# Ensure ldap client is not installed

Necessity: The Lightweight Directory Access Protocol (LDAP) is used to query directory services. If the system is not intended to be an LDAP client, installing the 'ldap-utils' package provides unnecessary tools that could be exploited by an attacker for network reconnaissance and enumeration of directory services. Removing it reduces the system's attack surface by eliminating unused software. Remediation and Auditing: The audit script verifies the installation status of the 'ldap-utils' package using the system's package manager. The remediation script uninstalls this package, including its configuration files, to ensure the system is clean. Recommended State Rationale: The recommendation is consistent across all levels (Basic, Moderate, Strict) because this is a binary control. A system either requires LDAP client functionality or it does not. If it is not required, the package should be removed to adhere to the principle of least functionality. There is no secure justification for keeping unused LDAP client tools installed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'ldap-utils' package is installed. The script must output 'Installed' if the package is present and 'Not Installed' if it is not. The output must contain only one of these two strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts one argument: the desired state. If the argument is 'Not Installed', the script must use 'apt-get purge -y ldap-utils' to remove the package. The script must return 'true' if the package is successfully removed or was already not installed, and 'false' if the removal fails.

