STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms.

DISA Rule

SV-227968r603266_rule

Vulnerability Number

V-227968

Group Title

SRG-OS-000250

Rule Version

GEN007980

Severity

CAT II

CCI(s)

• CCI-001453 - The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Configure all LDAP authentications and connections to be encrypted using TLS and FIPS 140-2 approved cryptographic algorithms.

Check Contents

Check if the system is using NSS LDAP.
# grep -v '^#' /etc/nsswitch.conf | grep ldap
If no lines are returned, this vulnerability is not applicable.

Verify TLS is used for client authentications to the server
# grep "NS_LDAP_AUTH=" /var/ldap/ldap_client_file
If any of the authentication methods used do not begin with "tls:", this is a finding.

Retrieve the list of LDAP servers.
# grep "NS_LDAP_SERVERS=" /var/ldap/client_file
Use the certutil to verify the cipher(s) used for every server.
# certutil -L -n < host nickname > -d /var/ldap
If any of the TLS connections do not use FIPS 140-2 approved cryptographic algorithms, this is a finding.

Vulnerability Number

V-227968

Documentable

False

Rule Version

GEN007980

Severity Override Guidance

Check if the system is using NSS LDAP.
# grep -v '^#' /etc/nsswitch.conf | grep ldap
If no lines are returned, this vulnerability is not applicable.

Verify TLS is used for client authentications to the server
# grep "NS_LDAP_AUTH=" /var/ldap/ldap_client_file
If any of the authentication methods used do not begin with "tls:", this is a finding.

Retrieve the list of LDAP servers.
# grep "NS_LDAP_SERVERS=" /var/ldap/client_file
Use the certutil to verify the cipher(s) used for every server.
# certutil -L -n < host nickname > -d /var/ldap
If any of the TLS connections do not use FIPS 140-2 approved cryptographic algorithms, this is a finding.

Check Content Reference

M

Target Key

4061

Comments