Uninstall openldap-servers Package
Ensures the slapd (OpenLDAP server) package is not installed on hosts that are not dedicated directory servers.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
slapd is the OpenLDAP standalone directory server. Unnecessary packages should not be installed, in order to decrease the attack surface of the system. While this software is clearly essential on a dedicated LDAP/directory server, it is not needed on a typical workstation, application server, or appliance, where a listening LDAP daemon would only add exposure and patch burden.
What Pavois checks
Pavois uses CINC/InSpec's package resource to read the effective install state from the package database (dpkg/apt) and asserts slapd is absent. This is authoritative: if slapd is installed, an LDAP daemon can be started and bind to the network, regardless of any config file content.
describe package('slapd') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s slapd; a compliant host returns package 'slapd' is not installed and no information is available. You can also confirm nothing listens on LDAP ports with ss -tlnp | grep -E ':389|:636' (no output).
Inspect & investigate
- Removal events appear in
/var/log/dpkg.logand/var/log/apt/history.log. - After removal,
systemctl status slapdreports not-found and ports 389/636 are no longer bound (ss -tlnp).
Remediation
The harden plan defines a package resource for slapd with action remove; pavois harden apply uninstalls it through apt. The OpenLDAP service stops listening and cannot be reactivated until the package is reinstalled.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | slapd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Do not apply on a host that is actually serving LDAP, removing slapd takes down authentication/directory services for every client that binds to it, which can cascade into a site-wide login outage. Verify the role of the machine first (ss -tlnp, check for live LDAP clients). The local OpenLDAP database under /var/lib/ldap is preserved by a package removal (a purge would delete it), so reinstalling can recover the directory if needed.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.7 | direct | per OS, see the benchmark table | high |
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.