STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

DISA Rule

SV-283446r1188530_rule

Vulnerability Number

V-283446

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

OL08-00-010182

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Configure OL 8 to implement DOD-approved encryption by following the steps below:

To enable strict FIPS compliance, the fips=1 kernel option must be added to the kernel boot parameters during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.

Enable FIPS mode after installation (not strict FIPS-compliant) with the following command:

$ sudo fips-mode-setup --enable

Reboot the system for the changes to take effect.

Check Contents

Verify OL 8 implements DOD-approved encryption to protect the confidentiality of remote access sessions.

Show the configured systemwide cryptographic policy by running the following command:

$ sudo update-crypto-policies --show
FIPS

If the main policy name is not "FIPS", this is a finding.

If the AD-SUPPORT subpolicy module is included (e.g., "FIPS:AD-SUPPORT"), and Active Directory support is not documented as an operational requirement with the information system security officer (ISSO), this is a finding.

If the NO-ENFORCE-EMS subpolicy module is included (e.g., "FIPS:NO-ENFORCE-EMS"), and not enforcing EMS is not documented as an operational requirement with the ISSO, this is a finding.

If any other subpolicy module is included, this is a finding.

Vulnerability Number

V-283446

Documentable

False

Rule Version

OL08-00-010182

Severity Override Guidance

Verify OL 8 implements DOD-approved encryption to protect the confidentiality of remote access sessions.

Show the configured systemwide cryptographic policy by running the following command:

$ sudo update-crypto-policies --show
FIPS

If the main policy name is not "FIPS", this is a finding.

If the AD-SUPPORT subpolicy module is included (e.g., "FIPS:AD-SUPPORT"), and Active Directory support is not documented as an operational requirement with the information system security officer (ISSO), this is a finding.

If the NO-ENFORCE-EMS subpolicy module is included (e.g., "FIPS:NO-ENFORCE-EMS"), and not enforcing EMS is not documented as an operational requirement with the ISSO, this is a finding.

If any other subpolicy module is included, this is a finding.

Check Content Reference

M

Target Key

5416