Fix crypto policy settings in RHEL CIS profiles by jan-cerny · Pull Request #14120 · ComplianceAsCode/content

jan-cerny · 2025-11-12T10:19:19Z

Add a new rule configure_custom_crypto_policy_cis that configures multiple custom crypto sub policy modules for RHEL CIS. The new rule is very similar to fips_custom_stig_sub_policy. It configures new modules for system wide crypto policies that reduces the set of usable ciphers in sshd, MACs, and others.

The rule is templated by a new template crypto_sub_policies that is also introduced in this commit so that the code can be reused in other similar rules.

This change aligns the RHEL CIS profiles in CaC with:

CIS RHEL 8 Benchmark v4.0.0
CIS RHEL 9 Benchmark v2.0.0
CIS RHEL 10 Benchmark v1.0.1

All crypto requirements of the CIS profiles are now covered by this single rule.

This PR replaces the previous PR #14066 - see the discussion there for context!

Resolves: https://issues.redhat.com/browse/RHEL-111896
Also, it resolves crypto-related items from https://issues.redhat.com/browse/RHEL-76009.

Add a new rule `configure_custom_crypto_policy_cis` that configures multiple custom crypto sub policy modules for RHEL CIS. The new rule is very similar to `fips_custom_stig_sub_policy`. It configures new modules for system wide crypto policies that reduces the set of usable ciphers in sshd, MACs, and others. The rule is templated by a new template `crypto_sub_policies` that is also introduced in this commit so that the code can be reused in other similar rules. This change aligns the RHEL CIS profiles in CaC with: - CIS RHEL 8 Benchmark v4.0.0 - CIS RHEL 9 Benchmark v2.0.0 - CIS RHEL 10 Benchmark v1.0.1 All crypto requirements of the CIS profiles are now covered by this single rule. Resolves: https://issues.redhat.com/browse/RHEL-111896

vojtapolasek · 2025-11-12T12:29:28Z

+    -   **sub_policies** - A list of dictionaries. Each dictionary represents one custom crypto sub policy module. The dictionary has the following members:
+


Please consider adding a simple example.

vojtapolasek

Thank you for this rule. I verified it works with Automatus tests.
I have few remarks, please see below.

vojtapolasek · 2025-11-12T12:30:22Z

+
+update-crypto-policies --set {{{ BASE_POLICY }}}:{{{ CONFIGURE_CRYPTO_POLICY_MODULES }}}


Do you think it would make sense to make this command conditional in the same way as in the Ansible remediation?

vojtapolasek · 2025-11-12T12:31:38Z

+        {{{ oval_metadata("Ensure that the custom crypto policy module is configured", rule_title=rule_title) }}}
+        <criteria operator="AND" comment="Ensure that all of the correct lines are in the file.">
+        {{% for sub_policy in SUB_POLICIES %}}
+            <criterion comment="Check that {{{ sub_policy.key }}} is configured in {{{ sub_policy.name }}}"


Suggested change

<criterion comment="Check that {{{ sub_policy.key }}} is configured in {{{ sub_policy.name }}}"

<criterion comment="Check that {{{ sub_policy.key }}} is configured in {{{ sub_policy.module_name }}}"

vojtapolasek · 2025-11-12T13:09:00Z

CVE-2023-48795

+    {
+        "module_name": "NO-SSHWEAKCIPHERS",
+        "key": "cipher@SSH",
+        "value": "-3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC"


Note that in RHEL 9 there is the chacha cipher, here it is not. In the original CIS policy, I think there is the chacha mentioned, but at the same time it is marked as manual... maybe this should be checked later.

I have created this value based on the RHEL 10 CIS requirement 5.1.6 which has exactly this list of ciphers. There are some mentions of the chacha cipher, but it doesn't say that we should add it to the NO-SSHWEAKCIPHERS.module.

I noticed that the RHEL 9 CIS benchmark contains requirement 1.6.6 "Ensure system wide crypto policy disables chacha20-poly1305 for ssh". But, RHEL 10 CIS benchmark doesn't contain this requirement.

