I had the same thoughts on these checks, but the wording in the DISA STIGs are very
subtle.
V-72073 (AIDE implements FIPS..) has a note in the Check Text that reads:
Note: If RHEL-07-021350 is a finding, this is automatically a finding too as the system
cannot implement FIPS 140-2 approved cryptographic algorithms and hashes.
RHEL-07-021350 is related to the system running in FIPS mode (V-72067).
V-72067 states :
The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated
cryptography for the following: to provision digital signatures, to generate cryptographic
hashes, and to protect data requiring data-at-rest protections in accordance with
applicable federal laws, Executive Orders, directives, policies, regulations, and
standards.
Notice the phrase “NIST FIPS-validated cryptography”….that implies that the FIPS
implementation must be certified by NIST. Centos and others implementation of FIPS are
not officially certified by NIST, so they can never pass V-72067 and thus never pass
V-72073.
At least that is how I am reading the logic.
Robert
From: Chuck Atkins <chuck.atkins(a)kitware.com>
Sent: Friday, October 11, 2019 12:11 PM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>
Subject: Excessive FIPS checks
So, I tied doing this via github but it seems the issue and PR were just abruptly closed
within 20m without any meaningful conversation so I'm hoping that there can be a more
fruitful discussion on list here.
https://github.com/ComplianceAsCode/content/issues/4917<https://nam01....
https://github.com/ComplianceAsCode/content/pull/4920<https://nam01.sa...
The issue in question is that any FIPS related check includes a test for whether or not
the OS is FIPS certified. That seems to make sense as a stand alone rule but
shouldn't that be orthogonal to whether or not SSH is configured to use FIPS approved
crypto algorithms or if AIDE is configured to exclusively use FIPS approved hashes? The
rule isn't whether or not ssh is FIPS approved but just whether or not it's
configuration is such that only approved ciphers are used.
----------
Chuck Atkins
Staff R&D Engineer, Scientific Computing
Kitware, Inc.
(518) 881-1183
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner
Corporation and are intended only for the addressee. The information contained in this
message is confidential and may constitute inside or non-public information under
international, federal, or state securities laws. Unauthorized forwarding, printing,
copying, distribution, or use of such information is strictly prohibited and may be
unlawful. If you are not the addressee, please promptly delete this message and notify the
sender of the delivery error by e-mail or you may call Cerner's corporate offices in
Kansas City, Missouri, U.S.A at (+1) (816)221-1024.