documentation_complete: true

title: 'Configure LDAP Client to Use TLS For All Transactions'

description: "Configure LDAP to enforce TLS use. First, edit the file \n<tt>/etc/pam_ldap.conf</tt>, and add or correct the following lines:\n<pre>ssl start_tls</pre>\nThen review the LDAP server and ensure TLS has been configured."

rationale: |-
    The ssl directive specifies whether to use ssl or not. If
    not specified it will default to no. It should be set to start_tls rather
    than doing LDAP over SSL.

severity: medium

identifiers:
    cce: 26690-8

references:
    disa: 776,778,1453
    nist: CM-7
    stigid: RHEL-06-000252

ocil_clause: 'LDAP is not in use, the line is commented out, or not configured correctly'

ocil: |-
    To ensure LDAP is configured to use TLS for all transactions, run the following command:
    <pre>$ grep start_tls /etc/pam_ldap.conf</pre>
    The result should contain:
    <pre>ssl start_tls</pre>
