Linux STIGs
CAT I 29
Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.
-
RHEL 9 must be a vendor-supported release.
Maps to CM-6 via CCI-000366Check
Verify the version or RHEL 9 is vendor supported with the following command: $ cat /etc/redhat-release Red Hat Enterprise Linux release 9.6 (Plow) If the installed version of RHEL 9 is not supported, this is a finding.
Fix
Upgrade to a supported version of RHEL 9.
-
The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
Maps to AC-6(10) via CCI-002235Check
Verify RHEL 9 is configured to not reboot the system when Ctrl-Alt-Delete is pressed seven times within two seconds with the following command: $ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system* /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf:CtrlAltDelBurstAction=none If the "CtrlAltDelBurstAction" is not set to "none", is commented out, or is missing, this is a finding.
Fix
Configure RHEL 9 to disable the CtrlAltDelBurstAction by adding it to a drop file in a "/etc/systemd/system.conf.d/" configuration file: If no drop file exists, create one with the following command: $ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf Edit the file to contain the setting by adding the following text: [Manager] CtrlAltDelBurstAction=none Reload the daemon for this change to take effect. $ sudo systemctl daemon-reload
-
The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.
Maps to AC-6(10) via CCI-002235Check
Verify RHEL 9 is not configured to reboot the system when Ctrl-Alt-Delete is pressed with the following command: $ sudo systemctl status ctrl-alt-del.target ctrl-alt-del.target Loaded: masked (Reason: Unit ctrl-alt-del.target is masked.) Active: inactive (dead) If the "ctrl-alt-del.target" is loaded and not masked, this is a finding.
Fix
Configure RHEL 9 to disable the ctrl-alt-del.target with the following command: $ sudo systemctl disable --now ctrl-alt-del.target $ sudo systemctl mask --now ctrl-alt-del.target
-
RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes.
Maps to AC-3 via CCI-000213Check
Verify the RHEL 9 boot loader superuser account has been set with the following command: $ sudo grep -A1 "superusers" /etc/grub2.cfg set superusers="" export superusers password_pbkdf2 ${GRUB2_PASSWORD} Verify is not a common name such as root, admin, or administrator. If superusers contains easily guessable usernames, this is a finding.
Fix
Configure RHEL 9 to have a unique username for the grub superuser account. Edit the "/etc/grub.d/01_users" file and add or modify the following lines with a nondefault username for the superuser account: set superusers="" export superusers Once the superuser account has been added, update the grub.cfg file by running: In RHEL 9.0, 9.1 and 9.2: sudo grub2-mkconfig -o /boot/grub2/grub.cfg In RHEL 9.3 and later: sudo grub2-mkconfig -o /boot/grub2/grub.cfg --update-bls-cmdline
-
RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation.
Check
Verify RHEL 9 dnf always checks the GPG signature of software packages originating from external software repositories before installation with the following command: $ sudo grep -w gpgcheck /etc/dnf/dnf.conf gpgcheck=1 If "gpgcheck" is not set to either "1", "true", or "yes" (keywords containing letters are case insensitive), or if the option is missing or commented out, ask the system administrator (SA) how the GPG signatures of software packages are being verified. If no process to verify GPG signatures has been approved by the organization, this is a finding.
Fix
Configure RHEL 9 dnf to always check the GPG signature of software packages originating from external software repositories before installation. Add or update the following line in the [main] section of the "/etc/dnf/dnf.conf" file: gpgcheck=1 Note: Any of the following are acceptable: "1", "true", or "yes" (keywords containing letters are case insensitive).
-
RHEL 9 must check the GPG signature of locally installed software packages before installation.
Check
Verify RHEL 9 dnf always checks the GPG signature of locally installed software packages before installation with the following command: $ sudo grep localpkg_gpgcheck /etc/dnf/dnf.conf localpkg_gpgcheck=1 If "localpkg_gpgcheck" is not set to either "1", "true", or "yes" (keywords containing letters are case insensitive), or if the option is missing or commented out, ask the system administrator how the GPG signatures of local software packages are being verified. If no process to verify GPG signatures has been approved by the organization, this is a finding.
Fix
Configure RHEL 9 dnf to always check the GPG signature of local software packages before installation. Add or update the following line in the [main] section of the "/etc/dnf/dnf.conf" file: localpkg_gpgcheck=1 Note: Any of the following are acceptable: "1", "true", or "yes" (keywords containing letters are case insensitive).
-
RHEL 9 must have GPG signature verification enabled for all software repositories.
