Skip to content
Log In

Ensure LDAP client is not installed

An XCCDF Rule

Description

The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database. The openldap-clients package can be removed with the following command: 
$ sudo yum erase openldap-clients

Rationale

If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.

ID
xccdf_org.ssgproject.content_rule_package_openldap-clients_removed
Severity
Low
References
Updated

Remediation Templates

An Ansible Snippet

- name: Ensure openldap-clients is removed
  package:
    name: openldap-clients
    state: absent
  tags:
  - CCE-82885-5

script:kickstart

package remove openldap-clients

script:bootc

dnf remove openldap-clients

A Puppet Snippet

include remove_openldap-clients
class remove_openldap-clients {
  package { 'openldap-clients':
    ensure => 'purged',
  }
}

Anaconda Pre-Install Instructions

package --remove=openldap-clients

A Shell Script

# CAUTION: This remediation script will remove openldap-clients
#	   from the system, and may remove any packages
#	   that depend on openldap-clients. Execute this
#	   remediation AFTER testing on a non-production
#	   system!