Disable LDAP and NIS directory server services the system does not provide

Description

Directory servers packaged by Debian:

• OpenLDAP: slapd;
• NIS: ypserv, with its companions yppasswdd (password changes) and ypxfrd (map transfers).

The control passes when each unit is masked or not installed at all.

A unit that does not exist counts as compliant. On Debian 12, slapd only ships a System V init script; systemd still masks the generated slapd.service.

Rationale

A directory server holds account and group data that other systems trust. NIS sends password hashes to any client that asks and has no real authentication; an unattended OpenLDAP server can expose or accept changes to that data.

Impact

Masking a unit stops it and prevents it from starting again. LDAP and NIS clients are not affected. Directory servers must exclude this control in their tailoring file.

Audit

For each unit, run systemctl is-enabled <unit>. It must print masked, or fail because the unit does not exist: slapd.service, ypserv.service, yppasswdd.service, ypxfrd.service.

Automated: every check must pass. Scanners report each check by its id.

slapd

OpenLDAP server.

unit: slapd.service
state: masked

ypserv

NIS server.

unit: ypserv.service
state: masked

yppasswdd

NIS password update server.

unit: yppasswdd.service
state: masked

ypxfrd

NIS map transfer server.

unit: ypxfrd.service
state: masked

Remediation

Stop and mask each unit that is installed: systemctl mask --now <unit>. If the package is not needed at all, remove it instead: apt purge slapd ypserv.

Rollback

Run systemctl unmask <unit> then systemctl enable --now <unit>.

slapd

Generated from check slapd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ypserv

Generated from check ypserv: the engine writes the fix for every output, it sets the expected value and the check runs again after.

yppasswdd

Generated from check yppasswdd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ypxfrd

Generated from check ypxfrd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• slapd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ypserv(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle