Detections
Analytics

2.1350 - The system must implement NIST FIPS-validated cryptography - fips

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

 Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223

Solution

Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package.

 To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.

 Configure the operating system to implement DoD-approved encryption by following the steps below:

 The fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key.

 Install the dracut-fips package with the following command:

 # yum install dracut-fips

 Recreate the "initramfs" file with the following command:

 Note: This command will overwrite the existing "initramfs" file.

 # dracut -f

 Modify the kernel command line of the current kernel in the "grub.cfg" file by adding the following option to the GRUB_CMDLINE_LINUX key in the "/etc/default/grub" file and then rebuild the "grub.cfg" file:

 fips=1

 Changes to "/etc/default/grub" require rebuilding the "grub.cfg" file as follows:

 On BIOS-based machines, use the following command:

 # grub2-mkconfig -o /boot/grub2/grub.cfg

 On UEFI-based machines, use the following command:

 # grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg

 If /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi> must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command:

 # df /boot
 Filesystem 1K-blocks Used Available Use% Mounted on
 /dev/sda1 495844 53780 416464 12% /boot

 To ensure the boot= configuration option will work even if device naming changes between boots, identify the universally unique identifier (UUID) of the partition with the following command:

 # blkid /dev/sda1
 /dev/sda1: UUID="05c000f1-a213-759e-c7a2-f11b7424c797" TYPE="ext4"

 For the example above, append the following string to the kernel command line:

 boot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797

 Reboot the system for the changes to take effect.

See Also

https://docs.fedoraproject.org/f28/system-administrators-guide/index.html

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SC-13, 800-53|SI-7(9), CAT|I, CCI|CCI-000068, CCI|CCI-001199, CCI|CCI-002450, CCI|CCI-002476

Plugin: Unix

Control ID: 69a2f2857169ea6180c0c4e465ed500d6d5eb2b2ca572129ffb96062466f2386