cis-ubuntu1204-v110-6-6

name	cis-ubuntu1204-v110-6-6
description	Ensure LDAP is not enabled
category	cis-os-hardening
version	1.1.0
author	cyberstrike-official
tags	["cis","ubuntu",12.04,"linux","ldap","slapd","directory-services","attack-surface"]
cis_id	6.6
cis_benchmark	CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.6 Ensure LDAP is not enabled (Not Scored)

Profile Applicability

• Level 1

Description

The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database.

Rationale

If the server will not need to act as an LDAP client or server, it is recommended that the software be disabled to reduce the potential attack surface.

Audit Procedure

Using Command Line

Run the following command:

dpkg -s slapd

Expected Result

Ensure package status is not-installed or dpkg returns no info is available.

Remediation

Using Command Line

Uninstall the slapd package:

apt-get purge slapd

Default Value

Not installed by default on Ubuntu 12.04 LTS Server.

References

• CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
• http://www.openldap.org

Profile

Level 1 - Not Scored