2.3.5 Ensure LDAP client is not installed

Information

The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database.

Rationale:

If the system will not need to act as an LDAP client, it is recommended that the software be removed to reduce the potential attack surface.

Solution

Uninstall openldap-clients using the appropriate package manager.
OR

# yum remove openldap-clients

Impact:

Removing the LDAP client will prevent or inhibit using LDAP for authentication in your environment.

Notes:

The openldap-clients package can go by other names on some distributions. openldap2-client, and ldap-utils are known alternative package names.

See Also

https://workbench.cisecurity.org/files/2688

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-11, CSCv7|2.6

Plugin: Unix

Control ID: ffb1b77f2ef1e2d70df070dd04989e200faf8c51abaa605e7e63200786effe26