Uninstall 389-ds-base Package
An XCCDF Rule
Description
The 389-ds-base RPM is not installed by default on a Red Hat Enterprise Linux 9 system. It is needed only by the 389-ds server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed.
Rationale
Unnecessary packages should not be installed to decrease the attack surface of the system. While this software is clearly essential on an LDAP server, it is not necessary on typical desktop or workstation systems.
- ID
- xccdf_org.ssgproject.content_rule_package_389-ds-base_removed
- Severity
- Low
- References
- Updated
Remediation - Shell Script
# CAUTION: This remediation script will remove 389-ds-base
# from the system, and may remove any packages
# that depend on 389-ds-base. Execute this
# remediation AFTER testing on a non-production
# system!
Remediation - Anaconda Pre-Install Instructions
package --remove=389-ds-base
Remediation - Ansible
- name: Ensure 389-ds-base is removed
package:
name: 389-ds-base
state: absent
tags:
- NIST-800-53-CM-6(a)
Remediation - Puppet
include remove_389-ds-base
class remove_389-ds-base {
package { '389-ds-base':
ensure => 'purged',
}