Detections
Analytics

1.310 ALMA-09-040060

Information

AlmaLinux OS 9 must implement a FIPS 140-3-compliant systemwide cryptographic policy.

GROUP ID: V-283455
RULE ID: SV-283455r1188509

Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.

Satisfies: SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174

Solution

Configure AlmaLinux OS 9 to use a FIPS 140-3-compliant systemwide cryptographic policy.

Create a subpolicy for enhancements to the base systemwide crypto-policy by creating the file /etc/crypto-policies/policies/modules/STIG.pmod with the following content:

Define ciphers and MACs for OpenSSH and libssh

cipher@SSH=AES-256-GCM AES-256-CTR AES-128-GCM AES-128-CTR
mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256

Apply the policy enhancements to the FIPS systemwide cryptographic policy level with the following command:

$ sudo update-crypto-policies --set FIPS:STIG

Note: If additional subpolicies are being employed, they should be added to the update-crypto-policies command.

To make the cryptographic settings effective for already running services and applications, restart the system:

$ sudo reboot

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: MAINTENANCE, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|MA-4(6), 800-53|SC-13, CCI|CCI-002450, CCI|CCI-003123, Rule-ID|SV-283455r1188509_rule, STIG-ID|ALMA-09-040060, Vuln-ID|V-283455

Plugin: Unix

Control ID: 6088a973a90f232a6abb84bd6825e14f07c514953faf18b7d209d79617bcbb56