CIS OpenLDAP Benchmark

This recommendation verifies that slapd runs as the ldap user on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify slapd runs as ldap user
ps -eo user,pid,comm | grep slapd
grep -E '^User|^Group' /etc/default/slapd

# Ensure slapd runs as ldap user
usermod -s /usr/sbin/nologin ldap
chown -R ldap:ldap /var/lib/ldap /etc/ldap/slapd.d
# In /etc/default/slapd:
# SLAPD_USER="ldap"
# SLAPD_GROUP="ldap"

This setting ensures that database directory permissions are restricted on the OpenLDAP directory service. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the OpenLDAP directory service is essential for defense in depth.

# Check database directory permissions
stat -c '%a %U %G' /var/lib/ldap
find /var/lib/ldap -type f -exec stat -c '%a %n' {} \;

# Restrict database permissions
chmod 700 /var/lib/ldap
chown ldap:ldap /var/lib/ldap
chmod 600 /var/lib/ldap/*.mdb

This recommendation verifies that TLS certificates are configured on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify TLS is configured
ldapsearch -x -H ldaps://localhost -b '' -s base 'namingContexts' 2>&1 | head -5
grep -r 'olcTLSCertificate' /etc/ldap/slapd.d/

# Configure TLS for slapd
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ldap/certs/ca.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/certs/server.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/certs/server-key.pem
EOF

This recommendation ensures that encrypted connections are required on the OpenLDAP directory service. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the OpenLDAP directory service may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Verify StartTLS or LDAPS is required
grep -r 'olcSecurity\|olcLocalSSF' /etc/ldap/slapd.d/
grep 'SLAPD_SERVICES' /etc/default/slapd

# Require encrypted connections
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=config
changetype: modify
add: olcSecurity
olcSecurity: ssf=128
EOF
# In /etc/default/slapd:
# SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"

This recommendation verifies that restrictive ACLs are configured on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check ACL configuration
ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' 'olcAccess' 2>/dev/null | grep olcAccess

# Configure restrictive ACLs
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none
olcAccess: {1}to * by self read by users read by * none
EOF

This recommendation verifies that anonymous bind is disabled on the OpenLDAP directory service. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the OpenLDAP directory service increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Verify anonymous bind is disabled
ldapsearch -x -H ldap://localhost -b '' -s base 'namingContexts' 2>&1
grep -r 'olcDisallows\|olcRequires' /etc/ldap/slapd.d/

# Disable anonymous binds
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon
-
add: olcRequires
olcRequires: authc
EOF

This recommendation verifies that password policy overlay is enabled on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify password policy overlay is loaded
ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' '(objectClass=olcPPolicyConfig)' 2>/dev/null

# Enable password policy overlay
ldapadd -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy

dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com
olcPPolicyHashCleartext: TRUE
olcPPolicyUseLockout: TRUE
EOF

This recommendation verifies that strong password hashing is configured on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check password hash algorithm
ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' 'olcPasswordHash' 2>/dev/null

# Set strong password hashing
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=config
changetype: modify
add: olcPasswordHash
olcPasswordHash: {SSHA}
EOF
# For even stronger hashing, use {ARGON2} with pw-argon2 module

This recommendation verifies that audit logging overlay is enabled on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify audit logging is enabled
grep -r 'olcAuditlog\|auditlog' /etc/ldap/slapd.d/
ls -la /var/log/ldap/

# Enable audit logging overlay
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: auditlog

dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config
objectClass: olcAuditlogConfig
olcOverlay: auditlog
olcAuditlogFile: /var/log/ldap/audit.ldif
EOF

This recommendation verifies that appropriate log level is configured on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check slapd logging level
grep -r 'olcLogLevel' /etc/ldap/slapd.d/

# Set appropriate log level
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: stats acl
EOF
# Ensure syslog captures:
# /etc/rsyslog.d/slapd.conf:
# local4.* /var/log/ldap/slapd.log

This recommendation verifies that query size and time limits are configured on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify size and time limits
grep -r 'olcSizeLimit\|olcTimeLimit' /etc/ldap/slapd.d/

# Set query limits
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=config
changetype: modify
add: olcSizeLimit
olcSizeLimit: 500
-
add: olcTimeLimit
olcTimeLimit: 60
EOF

This recommendation verifies that proper database indexes are configured on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check index configuration for performance
ldapsearch -Y EXTERNAL -H ldapi:/// -b 'olcDatabase={1}mdb,cn=config' 'olcDbIndex' 2>/dev/null

# Configure proper indexes
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uid eq
olcDbIndex: cn eq,sub
olcDbIndex: mail eq
olcDbIndex: objectClass eq
olcDbIndex: memberOf eq
olcDbIndex: entryCSN eq
olcDbIndex: entryUUID eq
EOF

This recommendation verifies that OpenLDAP is running the latest stable version on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check OpenLDAP version
slapd -V 2>&1
dpkg -l slapd 2>/dev/null || rpm -q openldap-servers 2>/dev/null

# Update OpenLDAP to latest stable
apt-get update && apt-get install --only-upgrade slapd
# Or on RHEL:
yum update openldap-servers

This recommendation verifies that automated LDIF backups are configured on the OpenLDAP directory service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenLDAP directory service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify backup configuration
ls -la /var/backups/ldap/
crontab -l | grep slapcat

# Configure automated LDIF backups
mkdir -p /var/backups/ldap
# Add cron:
# 0 2 * * * slapcat -n 1 > /var/backups/ldap/backup-$(date +\%Y\%m\%d).ldif 2>/dev/null
# 0 2 * * * slapcat -n 0 -b cn=config > /var/backups/ldap/config-$(date +\%Y\%m\%d).ldif 2>/dev/null