Hello,
I was looking over the guide and found some things that may need attention.
2.3.6 - selinux unconfined check should also look for processes with inetd_t
label - excluding xinetd itself. Am inetd_t label also indicates a daemon that
has no policy for it.
2.4 - should a check exist to make sure the stated home dir exists?
2.4.2 - also need to look in /etc/libuser.conf for crypt_style and set it to
SHA512.
2.4.2.4.a - error, has pam_tally2 instead of pam_faillock.
2.4.4.2.a - vlock no longer meets common criteria requirements. It now
requires automatic screen locking after a timeout and reauthentication to
unlock. This was accomplished with the screen program and some code in various
shell startups.
2.5.8.2 - should it say RSA 2048 or higher and SHA2 hash? By 2014 this is
mandatory. Also, probably beyond scope, keys needed for FIPS compliance should
only be generated when the system is in FIPS mode to ensure the RNG passes its
periodic test during key generation.
2.6? - Do we care about setting kernel.dmesg_restrict = 1 in a sysctl?
3.4.3.k - the approved ciphers in FIPS mode are: "aes128-ctr, aes192-ctr,
aes256-ctr, aes128-cbc, 3des-cbc, aes192-cbc, aes256-cbc". A subset of these
are listed and I don't know if there was a reason why all of them are not
allowed.
3.4.3.l Would you want to add FIPS approved MACs? If so they are: "hmac-sha1"
and/or “hmac-sha1-96”. A SHA2 HMAC might be added in the future, but its
undetermined yet.
I have not looked at the daemon setting in detail yet.
Thanks,
-Steve