The system must use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-23825	GEN000588	SV-44863r1_rule	DCNR-1	Medium

Description
Cryptographic modules used by the system must be validated by the NIST CMVP as compliant with FIPS 140-2. Cryptography performed by modules not validated is viewed by NIST as providing no protection for the data.

STIG	Date
SUSE Linux Enterprise Server v11 for System z	2012-12-13

Details

Check Text ( C-42325r2_chk )
Determine if the system uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes. The NIST CMVP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy. If the system does not use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes, this is a finding. “FIPS MODE” operation has been included with OpenSSL version 0.9.8j for SLES 11 SP1 and SP2. As of April, 2012 OpenSSL/SUSE Linux is on the NIST CMVP ‘Modules in Process’ list. This will be an open finding until the validation is complete. Procedure: # cat /proc/sys/crypto/fips_enabled A value of “1” indicates that FIPS mode is enabled.

Check Text ( C-42325r2_chk )

Determine if the system uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes. The NIST CMVP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy.

If the system does not use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes, this is a finding.
“FIPS MODE” operation has been included with OpenSSL version 0.9.8j for SLES 11 SP1 and SP2. As of April, 2012 OpenSSL/SUSE Linux is on the NIST CMVP ‘Modules in Process’ list. This will be an open finding until the validation is complete.
Procedure:
# cat /proc/sys/crypto/fips_enabled
A value of “1” indicates that FIPS mode is enabled.

Fix Text (F-38296r1_fix)
Configure the system to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes. Add “fips=1” as a kernel parameter when the system is booted. Kernel parameters may be specified in the /etc/zipl.conf file as a “parameters” string for a kernel stanza, in a “parmfile” referenced within a kernel stanza, or directly on the z/VM guest IPL command.

Fix Text (F-38296r1_fix)

Configure the system to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes.
Add “fips=1” as a kernel parameter when the system is booted. Kernel parameters may be specified in the /etc/zipl.conf file as a “parameters” string for a kernel stanza, in a “parmfile” referenced within a kernel stanza, or directly on the z/VM guest IPL command.