ComplianceAsCode / ComplianceAsCode/content
Crypto-policy-related rules fail on RHEL-8 when installed with `fips=1`
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
```
harden_sshd_ciphers_openssh_conf_crypto_policy
harden_sshd_ciphers_opensshserver_conf_crypto_policy
harden_sshd_macs_openssh_conf_crypto_policy
harden_sshd_macs_opensshserver_conf_crypto_policy
```
fail on RHEL-8 (`stig` and `stig_gui`) when using the content-provided Anaconda kickstarts, when the installer is booted with `fips=1`, as opposed to RHEL-9 where these also fail, but don't have any remediation, so a potential failure is presumably expected.
In addition,
```
configure_gnutls_tls_crypto_policy
```
also fails on RHEL-8, and that rule doesn't seem to be part of any relevant RHEL-9 profile.
And
```
configure_crypto_policy
```
fails with the `ospp` profile, also only seems to be on RHEL-8.
#### SCAP Security Guide Version:
master @ cfed0829f21b8baca8e702c37474fd04f500e651
#### Operating System Version:
RHEL-8
#### Steps to Reproduce:
1. Run Contest as `--rhel 8 --arch x86_64 --test "/hardening/anaconda/(stig|ospp)"`, possibly with `CONTENT_PR=12916` (#12916) if it is not merged in the meantime.
#### Additional Information/Debugging Steps:
* [stig-arf.xml.gz](https://github.com/user-attachments/files/18606561/stig-arf.xml.gz)
* [ospp-arf.xml.gz](https://github.com/user-attachments/files/18606560/ospp-arf.xml.gz)
Contributor guide
Assessment
This issue has not been assessed yet.