Check
Verify RHEL 9 software repositories defined in "/etc/yum.repos.d/" have been configured with "gpgcheck" enabled with the following command: $ sudo grep -w gpgcheck /etc/yum.repos.d/*.repo | more gpgcheck = 1 If "gpgcheck" for software packages and repositories is not set to either "1", "true", or "yes" (keywords containing letters are case insensitive), or if the option is missing or commented out, ask the system administrator how the GPG signatures of local software packages are being verified. If no process to verify GPG signatures has been approved by the organization, this is a finding.
Fix
Configure RHEL 9 software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled with the following command: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/* Note: Any of the following are acceptable: "1", "true", or "yes" (keywords containing letters are case insensitive).
-
RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
Check
Verify RHEL 9 does not have an FTP server package installed with the following command: $ sudo dnf list --installed | grep vsftpd If the "vsftpd" package is installed, this is a finding.
Fix
Remove the vsftpd package with the following command: $ sudo dnf remove vsftpd
-
The Trivial File Transfer Protocol (TFTP) server must not be installed unless it is required, and if required, the RHEL 9 TFTP daemon must be configured to operate in secure mode.
Maps to CM-6 via CCI-000366Check
Verify if TFTP is installed, it is configured to operate in secure mode. Note: If TFTP is not required, it must not be installed. If TFTP is not installed, this rule is not applicable. Check to see if TFTP server is installed with the following command: $ sudo dnf list --installed tftp-server Updating Subscription Management repositories. Installed Packages tftp-server.x86_64 5.2-38.el9 @rhel-9-for-x86_64-appstream-rpms Verify the TFTP daemon, if tftp.server is installed, is configured to operate in secure mode with the following command: $ grep -i execstart /usr/lib/systemd/system/tftp.service ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot Note: The "-s" option ensures the TFTP server only serves files from the specified directory, which is a security measure to prevent unauthorized access to other parts of the file system.
Fix
Configure RHEL 9 so that TFTP operates in secure mode if installed. If TFTP server is not required, remove it with the following command: $ sudo dnf -y remove tftp-server Configure the TFTP daemon to operate in secure mode with the following command: $ sudo systemctl edit tftp.service In the editor, enter: [Service] ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot After making changes, reload the systemd daemon and restart the TFTP service as follows: $ sudo systemctl daemon-reload $ sudo systemctl restart tftp.service If the "-s" option is not present in the "ExecStart" line or if the line is missing, this is a finding.
-
RHEL 9 must have the crypto-policies package installed.
Check
Verify that the RHEL 9 crypto-policies package is installed with the following command: $ dnf list --installed crypto-policies Example output: crypto-policies.noarch 20240828-2.git626aa59.el9_5 If the crypto-policies package is not installed, this is a finding.
Fix
Install the crypto-policies package (if the package is not already installed) with the following command: $ sudo dnf -y install crypto-policies
-
RHEL 9 must implement a FIPS 140-3-compliant systemwide cryptographic policy.
Check
Verify RHEL 9 is set to use a FIPS 140-3-compliant systemwide cryptographic policy. Verify the current systemwide crypto-policy with the following command: $ update-crypto-policies --show FIPS If the systemwide crypto-policy is not set to "FIPS", this is a finding. Verify the current minimum crypto-policy configuration with the following commands: $ sudo grep -E 'rsa_size|hash' /etc/crypto-policies/state/CURRENT.pol hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256 min_rsa_size = 2048 If the "hash" values do not include at least the following FIPS 140-3-compliant algorithms, this is a finding: "SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256" If any algorithms include "SHA1" or a hash value less than "224", this is a finding. If the "min_rsa_size" is not set to a value of at least "2048", this is a finding. If these commands do not return any output, this is a finding.
Fix
Configure RHEL 9 to use a FIPS 140-3-compliant systemwide cryptographic policy. Set the systemwide crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto-policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.
