documentation_complete: true


title: 'Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server'

description: |-
    Configure SSSD to demand a valid certificate from the server to
    protect the integrity of LDAP remote access sessions by setting
    the <pre>ldap_tls_reqcert</pre> option in <pre>/etc/sssd/sssd.conf</pre>
    to <tt>demand</tt>.

rationale: |-
    Without a valid certificate presented to the LDAP client backend, the identity of a
    server can be forged compromising LDAP remote access sessions.

severity: medium

identifiers:
    cce@rhel8: CCE-84062-9
    cce@rhel9: CCE-86081-7
    cce@rhel10: CCE-87985-8

references:
    nist: SC-12(3),CM-6(a)
    srg: SRG-OS-000250-GPOS-00093
    stigid@ol7: OL07-00-040190

ocil_clause: 'the TLS reqcert is not set to demand'

ocil: |-
    To verify the LDAP client backend demands a valid certificate from the server in
    remote LDAP access sessions, run the following command:
    <pre>$ sudo grep ldap_tls_reqcert /etc/sssd/sssd.conf</pre>
    The output should return the following:
    <pre>ldap_tls_reqcert = demand</pre>

platform: sssd-ldap
