GEN008120 - If the system is using LDAP the /etc/ldap.conf file must not have an extended ACL

Information

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Solution

Remove the extended ACL from the /etc/security/ldap/ldap.cfg file.

# acledit /etc/security/ldap/ldap.cfg
Disable extended file permissions.

See Also

https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R14_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, CAT|II, CCI|CCI-000225, Group-ID|V-22562, Rule-ID|SV-38972r1_rule, STIG-ID|GEN008120, Vuln-ID|V-22562

Plugin: Unix

Control ID: 0d330c4123ab4a26edf9db002cdea6a69e2979a4029ffda9be1fa0c02ddf54e1