-
RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Check
Note: If there is a documented and approved reason for not having data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is Not Applicable. Verify RHEL 9 prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption. Note: If there is a documented and approved reason for not having data-at-rest encryption, this requirement is Not Applicable. List all block devices in tree-like format: $ sudo lsblk --tree NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS zram0 252:0 0 8G 0 disk [SWAP] nvme0n1 259:0 0 476.9G 0 disk |-nvme0n1p1 259:1 0 1G 0 part /boot/efi |-nvme0n1p2 259:2 0 1G 0 part /boot |-nvme0n1p3 259:3 0 474.9G 0 part |-luks- 253:0 0 474.9G 0 crypt |-rhel-root 253:1 0 16G 0 lvm / |-rhel-varcache 253:2 0 8G 0 lvm /var/cache |-rhel-vartmp 253:3 0 4G 0 lvm /var/tmp |-rhel-varlog 253:4 0 4G 0 lvm /var/log |-rhel-home 253:5 0 64G 0 lvm /home |-rhel-varlogaudit 253:6 0 4G 0 lvm /var/log/audit Verify that the block device tree for each persistent filesystem, excluding the /boot and /boot/efi filesystems, has at least one parent block device of type "crypt", and that the encryption type is LUKS: $ sudo cryptsetup status luks-b74f6910-2547-4399-86b2-8b0252d926d7 /dev/mapper/luks-b74f6910-2547-4399-86b2-8b0252d926d7 is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/nvme0n1p3 sector size: 512 offset: 32768 sectors size: 995986063 sectors mode: read/write If there are persistent filesystems (other than /boot or /boot/efi) whose block device trees do not have a crypt block device of type LUKS, ask the administrator to indicate how persistent filesystems are encrypted. If there is no evidence that persistent filesystems are encrypted, this is a finding.
Fix
Configure RHEL 9 to prevent unauthorized modification of all information at rest by using disk encryption. Encrypting a partition in an already installed system is more difficult, because existing partitions will need to be resized and changed. To encrypt an entire partition, dedicate a partition for encryption in the partition layout.
-
There must be no shosts.equiv files on RHEL 9.
Maps to CM-6 via CCI-000366Check
Verify there are no "shosts.equiv" files on RHEL 9 with the following command: $ sudo find / -name shosts.equiv If a "shosts.equiv" file is found, this is a finding.
Fix
Remove any found "shosts.equiv" files from the system. $ sudo rm /[path]/[to]/[file]/shosts.equiv
-
There must be no .shosts files on RHEL 9.
Maps to CM-6 via CCI-000366Check
Verify there are no ".shosts" files on RHEL 9 with the following command: $ sudo find / -name .shosts If a ".shosts" file is found, this is a finding.
Fix
Remove any found ".shosts" files from the system. $ sudo rm /[path]/[to]/[file]/.shosts
-
RHEL 9 SSHD must not allow blank passwords.
Maps to IA-2(2) via CCI-000766Check
Verify that RHEL 9 remote access using SSH prevents logging on with a blank password with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptypasswords' PermitEmptyPasswords no If the "PermitEmptyPasswords" keyword is set to "yes", is missing, or is commented out, this is a finding.
Fix
To configure the system to prevent SSH users from logging on with blank passwords edit the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d": PermitEmptyPasswords no Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service
-
RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Maps to MA-4 via CCI-000877Check
Verify the RHEL 9 SSHD is configured to allow for the UsePAM interface with the following command: $ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*usepam' UsePAM yes If the "UsePAM" keyword is set to "no", is missing, or is commented out, this is a finding.
Fix
Configure the RHEL 9 SSHD to use the UsePAM interface by adding or modifying the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d". UsePAM yes Restart the SSH daemon for the settings to take effect: $ sudo systemctl restart sshd.service
-
The RHEL 9 SSH client must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Maps to AC-17(2) via CCI-001453Check
Verify the SSH client is configured to use only ciphers employing FIPS 140-3 approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ grep -i Ciphers /etc/crypto-policies/back-ends/openssh.config Ciphers [email protected],aes256-ctr,[email protected],aes128-ctr If the cipher entries in the "openssh.config" file have any ciphers other than "[email protected],aes256-ctr,[email protected],aes128-ctr", or they are missing or commented out, this is a finding.
Fix
Configure the SSH client to use only ciphers employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.
-
The RHEL 9 SSH server must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Maps to AC-17(2) via CCI-001453Check
Verify the SSH server is configured to use only ciphers employing FIPS 140-3 approved algorithms. To verify the ciphers in the systemwide SSH configuration file, use the following command: $ sudo grep -i Ciphers /etc/crypto-policies/back-ends/opensshserver.config Ciphers [email protected],aes256-ctr,[email protected],aes128-ctr If the cipher entries in the "opensshserver.config" file have any ciphers other than "[email protected],aes256-ctr,[email protected],aes128-ctr", or they are missing or commented out, this is a finding.
Fix
Configure the RHEL 9 SSH server to use only ciphers employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.
