STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must use FIPS-validated cryptographic mechanisms to protect the integrity of log information.

DISA Rule

SV-257536r960951_rule

Vulnerability Number

V-257536

Group Title

SRG-APP-000126-CTR-000275

Rule Version

CNTR-OS-000340

Severity

CAT II

CCI(s)

CCI-001350 - Implement cryptographic mechanisms to protect the integrity of audit information.

Weight

Fix Recommendation

Edit the Cluster Log Forwarder configuration to configure TLS on the transport by executing the following:

oc edit clusterlogforwarder <name> -n openshift-logging

For any output->url value that is not using a secure transport, edit the url to use a secure (https:// or tls://) transport.

For detailed information regarding configuration of the Cluster Log Forwarder, refer to https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-external.html.

Check Contents

Verify the Cluster Log Forwarder is using an encrypted transport by executing the following:

oc get clusterlogforwarder -n openshift-logging

For each Cluster Log Forwarder, run the following command to display the configuration.

oc describe clusterlogforwarder <name> -n openshift-logging

Review the configuration and determine if the transport is secure, such as tls:// or https://. If there are any transports configured that are not secured by TLS, this is a finding.

OpenShift must use FIPS-validated cryptographic mechanisms to protect the integrity of log information.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key