Linux RHEL-10-000510

Note: If there is a documented and approved reason for not having data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is not applicable. Verify RHEL 10 prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. List all block devices in tree-like format: $ sudo lsblk --tree NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sda 8:0 0 64G 0 disk +-sda1 8:1 0 600M 0 part /boot/efi +-sda2 8:2 0 1G 0 part /boot +-sda3 8:3 0 62.4G 0 part +-rhel-root 253:0 0 23G 0 lvm ¦ +-luks-9f886368-bf3e-4d17-86ed-a71dd6571bb4 253:2 0 23G 0 crypt / +-rhel-swap 253:1 0 6.4G 0 lvm [SWAP] +-rhel-var_tmp 253:3 0 3G 0 lvm ¦ +-luks-c98555c8-0462-4b97-9afa-6db8c4bfee3b 253:14 0 3G 0 crypt /var/tmp +-rhel-var_log_audit 253:4 0 10G 0 lvm ¦ +-luks-4e45e1ad-5337-42c4-a19f-ee12ccc1d502 253:9 0 10G 0 crypt /var/log/audit +-rhel-tmp 253:5 0 2G 0 lvm ¦ +-luks-2d7e1b45-73c4-4282-8838-15a897e0d04e 253:11 0 2G 0 crypt /tmp +-rhel-home 253:6 0 10G 0 lvm ¦ +-luks-ca2261ed-7b00-4b7b-84cd-8cd6d8fa4b28 253:12 0 10G 0 crypt /home +-rhel-var 253:7 0 5G 0 lvm ¦ +-luks-51150299-f295-4145-b8f0-ebe9c6dfd5a0 253:13 0 5G 0 crypt /var +-rhel-var_log 253:8 0 3G 0 lvm +-luks-c651f493-9fdc-4c6e-a711-0a4f03149661 253:10 0 3G 0 crypt /var/log Verify that the block device tree for each persistent filesystem, excluding the /boot and /boot/efi filesystems, has at least one parent block device of type "crypt" and that the encryption type is LUKS: $ sudo cryptsetup status luks-9f886368-bf3e-4d17-86ed-a71dd6571bb4 /dev/mapper/luks-9f886368-bf3e-4d17-86ed-a71dd6571bb4 is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/mapper/rhel-root sector size: 512 offset: 32768 sectors size: 48201728 sectors mode: read/write flags: discards If there are persistent filesystems (other than /boot or /boot/efi) whose block device trees do not have a crypt block device of type LUKS, ask the administrator to indicate how persistent filesystems are encrypted. If there is no evidence that persistent filesystems are encrypted, this is a finding.

Configure RHEL 10 to prevent unauthorized modification of all information at rest by using disk encryption. Encrypting a partition in an already installed system is more difficult, because existing partitions will have to be resized and changed. To encrypt an entire partition, dedicate a partition for encryption in the partition layout.