STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must use FIPS 140-3-approved cryptographic algorithms for IP tunnels.

DISA Rule

SV-281014r1165397_rule

Vulnerability Number

V-281014

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

RHEL-10-300070

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

Configure RHEL 10 so that Libreswan uses the systemwide cryptographic policy.

Add the following line to "/etc/ipsec.conf":

include /etc/crypto-policies/back-ends/libreswan.config

Check Contents

Note: If the IPsec service is not installed, this requirement is not applicable.

Verify RHEL 10 sets the IPsec service to use the systemwide cryptographic policy with the following command:

$ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf
/etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config

If the ipsec configuration file does not contain "include /etc/crypto-policies/back-ends/libreswan.config", this is a finding.

Vulnerability Number

V-281014

Documentable

False

Rule Version

RHEL-10-300070

Severity Override Guidance

Note: If the IPsec service is not installed, this requirement is not applicable.

Verify RHEL 10 sets the IPsec service to use the systemwide cryptographic policy with the following command:

$ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf
/etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config

If the ipsec configuration file does not contain "include /etc/crypto-policies/back-ends/libreswan.config", this is a finding.

Check Content Reference

M

Target Key

5733