-
The RHEL 9 SSH client must be configured to use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Maps to AC-17(2) via CCI-001453Check
Verify the SSH client is configured to use only MACs employing FIPS 140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ grep -i MACs /etc/crypto-policies/back-ends/openssh.config MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 If the MACs entries in the "openssh.config" file have any hashes other than "[email protected],[email protected],hmac-sha2-256,hmac-sha2-512", or they are missing or commented out, this is a finding.
Fix
Configure the SSH client to use only MACs employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.
-
The RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Maps to AC-17(2) via CCI-001453Check
Verify the SSH server is configured to use only MACs employing FIPS 140-3 approved algorithms. To verify the MACs in the systemwide SSH configuration file, use the following command: $ sudo grep -i MACs /etc/crypto-policies/back-ends/opensshserver.config MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 If the MACs entries in the "opensshserver.config" file have any hashes other than "[email protected],[email protected],hmac-sha2-256,hmac-sha2-512", or they are missing or commented out, this is a finding.
Fix
Configure the RHEL 9 SSH server to use only MACs employing FIPS 140-3 approved algorithms. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.
-
RHEL 9 must not allow unattended or automatic logon via the graphical user interface.
Maps to CM-6 via CCI-000366Check
Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify RHEL 9 does not allow an unattended or automatic logon to the system via a graphical user interface. Check for the value of the "AutomaticLoginEnable" in the "/etc/gdm/custom.conf" file with the following command: $ grep -i automaticlogin /etc/gdm/custom.conf AutomaticLoginEnable=false If the value of "AutomaticLoginEnable" is not set to "false", this is a finding.
Fix
Configure the GNOME desktop display manager to disable automatic login. Set AutomaticLoginEnable to false in the [daemon] section in /etc/gdm/custom.conf. For example: [daemon] AutomaticLoginEnable=false
-
The root account must be the only account having unrestricted access to RHEL 9 system.
Maps to CM-6 via CCI-000366Check
Verify that only the "root" account has a UID "0" assignment with the following command: $ awk -F: '$3 == 0 {print $1}' /etc/passwd root If any accounts other than "root" have a UID of "0", this is a finding.
Fix
Change the UID of any account on the system, other than root, that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.
-
RHEL 9 must use a Linux Security Module configured to enforce limits on system services.
Check
Ensure that RHEL 9 verifies correct operation of security functions through the use of SELinux with the following command: $ getenforce Enforcing If SELINUX is not set to "Enforcing", this is a finding. Verify that SELinux is configured to be enforcing at boot. grep "SELINUX=" /etc/selinux/config # SELINUX= can take one of these three values: # NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also SELINUX=enforcing If SELINUX line is missing, commented out, or not set to "enforcing", this is a finding.
Fix
Configure RHEL 9 to verify correct operation of security functions. Edit the file "/etc/selinux/config" and add or modify the following line: SELINUX=enforcing A reboot is required for the changes to take effect.
-
RHEL 9 must not allow blank or null passwords.
Maps to CM-6 via CCI-000366Check
Verify that null passwords cannot be used with the following command: $ sudo grep -i nullok /etc/pam.d/system-auth /etc/pam.d/password-auth If output is produced, this is a finding. If the system administrator (SA) can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.
Fix
If PAM is managed with authselect, use the following command to remove instances of "nullok": $ sudo authselect enable-feature without-nullok Otherwise, remove any instances of the "nullok" option in the "/etc/pam.d/password-auth" and "/etc/pam.d/system-auth" files to prevent logons with empty passwords. Note: Manual changes to the listed file may be overwritten by the "authselect" program.
-
RHEL 9 must enable FIPS mode.
Check
Verify RHEL 9 is in FIPS mode with the following command: $ cat /proc/sys/crypto/fips_enabled 1 If the command does not return "1", this is a finding.
Fix
Configure RHEL 9 to implement FIPS mode. If this check fails on an installed system, it is a permanent finding until the system is reinstalled with "fips=1" during installation.
-
RHEL 9 IP tunnels must use FIPS 140-3 approved cryptographic algorithms.
Maps to AC-17(2) via CCI-000068Check
Verify that the IPsec service uses the system crypto policy with the following command: Note: If the ipsec service is not installed, this requirement is Not Applicable. $ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf /etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config If the ipsec configuration file does not contain "include /etc/crypto-policies/back-ends/libreswan.config", this is a finding.
Fix
Configure Libreswan to use the system cryptographic policy. Add the following line to "/etc/ipsec.conf": include /etc/crypto-policies/back-ends/libreswan.config
-
RHEL 9 cryptographic policy must not be overridden.
