Learn LDAP - Compliance & Security Auditing

#Introduction

The directory stores the most sensitive data in the organization — identities and credentials. Episode 29 is about proving it's handled correctly: what regulations like GDPR, PCI-DSS, SOC 2, and HIPAA demand of directory data, how to harden the server, and how to run a proper security audit.

#What the Regulations Want

Each framework looks at the directory from a slightly different angle, but the practical requirements converge:

The common denominator: know what you store, who can access it, and prove both with logs and access control. Every framework is satisfied by the same technical foundation: TLS everywhere (episode 16), least-privilege ACLs (episode 15), audit logging (episode 18), and retention.

#Mapping the Data

Before auditing, know what's in the directory. A data inventory:

• Personal data — names, emails, phone numbers, employee IDs → GDPR territory.
• Credentials — hashed userPassword values → must never leak, hashing required.
• Employment data — title, department, hire date → internal but personal.
• Access metadata — bind logs, access logs → retention-limited evidence.
• What must NOT be stored — card numbers (PCI), health records (HIPAA), plaintext passwords. If an attribute isn't needed, don't add it.

ldapsearch -x -D cn=admin,dc=example,dc=com -W \
  -b ou=people,dc=example,dc=com "(objectClass=inetOrgPerson)" \
  uid mail employeeNumber telephoneNumber

#Hardening Checklist

A practical hardening baseline:

• TLS everywhere — olcSecurity: ssf=1, TLS_REQCERT demand, no plaintext binds.
• Anonymous disabled — olcDisallows: bind_anon, olcRequires: authc (episode 15).
• Strong password policy — ppolicy from episode 12: length, history, lockout.
• Strong hashes — olcPasswordHash: {SSHA512} minimum; never {MD5}/{SHA}.
• Least privilege — ACLs grant read/search, not write, except to the designated admin.
• Dedicated service accounts — applications bind as their own account, not the admin (episode 21).
• Firewall — LDAP ports reachable only from authorized networks.
• Up-to-date packages — a patched slapd is the cheapest control there is.
• Minimal schema — fewer custom attributes mean less data to protect.

#The Security Audit Workflow

An audit is evidence, not opinion. The workflow:

1. Scoping — which servers, which data, which framework applies.
2. Data inventory — what's stored, where, and for how long (the mapping above).
3. Configuration review — dump and inspect cn=config: TLS, ACLs, overlays, hashes.
4. Access review — who has admin, who has read, who has replication bind — against the account list.
5. Log review — check bind failures, unusual hours, unexpected search patterns from episode 18's logs.
6. Testing — verify the controls: -ZZ fails without TLS, anonymous bind is rejected, a locked account can't bind.
7. Documentation — findings, evidence, remediation plan, and owners.

slapcat -b cn=config > /audit/cn-config-$(date +%F).ldif
ldapsearch -x -b cn=Monitor "(objectClass=*)" monitorConnectionTotal

#SIEM and Log Aggregation

Compliance requires more than local logs — the audit trail must survive the server:

• Ship logs to a central system — rsyslog or journald forwarding to a SIEM (Splunk, Elasticsearch, Graylog).
• Alert on the risky patterns — N bind failures from one IP, admin binds at odd hours, replication disconnects.
• Retain per policy — log retention is itself a compliance requirement (e.g. PCI-DSS requires at least 12 months for logs).
• Make logs immutable — a tampered log is no evidence; write-once storage or signed logs protect the audit value.

local4.*    @siem.example.com:514

#The Audit Report

A complete audit concludes with a report containing:

• Scope and method — what was audited and how.
• Findings — each with severity (critical/high/medium/low).
• Evidence — configuration dumps, log excerpts, test results.
• Remediation — concrete fixes with owners and deadlines.
• Residual risk — what remains and why it's accepted.

Severity ranking guide: a plaintext bind capability is critical; missing entryCSN index is low. The report's value is that an operator can read it six months later and know exactly what to do.

#Closing

In this episode 29 you understood compliance and security auditing: the directory-relevant requirements of GDPR, PCI-DSS, SOC 2, and HIPAA; mapping the data you store and what must never be stored; a hardening checklist from TLS to minimal schema; the seven-step audit workflow; SIEM log aggregation and retention; and structuring the audit report with severity and remediation.

Key takeaways:

• All frameworks converge on the same foundation — TLS, ACLs, logs, retention.
• Inventory first, audit second — you can't protect what you haven't mapped.
• Evidence beats opinion — config dumps and log excerpts are the deliverable.
• Audit on a cadence — compliance is continuous, not a one-time checkbox.

In the final episode, episode 30, we bring everything together: the production checklist & the future of LDAP — a comprehensive go-live checklist, operational pitfalls, and where the protocol is heading.