# Ensure ldap client is not installed

The necessity of this control is rooted in the principle of least functionality. If the system does not require LDAP client services, the 'openldap-clients' package should be removed to reduce the system's attack surface. An installed but unused LDAP client could be exploited by an attacker to gather information about the network's directory services or leveraged in other chained attacks. The audit script verifies the installation status of the 'openldap-clients' package using the system's package manager. The remediation script uninstalls the package, thereby removing LDAP client tools like ldapsearch, ldapadd, and ldapmodify. For all security levels (Basic, Moderate, and Strict), the recommended state is 'not installed'. There is no valid use case for having the package installed on a system that is not an LDAP client; therefore, its removal is the only recommended configuration to minimize potential security risks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['not installed']` |
| **Moderate** | `['not installed']` |
| **Strict** | `['not installed']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if the 'openldap-clients' package is installed. The script should output 'installed' if the package is present and 'not installed' if it is not. The output must not contain any other text or formatting.

## Remediation Script Working

shell script that accepts one positional argument. If the argument is 'not installed', the script must attempt to uninstall the 'openldap-clients' package using 'yum remove'. The script must output 'true' on successful removal or if the package was already not present, and 'false' on failure.

