Details

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.

Solution

To remove the clear-text password for ‘bindpwd’, do the following two steps:
Edit ‘/etc/security/ldap/ldap.cfg’ to remove the ‘bindpwd’ line and save the change;

Re-config the LDAP client using the ‘mksecldap’ command:
# mksecldap -c -h -A -D -d -a -p -k -w

Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: ‘gsk8capicmd’ (used below), ‘gsk8capicmd_64’ and ‘gsk7cmd’.

To use the stashed password for SSL key database (KDB), do the following two steps:
Edit ‘/etc/security/ldap/ldap.cfg’ to remove the ‘ldapsslkeypwd’ line and save the change;

Run the ‘gsk8capicmd’ to create a stashed password file for the SSL KDB:
# gsk8capicmd -keydb -stashpw -db -pw

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V2R3_STIG.ziphttps://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V2R3_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Unix.

References

• 800-53|IA-5(1)(c)
• CAT|I
• CCI|CCI-000196
• Rule-ID|SV-215174r508663_rule
• STIG-ID|AIX7-00-001007
• STIG-Legacy|SV-101389
• STIG-Legacy|V-91291
• Vuln-ID|V-215174

Source

• Tenable.com/audits