Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

crypto-policies expects "DEFAULT" yet CIS Benchmark says "not LEGACY"

Aperta
  • Qualcosa non va?
#13,741 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
38/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
linux, shell
Ambito
operating-systems, security

Direzione di ricerca

Inizia riproducendo il malfunzionamento con il comando oscap fornito, utilizzando il profilo xccdf_org.ssgproject.content_profile_cis_server_l1 e ssg-al2023-ds.xml. Confronta il controllo Configure System Cryptography Policy con il requisito CIS e l’impostazione FIPS di AL2023; il lavoro è completato quando il profilo supera correttamente una configurazione FIPS non LEGACY.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

triaged
Description of problem:

I hardened my AL2023 instance, including enabling FIPS and then ran the openSCAP audit.
The audit says I failed the "Configure System Cryptography Policy" because /etc/crypto-policies/config is not "DEFAULT" (or DEFAULT:NO-SHA1).
It's set to "FIPS".

The CIS Benchmark clearly says that the expected value is "Not LEGACY". It doesn't expect it to be "DEFAULT" so I'm not sure why the check is looking for "DEFAULT".

SCAP Security Guide Version:

0.1.77

Operating System Version:

AL2023

Steps to Reproduce:
  1. Harden AL2023
  2. Enable FIPS
  3. Run audit: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --report ec2-al2023_oscap-ssg-report_2025-07-23-01-01-06.html scap-security-guide-0.1.77/ssg-al2023-ds.xml
Actual Results:

Failed "Configure System Cryptography Policy"

Expected Results:

Pass "Configure System Cryptography Policy"

Additional Information/Debugging Steps:

CIS_Amazon_linux_2023_Benchmark_v1.0.0.pdf

1.9 Ensure system-wide crypto policy is not legacy (Automated)
Profile Applicability:
• Level 1 - Server
Description:
The system-wide crypto-policies followed by the crypto core components allow
consistently deprecating and disabling algorithms system-wide.
The individual policy levels (DEFAULT, LEGACY, FUTURE, and FIPS) are included in
the crypto-policies(7) package.
Rationale:
If the Legacy system-wide crypto policy is selected, it includes support for TLS 1.0, TLS
1.1, and SSH2 protocols or later. The algorithms DSA, 3DES, and RC4 are allowed,
while RSA and Diffie-Hellman parameters are accepted if larger than 1023-bits.
These legacy protocols and algorithms can make the system vulnerable to attacks,
including those listed in RFC 7457
Impact:
Environments that require compatibility with older insecure protocols may require the
use of the less secure LEGACY policy level.
Audit:
Run the following command to verify that the system-wide crypto policy is not LEGACY

grep -E -i '^\sLEGACY\s(\s+#.*)?$' /etc/crypto-policies/config

Verify that no lines are returned
Remediation:
Run the following command to change the system-wide crypto policy

update-crypto-policies --set

Example:

update-crypto-policies --set DEFAULT

Run the following to make the updated system-wide crypto policy active

update-crypto-policies

Default Value:
DEFAULT
Page 196
References:

  1. CRYPTO-POLICIES(7)
  2. https://access.redhat.com/articles/3642912#what-polices-are-provided-1
  3. NIST SP 800-53 Rev. 5: SC-8
    Additional Information:
    To switch the system to FIPS mode, run the following command:
    fips-mode-setup --enable
    CIS Controls:
    Controls
    Version Control IG 1 IG 2 IG 3
    v8
    3.10 Encrypt Sensitive Data in Transit
    Encrypt sensitive data in transit. Example implementations can include:
    Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).
    ● ●
    v7 14.4 Encrypt All Sensitive Information in Transit
    Encrypt all sensitive information in transit. ●
Lingua principale
Shell
Stelle
2.8k
Fork
842
Merge medio
2g 22h
PR unite (30g)
69

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ComplianceAsCode/content

Tutte le issue di ComplianceAsCode/content

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.