STIGQter STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 crypto policy must not be overridden.

DISA Rule

SV-282602r1200786_rule

Vulnerability Number

V-282602

Group Title

SRG-OS-000396-GPOS-00176

Rule Version

TOSS-05-000470

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure TOSS 5 to FIPS crypto policy.

$ sudo ln -s /usr/share/crypto-policies/FIPS/<service>.txt /etc/crypto-policies/back-ends/<service>.conf

Replace <service> with every service that is not set to FIPS.

Restart the system for the changes to take effect.

Check Contents

Verify TOSS 5 custom crypto policies are loaded correctly.

List all of the crypto backends configured on the system.

$ ls -l /etc/crypto-policies/back-ends/
lrwxrwxrwx. 1 root root 40 Oct 7 08:44 bind.config -> /usr/share/crypto-policies/FIPS/bind.txt
lrwxrwxrwx. 1 root root 42 Oct 7 08:44 gnutls.config -> /usr/share/crypto-policies/FIPS/gnutls.txt
lrwxrwxrwx. 1 root root 40 Oct 7 08:44 java.config -> /usr/share/crypto-policies/FIPS/java.txt
lrwxrwxrwx. 1 root root 46 Oct 7 08:44 javasystem.config -> /usr/share/crypto-policies/FIPS/javasystem.txt
lrwxrwxrwx. 1 root root 40 Oct 7 08:44 krb5.config -> /usr/share/crypto-policies/FIPS/krb5.txt
lrwxrwxrwx. 1 root root 45 Oct 7 08:44 libreswan.config -> /usr/share/crypto-policies/FIPS/libreswan.txt
lrwxrwxrwx. 1 root root 42 Oct 7 08:44 libssh.config -> /usr/share/crypto-policies/FIPS/libssh.txt
lrwxrwxrwx. 1 root root 39 Oct 7 08:44 nss.config -> /usr/share/crypto-policies/FIPS/nss.txt
lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssh.config -> /usr/share/crypto-policies/FIPS/openssh.txt
lrwxrwxrwx. 1 root root 49 Oct 7 08:44 opensshserver.config -> /usr/share/crypto-policies/FIPS/opensshserver.txt
lrwxrwxrwx. 1 root root 46 Oct 7 08:44 opensslcnf.config -> /usr/share/crypto-policies/FIPS/opensslcnf.txt
lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssl.config -> /usr/share/crypto-policies/FIPS/openssl.txt

If the paths do not point the respective files under "/usr/share/crypto-policies/FIPS" path, this is a finding.

Vulnerability Number

V-282602

Documentable

False

Rule Version

TOSS-05-000470

Severity Override Guidance

Verify TOSS 5 custom crypto policies are loaded correctly.

List all of the crypto backends configured on the system.

$ ls -l /etc/crypto-policies/back-ends/
lrwxrwxrwx. 1 root root 40 Oct 7 08:44 bind.config -> /usr/share/crypto-policies/FIPS/bind.txt
lrwxrwxrwx. 1 root root 42 Oct 7 08:44 gnutls.config -> /usr/share/crypto-policies/FIPS/gnutls.txt
lrwxrwxrwx. 1 root root 40 Oct 7 08:44 java.config -> /usr/share/crypto-policies/FIPS/java.txt
lrwxrwxrwx. 1 root root 46 Oct 7 08:44 javasystem.config -> /usr/share/crypto-policies/FIPS/javasystem.txt
lrwxrwxrwx. 1 root root 40 Oct 7 08:44 krb5.config -> /usr/share/crypto-policies/FIPS/krb5.txt
lrwxrwxrwx. 1 root root 45 Oct 7 08:44 libreswan.config -> /usr/share/crypto-policies/FIPS/libreswan.txt
lrwxrwxrwx. 1 root root 42 Oct 7 08:44 libssh.config -> /usr/share/crypto-policies/FIPS/libssh.txt
lrwxrwxrwx. 1 root root 39 Oct 7 08:44 nss.config -> /usr/share/crypto-policies/FIPS/nss.txt
lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssh.config -> /usr/share/crypto-policies/FIPS/openssh.txt
lrwxrwxrwx. 1 root root 49 Oct 7 08:44 opensshserver.config -> /usr/share/crypto-policies/FIPS/opensshserver.txt
lrwxrwxrwx. 1 root root 46 Oct 7 08:44 opensslcnf.config -> /usr/share/crypto-policies/FIPS/opensslcnf.txt
lrwxrwxrwx. 1 root root 43 Oct 7 08:44 openssl.config -> /usr/share/crypto-policies/FIPS/openssl.txt

If the paths do not point the respective files under "/usr/share/crypto-policies/FIPS" path, this is a finding.

Check Content Reference

M

Target Key

5738