Disable LDAP Server (slapd)
Ensures the slapd.service (OpenLDAP directory server) is neither enabled at boot nor running, unless the host is intentionally an LDAP server.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
slapd is the OpenLDAP directory daemon, listening on 389 (LDAP) and 636 (LDAPS). An LDAP directory typically holds user accounts, group memberships and credential hashes, making it a high-value target. Exposing it where no directory role is needed widens the attack surface and risks leaking the very identity data attackers want; a misconfigured slapd can allow anonymous binds or unauthenticated reads of the whole tree. If the host is not meant to serve a directory, the daemon should be stopped and disabled.
What Pavois checks
Pavois reads the effective state of slapd.service from systemd, asserting it is neither enabled nor running. This reflects what is actually listening on ports 389/636, regardless of whether /etc/ldap/slapd.d/ config fragments exist. A file-based check could be fooled by leftover config from a removed role, or miss a daemon started by a drop-in override.
describe service('slapd.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled slapd.service and systemctl is-active slapd.service; expect disabled/masked and inactive. Confirm nothing listens with ss -tlnp | grep -E ':389|:636'.
Inspect & investigate
Inspect journalctl -u slapd.service for start/stop and bind activity. systemctl show slapd.service -p ActiveState -p UnitFileState gives the machine-readable state Pavois asserts. Confirm the ports are closed with ss -tlnp | grep -E ':389|:636'.
Remediation
Pavois's harden plan acts on the service resource named slapd with actions disable then stop: it removes boot enablement and stops the running directory daemon. Applied with pavois harden apply. The directory data on disk is left untouched, only the service state changes.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | slapd |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling slapd will make this host stop serving LDAP: any client (PAM/sssd, applications, other servers) that authenticates or looks up identities against this directory will lose access. This rule targets the server role, not LDAP clients, a host that merely consumes a remote directory is unaffected. Before applying: confirm no clients depend on this server (ss -tnp | grep -E ':389|:636' for active connections), and that it is not a replica/provider in an LDAP replication topology. If it is a directory server, exclude this rule.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.7 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.