The RHEL 9 requirement 1.6.6 says that the chacha cipher should be disabled only if the system is affected by CVE-2023-48795. It says: if CVE-2023-48795 has been addressed, and it meets local site policy, this
recommendation may be skipped. The Red Hat page https://access.redhat.com/security/cve/cve-2023-48795 doesn't list RHEL 10 as affected by this CVE. Based on that I think the reason the requirement isn't here is because RHEL 10 doesn't suffer from this CVE and therefore it's fine to use the chacha20-poly1305 cipher on RHEL 10.

Do not run the update command if the correct crypto policy is already set.

jan-cerny · 2025-11-12T15:12:04Z

I have added an example to the documentation, I have improved idempotency of the Bash remediation and I have fixed comment in an OVAL criterion element.

ggbecker · 2025-11-13T14:09:21Z

+    {
+        "module_name": "NO-WEAKMAC",
+        "key": "mac",
+        "value": "-*-64*"


Why do we have 64 here and not 128 the same as RHEL8 and RHEL10?

in RHEL9 CIS 2.0.0 we have
1.6.4 Ensure system wide crypto policy disables macs less than
128 bits (Automated)

and then in the code it actually disables 64. Maybe it's an issue in the benchmark.

I have created https://workbench.cisecurity.org/benchmarks/18210/tickets/26578 to check if that is a real issue.

So, checking the ticket again, it seems it was a mistake indeed. So your code remains the same as changed in a77ffb1

In RHEL9 CIS 2.0.0 we have 1.6.4 Ensure system wide crypto policy disables macs less than 128 bits, but the prose says 64. This is an issue in CIS Benchmark, see https://workbench.cisecurity.org/benchmarks/18210/tickets/26578

openshift-ci · 2025-11-13T16:44:35Z

@jan-cerny: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	`a77ffb1`	link	true	`/test e2e-aws-openshift-node-compliance`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jan-cerny · 2025-11-14T07:52:57Z

/test e2e-aws-openshift-node-compliance

vojtapolasek

LGTM now, thank you.

jan-cerny added this to the 0.1.79 milestone Nov 12, 2025

jan-cerny requested review from a team, Mab879, matusmarhefka and vojtapolasek as code owners November 12, 2025 10:19

jan-cerny mentioned this pull request Nov 12, 2025

Fix crypto policy settings in CIS #14066

Closed

jan-cerny force-pushed the cis_crypto branch from f3dd0c0 to 80c3dbf Compare November 12, 2025 10:37

Add packages directive to test scenarios

90bf0a2

vojtapolasek reviewed Nov 12, 2025

View reviewed changes

vojtapolasek requested changes Nov 12, 2025

View reviewed changes

jan-cerny added 3 commits November 12, 2025 14:50

Add a simple example to template documentation

5c2ed5e

Improve idempotency of bash remediation

1d351b2

Do not run the update command if the correct crypto policy is already set.

Fix comment in OVAL criterion element

f2957a6

Mab879 assigned vojtapolasek Nov 12, 2025

ggbecker reviewed Nov 13, 2025

View reviewed changes

ggbecker self-assigned this Nov 13, 2025

Fix weak MACs bits on RHEL 9

a77ffb1

In RHEL9 CIS 2.0.0 we have 1.6.4 Ensure system wide crypto policy disables macs less than 128 bits, but the prose says 64. This is an issue in CIS Benchmark, see https://workbench.cisecurity.org/benchmarks/18210/tickets/26578

vojtapolasek approved these changes Nov 14, 2025

View reviewed changes

vojtapolasek merged commit 43e69b1 into ComplianceAsCode:master Nov 14, 2025
138 of 140 checks passed

		- sub_policies - A list of dictionaries. Each dictionary represents one custom crypto sub policy module. The dictionary has the following members:


		update-crypto-policies --set {{{ BASE_POLICY }}}:{{{ CONFIGURE_CRYPTO_POLICY_MODULES }}}

	<criterion comment="Check that {{{ sub_policy.key }}} is configured in {{{ sub_policy.name }}}"
	<criterion comment="Check that {{{ sub_policy.key }}} is configured in {{{ sub_policy.module_name }}}"

Conversation

jan-cerny commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vojtapolasek left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-cerny commented Nov 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Nov 13, 2025

Uh oh!

jan-cerny commented Nov 14, 2025

Uh oh!

vojtapolasek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jan-cerny commented Nov 12, 2025 •

edited

Loading