Skip to content
ATO Pathways
  Log In

Ensure LDAP client is not installed

An XCCDF Rule

Description

The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database. The openldap2-client package can be removed with the following command: 

$ sudo zypper remove openldap2-client

Rationale

If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.

ID
xccdf_org.ssgproject.content_rule_package_openldap-clients_removed
Severity
Low
References
Updated



Remediation - Ansible

- name: Ensure openldap2-client is removed
  package:
    name: openldap2-client
    state: absent
  tags:
  - CCE-91310-3

Remediation - Puppet

include remove_openldap2-client

class remove_openldap2-client {
  package { 'openldap2-client':
    ensure => 'purged',
  }

Remediation - Shell Script


# CAUTION: This remediation script will remove openldap2-client
#	   from the system, and may remove any packages
#	   that depend on openldap2-client. Execute this
#	   remediation AFTER testing on a non-production
#	   system!