SV-204497r958408: The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. | Red Hat Enterprise Linux 7 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Description

Discussion Text

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000068Not mappedCCI-001199Not mappedCCI-002450Not mappedCCI-002476SV-86691V-72067

References

DPMS Target Red Hat Enterprise Linux 7 DISA DPMS Target Red Hat Enterprise Linux 7 2899

Checks

DISA STIG (Manual Reference)

Verify the operating system implements DoD-approved encryption to protect the confidentiality of remote access sessions.

Check to see if the "dracut-fips" package is installed with the following command:

# yum list installed dracut-fips

dracut-fips-033-360.el7_2.x86_64.rpm

If a "dracut-fips" package is installed, check to see if the kernel command line is configured to use FIPS mode with the following command:

Note: GRUB 2 reads its configuration from the "/boot/grub2/grub.cfg" file on traditional BIOS-based machines and from the "/boot/efi/EFI/redhat/grub.cfg" file on UEFI machines.

# grep fips /boot/grub2/grub.cfg
/vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet

If the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the following command:

# cat /proc/sys/crypto/fips_enabled 
1

If a "dracut-fips" package is not installed, the kernel command line does not have a fips entry, or the system has a value of "0" for "fips_enabled" in "/proc/sys/crypto", this is a finding.

Verify the file /etc/system-fips exists.

# ls -l /etc/system-fips

If this file does not exist, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7os:def:204497
# The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test) -- fips=1 in grub.cfg: no extractor for field "subexpression"

# Prelink package is not installed
# rpminfo_object (rpminfo_test)
test_1() {
  ! ( rpm -q --quiet 'prelink' &>/dev/null )
}
# Prelinking is disabled
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -Pq '^[\s]*PRELINKING=no[\s]*' '/etc/sysconfig/prelink' &>/dev/null
}
# Dracut-fips package is installed
# rpminfo_object (rpminfo_test)
test_3() {
  rpm -q --quiet 'dracut-fips' &>/dev/null
}
# fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  (sed -En 's/^\s*GRUB_CMDLINE_LINUX="(.*)"$/\1/p' '/etc/default/grub') | grep -Pq '^(.* )?fips=1( .*)?$'
}
# fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT
# textfilecontent54_object (textfilecontent54_test)
test_5() {
  (sed -En 's/^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$/\1/p' '/etc/default/grub') | grep -Pq '^(.* )?fips=1( .*)?$'
}
# 1 in /proc/sys/crypto/fips_enabled
# textfilecontent54_object (textfilecontent54_test)
test_7() {
  grep -Pq '^1$' '/proc/sys/crypto/fips_enabled' &>/dev/null
}
# no uncommented fips=0 anywhere in /etc/default/grub
# textfilecontent54_object (textfilecontent54_test)
test_8() {
  ! ( grep -Pq '^[^#]*fips=0' '/etc/default/grub' &>/dev/null )
}
# /etc/system-fips exists
# file_object (file_test)
test_9() {
  test -e '/etc/system-fips' &>/dev/null
}

if ( ( test_1 || test_2 ) && test_3 && ( test_4 || test_5 ) && test_7 && test_8 && test_9 ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Remediation

Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package.

To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.

Configure the operating system to implement DoD-approved encryption by following the steps below: 

The fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key.

Install the dracut-fips package with the following command:

# yum install dracut-fips

Recreate the "initramfs" file with the following command:

Note: This command will overwrite the existing "initramfs" file.

# dracut -f

Modify the kernel command line of the current kernel in the "grub.cfg" file by adding the following option to the GRUB_CMDLINE_LINUX key in the "/etc/default/grub" file and then rebuild the "grub.cfg" file:

fips=1

Changes to "/etc/default/grub" require rebuilding the "grub.cfg" file as follows:

On BIOS-based machines, use the following command:

# grub2-mkconfig -o /boot/grub2/grub.cfg

On UEFI-based machines, use the following command:

# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

If /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi> must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command:

# df /boot
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda1 495844 53780 416464 12% /boot

To ensure the "boot=" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command:

# blkid /dev/sda1
/dev/sda1: UUID="05c000f1-a213-759e-c7a2-f11b7424c797" TYPE="ext4"

For the example above, append the following string to the kernel command line:

boot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797

If the file /etc/system-fips does not exists, recreate it:

# touch /etc/ system-fips

Reboot the system for the changes to take effect.