OpenControls Logo

STIG Viewer

STIGViewer Support

AlmaLinux OS 9 must implement a FIPS 140-3-compliant systemwide cryptographic policy.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283455ALMA-09-040060SV-283455r1188509_ruleCCI-003123high
Description
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. Satisfies: SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174
STIGDate
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide2026-02-27

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05.3Remote Maintenance Cryptographic Protection
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (26) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(4)Automated Audit Actions
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-9(3)Cryptographic Protection
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00

+16 more (top 10 by confidence shown)

CCI1 mapping
CCI-003123
1.00

Details

Check Text (C-283455r1188509_chk)

Verify AlmaLinux OS 9 is set to use a FIPS 140-3-compliant systemwide cryptographic policy with the following command: $ update-crypto-policies --show FIPS If the systemwide crypto policy is not set to "FIPS", this is a finding. Note: If subpolicies have been configured, they could be listed in a colon-separated list starting with "FIPS" as follows FIPS:<SUBPOLICY-NAME>. This is not a finding. Note: Subpolicies like AD-SUPPORT should be configured according to the latest guidance from the operating system vendor. Verify the current minimum crypto-policy configuration with the following commands: $ grep -E 'rsa_size|hash' /etc/crypto-policies/state/CURRENT.pol hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256 min_rsa_size = 2048 If the "hash" values do not include at least the following FIPS 140-3-compliant algorithms "SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256", this is a finding. If there are algorithms that include "SHA1" or a hash value less than "224" this is a finding. If the "min_rsa_size" is not set to a value of at least 2048, this is a finding. If these commands do not return any output, this is a finding.

Fix Text (F-87925r1188508_fix)

Configure AlmaLinux OS 9 to use a FIPS 140-3-compliant systemwide cryptographic policy. Create a subpolicy for enhancements to the base systemwide crypto-policy by creating the file /etc/crypto-policies/policies/modules/STIG.pmod with the following content: # Define ciphers and MACs for OpenSSH and libssh cipher@SSH=AES-256-GCM AES-256-CTR AES-128-GCM AES-128-CTR mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256 Apply the policy enhancements to the FIPS systemwide cryptographic policy level with the following command: $ sudo update-crypto-policies --set FIPS:STIG Note: If additional subpolicies are being employed, they should be added to the update-crypto-policies command. To make the cryptographic settings effective for already running services and applications, restart the system: $ sudo reboot