documentation_complete: true

prodtype: rhel7

title: 'Configure LDAP Client to Use TLS For All Transactions'

description: |-
    This check verifies that RHEL7 implements cryptography
    to protect the integrity of remote LDAP authentication sessions.
    <br /><br />
    To determine if LDAP is being used for authentication, use the following
    command:
    <pre>$ sudo grep -i useldapauth /etc/sysconfig/authconfig</pre>
    <br /><br />
    If <tt>USELDAPAUTH=yes</tt>, then LDAP is being used. To check if LDAP is
    configured to use TLS, use the following command:
    <pre>$ sudo grep -i ssl /etc/pam_ldap.conf</pre>

rationale: "Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection. The ssl directive specifies \nwhether to use TLS or not. If not specified it will default to no. \nIt should be set to start_tls rather than doing LDAP over SSL."

severity: medium

identifiers:
    cce@rhel7: 80291-8

references:
    disa: 1453
    nist: AC-17(2),CM-7
    srg: SRG-OS-000250-GPOS-00093

ocil_clause: 'the ''ssl'' option is not ''start_tls'''

ocil: |-
    If the system is not using TLS, set the <tt>ssl</tt> option in <tt>/etc/pam_ldap.conf</tt>
    to <tt>start_tls</tt>.
