# Ensure ldap server services are not in use

Necessity: Running an LDAP server increases the system's attack surface. If the system is not intended to function as a directory server, the 'openldap-servers' package should be removed. Unnecessary services can be misconfigured or exploited by attackers to gain unauthorized access, elevate privileges, or conduct reconnaissance. Adhering to the principle of least functionality by removing unneeded services is a fundamental security best practice.

Auditing and Remediation: The audit script verifies whether the 'openldap-servers' package is installed on the system, which directly indicates if the LDAP server service is available. The remediation script uninstalls this package, effectively removing the LDAP server capabilities from the machine.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Not Installed'. This is a binary security control; either the service is required for the system's role, or it is not. If an LDAP server is not explicitly needed, it should be removed completely. There is no intermediate state that provides security benefits. All three levels advocate for its removal to minimize potential security vulnerabilities and simplify system management.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the installation status of the 'openldap-servers' package. The script must output only the string 'Installed' if the package is present, or 'Not Installed' if it is not. Ensure no other text is returned.

## Remediation Script Working

Bash script that accepts one positional argument, which must be the string 'Not Installed'. The script will then execute the command to remove the 'openldap-servers' package (e.g., 'yum remove -y openldap-servers'). The script must output only the string 'true' upon successful removal, or 'false' if the operation fails.

