AIX7-00-001007 - If AIX is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.

Solution

To remove the clear-text password for "bindpwd", do the following two steps:
Edit "/etc/security/ldap/ldap.cfg" to remove the "bindpwd" line and save the change;

Re-config the LDAP client using the "mksecldap" command:
# mksecldap -c -h <LDAP_HOST:LDAP_PORT> -A <auth_type> -D <Default_Entry> -d <BASE_DN> -a <BIND_USER> -p <BIND_PASSWORD> -k <KDB_FILE> -w <KDB_PASSWORD>

Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: "gsk8capicmd" (used below), "gsk8capicmd_64" and "gsk7cmd".

To use the stashed password for SSL key database (KDB), do the following two steps:
Edit "/etc/security/ldap/ldap.cfg" to remove the "ldapsslkeypwd" line and save the change;

Run the "gsk8capicmd" to create a stashed password file for the SSL KDB:
# gsk8capicmd -keydb -stashpw -db <KDB_FILE> -pw <KDB_PASSWORD>

Item Details

Audit Name: DISA IBM AIX 7.x STIG v3r2

Category: IDENTIFICATION AND AUTHENTICATION

Plugin: Unix

Control ID: 7c8a84f029cfa9447c76b0466e34d2c40a85b2e32bb9441e193b67201730c017

Detections

Analytics

AIX7-00-001007 - If AIX is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.

Warning! Audit Deprecated

Information

Solution

See Also

Item Details