documentation_complete: true


title: 'Configure SSSD LDAP Backend Client CA Certificate'

description: |-
    Configure SSSD to implement cryptography to protect the
    integrity of LDAP remote access sessions. By setting
    the <pre>ldap_tls_cacert</pre> option in <pre>/etc/sssd/sssd.conf</pre>
    to point to the path for the X.509 certificates used for peer authentication.
    <pre>ldap_tls_cacert /path/to/tls/ca.cert</pre>

rationale: |-
    Without cryptographic integrity protections, information can be altered by
    unauthorized users without detection.
    <br /><br />
    Cryptographic mechanisms used for
    protecting the integrity of information include, for example, signed hash
    functions using asymmetric cryptography enabling distribution of the public key
    to verify the hash information while maintaining the confidentiality of the key
    used to generate the hash.

severity: medium

identifiers:
    cce@rhel8: CCE-82438-3

references:
    nist: SC-12(3),CM-6(a)
    srg: SRG-OS-000250-GPOS-00093
    stigid@ol7: OL07-00-040200

ocil_clause: 'the TLS CA cert is not configured'

ocil: |-
    To verify the operating system implements cryptography to protect the integrity of
    remote ldap access sessions, run the following command:
    <pre>$ sudo grep ldap_tls_cacert /etc/sssd/sssd.conf</pre>
    The output should return the following with a correctly configured CA cert path:
    <pre>ldap_tls_cacert /path/to/tls/ca.cert</pre>

warnings:
    - general:
        A remediation is not provided for this rule as each system has unique requirements.

platform: sssd-ldap
