Detections
Analytics
1.6.1 Ensure system wide crypto policy is not set to legacy
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
When a system-wide policy is set up, the default behavior of applications will be to follow the policy. Applications will be unable to use algorithms andprotocols that do not meet the policy, unless you explicitly request the application to do so.
The system-wide crypto-policies followed by the crypto core components allow consistently deprecating and disabling algorithms system-wide.
The LEGACY policy ensures maximum compatibility with version 5 of the operating system and earlier; it is less secure due to an increased attack surface. In addition to the DEFAULT level algorithms and protocols, it includes support for the TLS 1.0 and 1.1 protocols. The algorithms DSA, 3DES, and RC4 are allowed, while RSA keys and Diffie-Hellman parameters are accepted if they are at least 1023 bits long.
If the LEGACY system-wide crypto policy is selected, it includes support for TLS 1.0, TLS 1.1, and SSH2 protocols or later. The algorithms DSA, 3DES, and RC4 are allowed, while RSA and Diffie-Hellman parameters are accepted if larger than 1023-bits.
These legacy protocols and algorithms can make the system vulnerable to attacks, including those listed in RFC 7457
Solution
Run the following command to change the system-wide crypto policy# update-crypto-policies --set <CRYPTO POLICY>
Example:
# update-crypto-policies --set DEFAULT
Run the following to make the updated system-wide crypto policy active
# update-crypto-policies
Impact:
Environments that require compatibility with older insecure protocols may require the use
of the less secure LEGACY policy level.
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v2.0.0 L1 Server
References: CSCv7|14.4
Plugin: Unix
Control ID: 33af6f508ff01c850d71cc554afe978ef818a0b30ea21082b6963b3751f1351d