documentation_complete: true

prodtype: rhel7

title: 'Configure SSSD LDAP Backend Client CA Certificate'

description: |-
    Configure SSSD to implement cryptography to protect the
    integrity of LDAP remote access sessions. By setting
    the <pre>ldap_tls_cacert</pre> option in <pre>/etc/sssd/sssd.conf</pre>
    to point to the path for the X.509 certificates used for peer authentication.
    <pre>ldap_tls_cacert /path/to/tls/ca.cert</pre>

rationale: |-
    Without cryptographic integrity protections, information can be altered by
    unauthorized users without detection.
    <br /><br />
    Cryptographic mechanisms used for
    protecting the integrity of information include, for example, signed hash
    functions using asymmetric cryptography enabling distribution of the public key
    to verify the hash information while maintaining the confidentiality of the key
    used to generate the hash.

severity: medium

identifiers:
    cce: 80516-8

references:
    disa: 1453
    nist: ""
    srg: SRG-OS-000250-GPOS-00093
    stigid: "040200"

ocil_clause: 'the TLS CA cert is not configured'

ocil: |-
    To verify the operating system implements cryptography to protect the integrity of
    remote ldap access sessions, run the following command:
    <pre>$ sudo grep ldap_tls_cacert /etc/sssd/sssd.conf</pre>
    The output should return the following with a correctly configured CA cert path:
    <pre>ldap_tls_cacert /path/to/tls/ca.cert</pre>