Check
Verify that RHEL 9 cryptographic policies are not overridden. Verify that the configured policy matches the generated policy with the following command: $ sudo update-crypto-policies --check The configured policy matches the generated policy If the returned message does not match the above, but instead matches the following, this is a finding: The configured policy does NOT match the generated policy List all of the crypto backends configured on the system with the following command: $ ls -l /etc/crypto-policies/back-ends/ lrwxrwxrwx. 1 root root 40 Nov 13 16:29 bind.config -> /usr/share/crypto-policies/FIPS/bind.txt lrwxrwxrwx. 1 root root 42 Nov 13 16:29 gnutls.config -> /usr/share/crypto-policies/FIPS/gnutls.txt lrwxrwxrwx. 1 root root 40 Nov 13 16:29 java.config -> /usr/share/crypto-policies/FIPS/java.txt lrwxrwxrwx. 1 root root 46 Nov 13 16:29 javasystem.config -> /usr/share/crypto-policies/FIPS/javasystem.txt lrwxrwxrwx. 1 root root 40 Nov 13 16:29 krb5.config -> /usr/share/crypto-policies/FIPS/krb5.txt lrwxrwxrwx. 1 root root 45 Nov 13 16:29 libreswan.config -> /usr/share/crypto-policies/FIPS/libreswan.txt lrwxrwxrwx. 1 root root 42 Nov 13 16:29 libssh.config -> /usr/share/crypto-policies/FIPS/libssh.txt -rw-r--r--. 1 root root 398 Nov 13 16:29 nss.config lrwxrwxrwx. 1 root root 43 Nov 13 16:29 openssh.config -> /usr/share/crypto-policies/FIPS/openssh.txt lrwxrwxrwx. 1 root root 49 Nov 13 16:29 opensshserver.config -> /usr/share/crypto-policies/FIPS/opensshserver.txt lrwxrwxrwx. 1 root root 46 Nov 13 16:29 opensslcnf.config -> /usr/share/crypto-policies/FIPS/opensslcnf.txt lrwxrwxrwx. 1 root root 43 Nov 13 16:29 openssl.config -> /usr/share/crypto-policies/FIPS/openssl.txt lrwxrwxrwx. 1 root root 48 Nov 13 16:29 openssl_fips.config -> /usr/share/crypto-policies/FIPS/openssl_fips.txt If the paths do not point to the respective files under /usr/share/crypto-policies/FIPS path, this is a finding. Note: nss.config should not be symlinked. Note: If there is an operational need to use a subpolicy that causes the links to the crypto backends to break, this is a finding, and exceptions will need to be made by the authorizing official (AO) and documented with the information system security officer (ISSO).
Fix
Configure RHEL 9 to correctly implement the systemwide cryptographic policies by reinstalling the crypto-policies package contents. Reinstall crypto-policies with the following command: $ sudo dnf -y reinstall crypto-policies Set the crypto-policy to FIPS with the following command: $ sudo update-crypto-policies --set FIPS Setting system policy to FIPS Note: Systemwide crypto policies are applied on application startup. It is recommended to restart the system for the change of policies to fully take place.
-
RHEL 9 must implement DoW-approved encryption in the bind package.
Check
Verify that BIND uses the system crypto policy with the following command: Note: If the "bind" package is not installed, this requirement is Not Applicable. $ sudo grep include /etc/named.conf include "/etc/crypto-policies/back-ends/bind.config";' If BIND is installed and the BIND config file doesn't contain the include "/etc/crypto-policies/back-ends/bind.config" directive, or the line is commented out, this is a finding.
Fix
Configure BIND to use the system crypto policy. Add the following line to the "options" section in "/etc/named.conf": include "/etc/crypto-policies/back-ends/bind.config";
-
RHEL 9 must implement DoW-approved encryption in the OpenSSL package.
Maps to AC-17(2) via CCI-001453Check
Verify the RHEL 9 OpenSSL library is configured to use only ciphers employing FIPS 140-3-approved algorithms with the following command: $ grep -i opensslcnf.config /etc/pki/tls/openssl.cnf .include = /etc/crypto-policies/back-ends/opensslcnf.config If the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf" file, this is a finding.
Fix
Configure the RHEL 9 OpenSSL library to use the systemwide cryptographic policy. Edit the "/etc/pki/tls/openssl.cnf" and add or modify the following line: .include = /etc/crypto-policies/back-ends/opensslcnf.config