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif</tt>
-to include suffix information relevant to your domain:
-<pre>olcSuffix: "dc=example,dc=com "
-olcRootDN: "cn=Manager,dc=example,dc=com "</pre>
-where dc=example,dc=com is the same root you will use on the LDAP clients.
-<br />
-These are basic LDAP configuration directives. The suffix parameter gives the root name
of all information served by this LDAP server, and should be some name related to your
domain. The rootdn parameter names LDAP's privileged user, who is allowed to read or
write all data managed by this LDAP server.
-</description>
-<ident cce="27191-6" />
-<oval id="ldap_server_config_olcsuffix" />
-<ref nist="AC-2,CM-7" />
-</Rule>
-
-<Rule id="ldap_server_config_bdb_file_security">
-<title>LDAP Configuration File Security</title>
-<description>Is this system an OpenLDAP server? If so,
-ensure that the configuration files are protected from unauthorized
-access or modification.
-<br /><br />
-Edit the ldap configuration file at
<tt>/etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif</tt>.
-Ensure that the configuration file has reasonable permissions:
-<pre># chown root:ldap /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif
-# chmod 640 /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif</pre>
-Protect configuration files containing the hashed password the same way you would protect
other files, such as
-<tt>/etc/shadow</tt>, which contain hashed authentication data.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<oval id="ldap_server_config_bdb_file_security" />
-<ref nist="AC-6,CM-7" />
-</Rule>
-
-<Rule id="ldap_server_config_olcrootpw">
-<title>Configure LDAP Root Password</title>
-<description>Is this system an OpenLDAP server? If so,
-ensure that the RootDN uses a secure password.
-<br /><br />
-Generate a hashed password using the slappasswd utility:
-<pre># slappasswd
-New password:
-Re-enter new password:</pre>
-This will output a hashed password string.
-<br /><br />
-Edit the file
<tt>/etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif</tt>, and add or
correct
-the line:
-<pre>olcRootPW: {SSHA}hashed-password-string</pre>
-Be sure to select a secure password for the LDAP root user, since this user has
permission to read and write all
-LDAP data, so a compromise of the LDAP root password will probably enable a full
compromise of your site.
-In addition, be sure to use a reasonably strong hash function. The default hash function
should be used. The default hash function is a salted SHA-1 algorithm which is FIPS 160-1
compliant. Insecure schemes such as crypt should not be used.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<oval id="ldap_server_config_olcrootpw" />
-<ref nist="IA-2" />
-</Rule>
-<Rule id="ldap_server_config_certificate_files">
-<title>Protect LDAP Certificate Files</title>
+<Group id="ldap_server_config_certificate_files">
+<title>Install and Protect LDAP Certificate Files</title>
<description>Create the PKI directory for LDAP certificates if it does not already
exist:
<pre># mkdir /etc/pki/tls/ldap
# chown root:root /etc/pki/tls/ldap
# chmod 755 /etc/pki/tls/ldap</pre>
-Using removable media or some other secure transmission format, install the files
generated in the previous
-step onto the LDAP server:
+Using removable media or some other secure transmission format, install the certificate
files
+onto the LDAP server:
<ul>
<li><tt>/etc/pki/tls/ldap/serverkey.pem</tt>: the private key
<tt>ldapserverkey.pem</tt></li>
<li><tt>/etc/pki/tls/ldap/servercert.pem</tt>: the certificate file
<tt>ldapservercert.pem</tt></li>
@@ -181,239 +122,21 @@ Verify the ownership and permissions of these files:
# chown root:ldap /etc/pki/tls/ldap/servercert.pem
# chmod 640 /etc/pki/tls/ldap/serverkey.pem
# chmod 640 /etc/pki/tls/ldap/servercert.pem</pre>
-Verify that the CA's public certificate file has been installed as
<tt>/etc/pki/tls/CA/cacert.pem</tt>, and has the
-correct permissions:
+Verify that the CA's public certificate file has been installed as
+<tt>/etc/pki/tls/CA/cacert.pem</tt>, and has the correct permissions:
<pre># mkdir /etc/pki/tls/CA
# chown root:root /etc/pki/tls/CA/cacert.pem
# chmod 644 /etc/pki/tls/CA/cacert.pem</pre>
-As a result of these steps, the LDAP server will have access to its own private
certificate and the key with which
-that certificate is encrypted, and to the public certificate file belonging to the CA.
Note that it would be possible
-for the key to be protected further, so that processes running as ldap could not read it.
If this were done, the
-LDAP server process would need to be restarted manually whenever the server rebooted.
