ComplianceAsCode / ComplianceAsCode/content

Crypto-policy-related rules fail on RHEL-8 when installed with `fips=1`

Open
#12,942 10 comments 0 reactions 0 assignees View on GitHub
blocked productization-issue RHEL RHEL8 triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

```
harden_sshd_ciphers_openssh_conf_crypto_policy
harden_sshd_ciphers_opensshserver_conf_crypto_policy
harden_sshd_macs_openssh_conf_crypto_policy
harden_sshd_macs_opensshserver_conf_crypto_policy
```
fail on RHEL-8 (`stig` and `stig_gui`) when using the content-provided Anaconda kickstarts, when the installer is booted with `fips=1`, as opposed to RHEL-9 where these also fail, but don't have any remediation, so a potential failure is presumably expected.

In addition,
```
configure_gnutls_tls_crypto_policy
```
also fails on RHEL-8, and that rule doesn't seem to be part of any relevant RHEL-9 profile.

And
```
configure_crypto_policy
```
fails with the `ospp` profile, also only seems to be on RHEL-8.

#### SCAP Security Guide Version:
master @ cfed0829f21b8baca8e702c37474fd04f500e651

#### Operating System Version:
RHEL-8

#### Steps to Reproduce:

1. Run Contest as `--rhel 8 --arch x86_64 --test "/hardening/anaconda/(stig|ospp)"`, possibly with `CONTENT_PR=12916` (#12916) if it is not merged in the meantime.

#### Additional Information/Debugging Steps:
* [stig-arf.xml.gz](https://github.com/user-attachments/files/18606561/stig-arf.xml.gz)
* [ospp-arf.xml.gz](https://github.com/user-attachments/files/18606560/ospp-arf.xml.gz)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.