Ensure LDAP client is not installed
Ensures the ldap-utils OpenLDAP client package is not installed on hosts that are not LDAP clients.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
ldap-utils provides the OpenLDAP client commands (ldapsearch, ldapadd, ldapmodify…). If the system does not need to act as an LDAP client, the software should be removed to reduce the potential attack surface and to deny an attacker ready-made tools for querying or tampering with a directory service.
What Pavois checks
Pavois queries the package database via InSpec package('ldap-utils') (dpkg -s ldap-utils) and asserts it is not installed. The package state is authoritative, it tells you exactly whether the client binaries are present, regardless of any leftover /etc/ldap/ldap.conf.
describe package('ldap-utils') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s ldap-utils. The expected output is package 'ldap-utils' is not installed. An installed version line means the rule fails.
Inspect & investigate
Confirm removal via apt list --installed | grep ldap-utils (should be empty) or /var/log/apt/history.log, which records the removal transaction. These are client CLI tools, so there is no service log.
Remediation
Pavois's harden plan declares a package resource named ldap-utils with action remove; pavois harden apply runs the equivalent of apt-get remove ldap-utils to reach the compliant state. If remediation were empty you would uninstall it manually.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | ldap-utils |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing ldap-utils only deletes the command-line query tools; it does not affect LDAP-based authentication, which is handled by libnss-ldap/sssd. Precaution: if administrators or scripts rely on ldapsearch/ldapmodify to manage a directory from this host, removing the package will break those workflows. Confirm no automation depends on these binaries before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.5, 2.2.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.