STIGQter: STIG Summary: Oracle Linux 9 Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

OL 9 must implement a FIPS 140-3 compliant systemwide cryptographic policy.

DISA Rule

SV-271478r1190787_rule

Vulnerability Number

V-271478

Group Title

SRG-OS-000396-GPOS-00176

Rule Version

OL09-00-000241

Severity

CAT I

CCI(s)

CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

Fix Recommendation

Configure OL 9 to use a modified FIPS-compliant systemwide crypto-policy.

Create subpolicies for enhancements to the systemwide crypto-policy with the following commands:

Create or edit the SCOPES-AND-WILDCARDS policy module in a text editor and insert options that modify the systemwide cryptographic policy as follows:

$ sudo vi /etc/crypto-policies/policies/modules/SCOPES-AND-WILDCARDS.pmod

Add the following lines to the policy:

# Disable CHACHA20-POLY1305 for the TLS protocol (OpenSSL, GnuTLS, NSS, and OpenJDK)
cipher@TLS = -CHACHA20-POLY1305

# Disable all CBC mode ciphers for the SSH protocol (libssh and OpenSSH):

cipher@SSH = -*-CBC

Create or edit the OPENSSH-SUBPOLICY module in a text editor and insert options that modify the systemwide crypto-policy as follows:

$ sudo vi /etc/crypto-policies/policies/modules/OPENSSH-SUBPOLICY.pmod

Add the following lines to the policy:

# Define ciphers for OpenSSH
cipher@SSH=AES-256-GCM AES-128-GCM AES-256-CTR AES-128-CTR

# Define MACs for OpenSSH
mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256

Create or edit the REQUIRE.pmod file and add the following lines to include the subpolicies in the FIPS configuration with the following command:

$ sudo vi /etc/crypto-policies/policies/modules/REQUIRE.pmod

Add the following lines to REQUIRE.pmod:

@OPENSSH-SUBPOLICY
@SCOPES-AND-WILDCARDS

Apply the policy enhancements to the FIPS systemwide cryptographic policy level with the following command:

$ sudo update-crypto-policies --set FIPS

Note: If additional subpolicies are being employed, they must be added to the REQUIRE.pmod as well. REQUIRE.pmod is included in the systemwide crypto-policy when it is set.

To make the cryptographic settings effective for already running services and applications, restart the system:

$ sudo reboot

Check Contents

Verify OL 9 is set to use a modified FIPS compliant systemwide crypto-policy.

$ update-crypto-policies --show
FIPS

If the systemwide crypto-policy is not set to "FIPS", this is a finding.

Note: If subpolicies have been configured, they will be listed in a colon-separated list starting with FIPS as follows:

FIPS:<SUBPOLICY-NAME>:<SUBPOLICY-NAME>.

Verify the current minimum crypto-policy configuration with the following commands:

$ grep -E 'rsa_size|hash' /etc/crypto-policies/state/CURRENT.pol
hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256
min_rsa_size = 2048

If the "hash" values do not include at least the following FIPS 140-3-compliant algorithms, "SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256", this is a finding.

If there are algorithms that include "SHA1" or a hash value less than "256", this is a finding.

If the "min_rsa_size" is not set to a value of at least 2048, this is a finding.

If these commands do not return any output, this is a finding.

Vulnerability Number

V-271478

Documentable

False

Rule Version

OL09-00-000241

Severity Override Guidance

Check Content Reference

Target Key

5680