-</description>
-<ident cce="27082-7" />
-<ident cce="27096-7" />
-<ident cce="27129-6" />
-<ident cce="27051-2" />
-<ident cce="26859-9" />
-<ident cce="27116-3" />
-<ident cce="27083-5" />
-<ident cce="27111-4" />
-<ident cce="27068-6" />
-<ident cce="27076-9" />
-<ident cce="26989-4" />
-<ident cce="26895-3" />
-<oval id="ldap_server_config_certificate_files" />
-<ref nist="AC-6,SC-11,SC-12,SC-13,SC-17" />
-</Rule>
-<Group id="ldap_server_config_directory_domain">
-<title>Create Top-level LDAP Structure for Domain</title>
-<description>Create a structure for the domain itself with at least the following
attributes:
-<pre>dn: dc=example,dc=com
-objectClass: dcObject
-objectClass: organization
-dc: example
-o: Organization Description</pre>
-This is a placeholder for the root of the domain's LDAP tree. Without this entry,
LDAP will not be able to find
-any other entries for the domain.
+As a result of these steps, the LDAP server will have access to its own private
+certificate and the key with which that certificate is encrypted, and to the
+public certificate file belonging to the CA. Note that it would be possible for
+the key to be protected further, so that processes running as ldap could not
+read it. If this were done, the LDAP server process would need to be restarted
+manually whenever the server rebooted.
</description>
-<!--<ident cce="TODO:CCE" />-->
-<!--oval id="MANUAL AUDIT" /-->
-<ref nist="AC-2" />
</Group>
-<Group id="ldap_server_config_directory_users_groups">
-<title>Create LDAP Structures for Users and Groups</title>
-<description>Create LDAP structures for people (users) and for groups with at least
the following attributes:
-<pre>dn: ou=people,dc=example,dc=com
-ou: people
-structuralObjectClass: organizationalUnit
-objectClass: organizationalUnit
-dn: ou=groups,dc=example,dc=com
-ou: groups
-structuralObjectClass: organizationalUnit
-objectClass: organizationalUnit</pre>
-Posix users and groups are the two top-level items which will be needed in order to use
LDAP for authentication.
-These organizational units are used to identify the two categories within LDAP.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<!--oval id="MANUAL AUDIT" /-->
-<ref nist="AC-2, AC-6, SC-2" />
-</Group>
-<Group id="ldap_server_config_directory_accounts">
-<title>Create Unix Accounts</title>
-<description>For each Unix user, create an LDAP entry with at least the following
attributes (others may be appropriate
-for your site as well), using variable values appropriate to that user:
-<pre>dn: uid=username ,ou=people,dc=example,dc=com
-structuralObjectClass: inetOrgPerson
-objectClass: inetOrgPerson
-objectClass: posixAccount
-objectClass: shadowAccount
-cn: fullname
-sn: surname
-gecos: fullname
-gidNumber: primary-group-id
-homeDirectory: /home/username
-loginShell: /path/to/shell
-uid: username
-uidNumber: uid
-userPassword: {MD5}md5-hashed-password
-shadowMax: N</pre>
-In general, the LDAP schemas for users use uid to refer to the text username, and
uidNumber for the numeric
-UID. This usage may be slightly confusing when compared to the standard Unix usage.
-You should not create entries for the root account or for system accounts which are
unique to individual systems,
-but only for user accounts which are to be shared across machines, and which have
authentication information
-(such as a password) associated with them.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<!--oval id="MANUAL AUDIT" /-->
-<ref nist="AC-2, CM-7, SC-2" />
</Group>
-
-<Group id="ldap_server_config_directory_groups">
-<title>Create Unix Groups</title>
-<description>For each Unix group, create an LDAP entry with at least the following
attributes:
-<pre>dn: cn=groupname ,ou=groups,dc=example,dc=com
-cn: groupname
-structuralObjectClass: posixGroup
-objectClass: posixGroup
-gidNumber: gid
-memberUid: username1
-memberUid: username2
-...
-memberUid: usernameN</pre>
-Note that each user has a primary group, identified by the gidNumber field in the
user's account entry. That
-group must be created, but it is not necessary to list the user as a memberUid of the
group. This behavior should
-be familiar to administrators, since it is identical to the handling of the /etc/passwd
and /etc/group files.
-Do not create entries for the root group or for system groups, but only for groups which
contain human users
-or which are shared across systems.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<!--oval id="MANUAL AUDIT" /-->
-<ref nist="AC-2, CM-7, SC-2" />
</Group>
-
-<Group id="ldap_server_config_directory_admin_group">
-<title>Create Groups to Administer LDAP</title>
-<description>If a group of LDAP administrators is desired, that group must be
created somewhat differently.
-The specification should have these attributes:
-<pre>dn: cn=admins ,ou=groups,dc=example,dc=com
-cn: admins
-structuralObjectClass: groupOfUniqueNames
-objectClass: groupOfUniqueNames
-uniqueMember: cn=Manager,dc=example,dc=com
-uniqueMember: uid=admin1-username ,ou=people,dc=example,dc=com
-uniqueMember: uid=admin2-username ,ou=people,dc=example,dc=com
-...
-uniqueMember: uid=adminN-username ,ou=people,dc=example,dc=com</pre>
-LDAP cannot use Posix groups for its own internal authentication - it needs to compare
the username specified
-in an authenticated bind to some internal groupOfUniqueNames. If you do not specify an
LDAP administrators'
-group, then all LDAP management will need to be done using the LDAP root user (Manager).
