+APP.2.3 OpenLDAP
---+APP.2.3.G1. Inadequate Planning of OpenLDAP
---+APP.2.3.G2. Inadequate Separation of offline and online access to OpenLDAP
---+APP.2.3.A1 Planning and Selecting Back Ends and Overlays for OpenLDAP (B)
---+APP.2.3.A3 Secure Configuration of OpenLDAP (B)
---+APP.2.3.A4 Configuration of the Database Used by OpenLDAP (B)
---+APP.2.3.A5 Secure Assignment of Access Rights to OpenLDAP (B)
---+APP.2.3.A6 Secure Authentication for OpenLDAP (B)
---+APP.2.3.A8 Restrictions on Attributes in OpenLDAP (S)
---+APP.2.3.A9 Partitioning and Replication in OpenLDAP (S)
---+APP.2.3.A10 Secure Updating of OpenLDAP (S)
---+APP.2.3.A11 Restriction of the OpenLDAP Runtime Environment (S)

APP.2.3 OpenLDAP

Introduction

OpenLDAP is a freely available directory service that provides information on any objects, such as users or IT systems, in a defined manner within a data network. The information can include simple attributes—the names or numbers of objects, for example—but also complex formats such as photos or certificates for electronic signatures. The typical application scenarios include address books and user administration systems.

OpenLDAP is a reference implementation for a server service within the framework of the Lightweight Directory Access Protocol (LDAP). Since it is open-source software, OpenLDAP can be installed on a variety of operating systems and is one of the most widely used directory services. Overlays are a special feature of OpenLDAP. Overlays add numerous functions to OpenLDAP and are also used for basic functions such as logging, replication, and maintaining integrity.

Objective

The objective of this module is to facilitate the secure operation of directory services based on OpenLDAP and appropriate protection of the information processed using these services.

Scoping and Modelling

Module APP.2.3 OpenLDAP must be applied to every OpenLDAP directory.

This module examines the threats and requirements that apply specifically to OpenLDAP. It does so based on version 2.4 of OpenLDAP. General security recommendations for directory services can be found in module APP.2.1 General Directory Service. These must also be taken into consideration. The requirements described therein are explained in detail and expanded upon in this module.

OpenLDAP should always be considered as part of the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, CON.3 Backup Concept, OPS.1.1.2 Archiving, OPS.1.1.5 Logging and OPS.1.1.2 Proper IT Administration.

Useful Resources

No further information is available for module APP.2.3 OpenLDAP.

1. Přehled

APP.2.3.A1 Planning and Selecting Back Ends and Overlays for OpenLDAP (B)

The use of OpenLDAP in an organisation MUST be carefully planned. If OpenLDAP is to be used together with other applications, the planning, configuration, and installation of applications and OpenLDAP MUST be coordinated. The version of the database used for data storage MUST be checked to ensure it is compatible. Back ends and overlays for OpenLDAP MUST be selected restrictively. It MUST be ensured that the OpenLDAP overlays are used in the correct order for this purpose. When planning OpenLDAP, the client applications to be selected and supported MUST be considered.
APP.2.3.A3 Secure Configuration of OpenLDAP (B)

Secure configuration of OpenLDAP requires a correctly configured slapd server. The client applications used MUST also be securely configured. When configuring OpenLDAP, the permissions MUST be set correctly in the operating system. The default values of all relevant OpenLDAP configuration directives MUST be checked and adapted if necessary. The back ends and overlays of OpenLDAP MUST be included in the configuration. Appropriate time and size restrictions MUST be set for searching within OpenLDAP. The configuration on the slapd server MUST be checked after each change.
APP.2.3.A4 Configuration of the Database Used by OpenLDAP (B)

The access rights for newly created database files MUST be limited to the user ID in whose context the slapd server is being run. The standard settings of the database used by OpenLDAP MUST be adapted.
APP.2.3.A5 Secure Assignment of Access Rights to OpenLDAP (B)

The global and database-specific access control lists maintained in OpenLDAP MUST be factored in correctly when using OpenLDAP. Database directives MUST take precedence over global directives.
APP.2.3.A6 Secure Authentication for OpenLDAP (B)

If the directory service is to distinguish between different users, they MUST authenticate themselves appropriately. The authentication between the slapd server and communication partners MUST be encrypted. If passwords are to be stored on the clients and servers, hashed values only MUST be used. A suitable hashing algorithm MUST be used.
APP.2.3.A8 Restrictions on Attributes in OpenLDAP (S)

The attributes in OpenLDAP SHOULD be restricted using overlays. OpenLDAP SHOULD be modified so that values in the directory service only correspond to a specific regular expression. In addition, it SHOULD be ensured with the help of overlays that selected values only exist once in the directory tree. Such restrictions SHOULD only be applied to user data.
APP.2.3.A9 Partitioning and Replication in OpenLDAP (S)

OpenLDAP SHOULD be partitioned into subtrees on different servers. In such configurations, changes made to data on one server SHOULD be replicated to the other servers. The replication mode SHOULD be selected based on the network connections and availability requirements at hand.
APP.2.3.A10 Secure Updating of OpenLDAP (S)

When performing updates, particular attention SHOULD be paid to whether the changes relate to the back ends or overlays used, or to software dependencies. If administrators use their own scripts, they SHOULD be checked to see if they work with the updated version of OpenLDAP without any problems. The configuration and access rights SHOULD be carefully checked after an update.
APP.2.3.A11 Restriction of the OpenLDAP Runtime Environment (S)

The slapd server SHOULD be restricted to a runtime directory. This directory SHOULD contain all configuration files and databases.

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
includes APP.2.3.G1. Inadequate Planning of OpenLDAP
includes APP.2.3.G2. Inadequate Separation of offline and online access to OpenLDAP