ComplianceAsCode / ComplianceAsCode/content

RHEL-9-V2R6:OpenSCAP profile V2R5 expects different MAC order than STIG benchmark V2R6 specifies

Open
#14,599 1 comment 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
DISA STIG requires configuring SSH Server to use FIPS 140-3 Validated MACs, but OpenSCAP audit logic expects a different MAC order than what the current STIG benchmark V2R6 specifies

#### Details:
OpenSCAP profile V2R5 expects MACs in order '256-etm,512-etm' but STIG benchmark specifies STIG.pmod with 'mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256

The misalignment affects this profile:

RHEL-09 V2R1-V2R6 STIG
The misalignment affects this rule:

RHEL-09-255075
Outcome:
The OpenSCAP tests are corrected to look for the correct audit rule

SCAP Security Guide Version: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.79

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.