STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must implement a FIPS 140-2/140-3 compliant systemwide cryptographic policy.

DISA Rule

SV-283452r1188500_rule

Vulnerability Number

V-283452

Group Title

SRG-OS-000396-GPOS-00176

Rule Version

AZLX-23-001270

Severity

CAT I

CCI(s)

CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

Weight

Fix Recommendation

Configure Amazon Linux 2023 to use a FIPS 140-2/140-3 compliant systemwide cryptographic policy.

Create subpolicies for enhancements to the systemwide crypto-policy with the following commands:

Create or edit the SCOPES-AND-WILDCARDS policy module in a text editor and insert options that modify the systemwide cryptographic policy as follows:
$ sudo vi /etc/crypto-policies/policies/modules/SCOPES-AND-WILDCARDS.pmod

Add the following lines to the policy:
# Disable CHACHA20-POLY1305 for the TLS protocol (OpenSSL, GnuTLS, NSS, and OpenJDK)
cipher@TLS = -CHACHA20-POLY1305

# Disable all CBC mode ciphers for the SSH protocol (libssh and OpenSSH)
cipher@SSH = -*-CBC

Create or edit the OPENSSH-SUBPOLICY module in a text editor and insert options that modify the systemwide crypto-policy as follows:
$ sudo vi /etc/crypto-policies/policies/modules/OPENSSH-SUBPOLICY.pmod

Add the following lines to the policy:
# Define ciphers for OpenSSH
cipher@SSH=AES-256-GCM AES-128-GCM AES-256-CTR AES-128-CTR

# Define MACs for OpenSSH
mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256

Create or edit the REQUIRE.pmod file and add the following lines to include the subpolicies in the FIPS configuration with the following command:

$ sudo vi /etc/crypto-policies/policies/modules/REQUIRE.pmod

Add the following lines to REQUIRE.pmod:
@OPENSSH-SUBPOLICY
@SCOPES-AND-WILDCARDS

Apply the policy enhancements to the FIPS systemwide cryptographic policy level with the following command:

$ sudo update-crypto-policies --set FIPS

Note: If additional subpolicies are being employed, they should be added to the REQUIRE.pmod as well. REQUIRE.pmod is included in the systemwide crypto-policy when it is set.

To make the cryptographic settings effective for already running services and applications, restart the system:
$ sudo reboot

Check Contents

Verify Amazon Linux 2023 is set to use a FIPS 140-2/140-3 compliant systemwide cryptographic policy.

$ update-crypto-policies --show
FIPS

If the systemwide crypto policy is not set to "FIPS", this is a finding.

Inspect the contents of the REQUIRE.pmod file (if it exists) to verify only authorized modifications to the current policy are included with the following command:

$ cat /etc/crypto-policies/policies/modules/REQUIRE.pmod

Note: If subpolicies have been configured, they could be listed in a colon-separated list starting with FIPS as follows FIPS:<SUBPOLICY-NAME>:<SUBPOLICY-NAME>. This is not a finding.

If the AD-SUPPORT subpolicy module is included (e.g., "FIPS:AD-SUPPORT"), and Active Directory support is not documented as an operational requirement with the information system security officer (ISSO), this is a finding.

If the NO-ENFORCE-EMS subpolicy module is included (e.g., "FIPS:NO-ENFORCE-EMS"), and not enforcing EMS is not documented as an operational requirement with the ISSO, this is a finding.

Verify the current minimum crypto-policy configuration with the following commands:

$ grep -E 'rsa_size|hash' /etc/crypto-policies/state/CURRENT.pol
hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256
min_rsa_size = 2048

If the "hash" values do not include at least the following FIPS 140-2/140-3 compliant algorithms "SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256", this is a finding.

If there are algorithms that include "SHA1" or a hash value less than "256" this is a finding.

If the "min_rsa_size" is not set to a value of at least 2048, this is a finding.

If these commands do not return any output, this is a finding.

Vulnerability Number

V-283452

Documentable

False

Rule Version

AZLX-23-001270

Severity Override Guidance

Check Content Reference

Target Key

5700