Detections
Analytics

1.6.8 Ensure system-wide crypto policy is FIPS

Information

The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

The system-wide cryptographic policies contain a policy level that enables cryptographic algorithms in accordance with the requirements by the Federal Information Processing Standard (FIPS) Publication 140. The fips-mode-setup tool that enables or disables FIPS mode internally uses the FIPS systemwide cryptographic policy. Switching the system to FIPS mode by using the FIPS system-wide cryptographic policy does not guarantee compliance with the FIPS 140 standard. Re-generating all cryptographic keys after setting the system to FIPS mode may not be possible. For example, in the case of an existing IdM realm with users' cryptographic keys you cannot re-generate all the keys. The fips-mode-setup tool uses the FIPS policy internally. But on top of what the update-crypto-policies command with the --set FIPS option does, fips-mode-setup ensures the installation of the FIPS dracut module by using the fips-finish-install tool, it also adds the fips=1 boot option to the kernel command line and regenerates the initial ramdisk.

IMPORTANT: Only enabling FIPS mode during installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place.

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000125-GPOS-00065, SRG-OS-000396-GPOS-00176, SRG-OS-000423-GPOS-00187, SRG-OS-000478-GPOS-00223

Solution

Run the following command to switch the system to FIPS mode:

# fips-mode-setup --enable

Output will include:

FIPS mode will be enabled.
Please reboot the system for the setting to take effect

Run the following command to restart the system:

# reboot

After the reboot has completed, re-run the Audit Procedure to verify FIPS mode

Note:

 - To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel boot parameters during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users must also ensure the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a nonunique key.
 - RHEL 8 utilizes GRUB 2 as the default bootloader. Note that GRUB 2 command-line parameters are defined in the kernelopts variable of the /boot/grub2/grubenv file for all kernel boot entries. The command fips-mode-setup modifies the "kernelopts" variable, which in turn updates all kernel boot entries.
 - kernelopts variables can be viewed with the grubby --info=all all command

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17, CAT|I, CSCv7|14.4, Rule-ID|SV-230223r928585_rule, STIG-ID|RHEL-08-010020, Vuln-ID|V-230223

Plugin: Unix

Control ID: 6c1bce3a159ce57502ca4621225ead6c158ec5e99cfe52123581a8f44b9bf793