1. Home
  2. Security Hardening
  3. DISA STIG AIX 7.x V2R3
  4. AIX7-00-001006 – If the AIX system is using LDAP for authentication or account information, the LDAP SSL, or TLS connection must require the server provide a certificate and this certificate must have a valid path to a trusted CA – Certificate Issuer
Searching...

AIX7-00-001006 – If the AIX system is using LDAP for authentication or account information, the LDAP SSL, or TLS connection must require the server provide a certificate and this certificate must have a valid path to a trusted CA – Certificate Issuer

Details

Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted.

Solution

Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: gsk8capicmd (used below), gsk8capicmd_64 and gsk7cmd.

Create a key database with DoD PKI or DoD-approved certificate using one of the following commands:
# gsk8capicmd -keydb -create -db -pw -type cms -stash

Edit ‘/etc/security/ldap/ldap.cfg’ and add or edit the ‘ldapsslkeyf’ setting to reference a KDB file containing a client certificate issued by DoD PKI or a DoD-approved external PKI.

Install a certificate signed by a DoD PKI or a DoD-approved external PKI using the following command:
# gsk8capicmd -cert -add -db -pw -file -label

Remove un-needed CA certificates using one of the following commands:
# gsk8capicmd -cert -delete -db -pw -label

Restart LDAP client using command:
# /usr/sbin/restart-secldapclntd

Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Unix.

References

Source

Updated on July 16, 2022
Was this article helpful?
Yes No

Related Articles