Skip to content
ATO Pathways
  Log In

Ensure LDAP client is not installed

An XCCDF Rule

Description

The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database. The openldap-clients package can be removed with the following command: 

$ sudo yum erase openldap-clients

Rationale

If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.

ID
xccdf_org.ssgproject.content_rule_package_openldap-clients_removed
Severity
Low
References
Updated



Remediation - Anaconda Pre-Install Instructions


package --remove=openldap-clients

Remediation - Ansible

- name: Ensure openldap-clients is removed
  package:
    name: openldap-clients
    state: absent
  tags:
  - CCE-82884-8

Remediation - Puppet

include remove_openldap-clients

class remove_openldap-clients {
  package { 'openldap-clients':
    ensure => 'purged',
  }

Remediation - Shell Script


# CAUTION: This remediation script will remove openldap-clients
#	   from the system, and may remove any packages
#	   that depend on openldap-clients. Execute this
#	   remediation AFTER testing on a non-production
#	   system!