For reasons of
-auditing and error detection, it is recommended that LDAP administrators have unique
identities.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<!--oval id="MANUAL AUDIT" /-->
-<ref nist="AC-2, CM-7, SC-2" />
-</Group>
-
-<Rule id="ldap_server_config_olcaccess">
-<title>Configure slapd to Protect Authentication Information</title>
-<description>Use ldapmodify to add these entries to the database. Add or correct
the following access specifications:
-1. Protect the user's password by allowing the user himself or the LDAP
administrators to change it,
-allowing the anonymous user to authenticate against it, and allowing no other access:
-<pre>olcAccess: to attrs=userPassword
- by self write
- by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com
" write
- by anonymous auth
- by * none
-olcAccess: to attrs=shadowLastChange
- by self write
- by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com
" write
- by * read</pre>
-2. Allow anyone to read other information, and allow the administrators to change it:
-<pre>olcAccess: to *
- by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com
" write
- by * read</pre>
-Access rules are applied in the order encountered, so more specific rules should appear
first. In particular,
-the rule restricting access to userPassword must appear before the rule allowing access
to all data. The
-shadowLastChange attribute is a timestamp, and is only critical if your site implements
password expiration. If
-your site does not have an LDAP administrators group, the LDAP root user (called Manager
in this guide) will
-be able to change data without an explicit access statement.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<oval id="ldap_server_config_olcaccess" />
-<ref nist="AC-2, AC-6, CM-7, SC-2" />
-</Rule>
-
-<Rule id="ldap_server_config_directory_file_security">
-<title>Correct Permissions on LDAP Server Files</title>
-<description>Correct the permissions on the ldap server's files.
-<pre># chown ldap:root /var/lib/ldap/*</pre>
-Some manual methods of inserting information into the LDAP database may leave these files
with incorrect
-permissions. This will prevent slapd from starting correctly.
-</description>
-<ident cce="27125-4" />
-<ident cce="27131-2" />
-<oval id="ldap_server_config_directory_file_security" />
-<ref nist="AC-6, CM-7" />
-</Rule>
-
-<Rule id="iptables_ldap_enabled">
-<title>Configure iptables to Allow Access to the LDAP Server</title>
-<description>Determine an appropriate network block representing the machines on
-your network which will synchronize to this server:
-<iptables-desc-macro net="true" proto="tcp" port="389"
/>
-<iptables-desc-macro net="true" proto="tcp" port="636"
/>
-The default Iptables configuration does not allow inbound access to any
-services. These modifications allow access to the LDAP primary (389) and
-encrypted-only (636) ports, while keeping all other ports on the server in
-their default protected state.
-Note: Even if the LDAP server restricts connections so that only encrypted
-queries are allowed, it will probably be necessary to allow traffic to the
-default port 389. This is true because many LDAP clients implement encryption
-by connecting to the primary port and issuing the STARTTLS command.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<oval id="iptables_ldap_enabled" />
-<ref nist="CM-7, SC-2, SC-5, SC-7" />
-</Rule>
-
-<Rule id="ldap_server_config_logging">
-<title>Configure Logging for LDAP</title>
-<description>
-<ol>
-<li>Add or correct the following line within
<tt>/etc/rsyslog.conf</tt>:
-<pre>local4.*</pre>
-</li>
-<li>Create the log file with safe permissions:
-<pre># touch /var/log/ldap.log
-# chown root:root /var/log/ldap.log
-# chmod 0600 /var/log/ldap.log</pre>
-</li>
-<li>Edit the file /etc/logrotate.d/syslog and add the pathname
-<pre>/var/log/ldap.log</pre>
-to the space-separated list in the first line.</li>
-<li>Edit the LDAP configuration file /etc/openldap/slapd.conf and set a reasonable
set of default log
-parameters, such as the following:
-<pre>loglevel stats2</pre>
-</li>
-</ol>
-
-OpenLDAP sends its log data to the syslog facility local4 at priority debug. By default,
RHEL5 does not store
-this facility at all. The syslog configuration suggested here will store any output
logged by slapd in the file
-<tt>/var/log/ldap.log</tt>, and will include that file in the standard log
rotation for syslog files.
-By default, LDAP's logging is quite verbose. The loglevel parameter is a
space-separated list of items to be
-logged. Specifying <tt>stats2</tt> will reduce the log output somewhat, but
this level will still produce some logging
-every time an LDAP query is made. (This may be appropriate, depending on your site's
auditing requirements.)
-In order to capture only <tt>slapd</tt> startup messages, specify
<tt>loglevel none</tt>.
-See <tt>slapd.conf(5)</tt> for detailed information about the loglevel
parameter.
-</description>
-<!--<ident cce="TODO:CCE" />-->
-<oval id="ldap_server_config_logging" />
-<ref nist="AC-6, AU-2(a), AU-3, AU-9" />
-</Rule>
-
-</Group><!--End <Group id="openldap_server"> -->
-</Group><!--End <Group id="ldap"> -->
--
1.7.1