The SSH daemon must use a FIPS 140-2 validated cryptographic module (operating in FIPS mode).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-23826	GEN005490	SV-45994r1_rule	DCNR-1	Medium

Description
Cryptographic modules used by the system must be validated by the NIST CVMP as compliant with FIPS 140-2. Cryptography performed by modules not validated is viewed by NIST as providing no protection for the data.

STIG	Date
SUSE Linux Enterprise Server v11 for System z	2013-04-26

Details

Check Text ( C-43277r1_chk )
Determine if the SSH daemon uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy. Procedure: # cat /proc/sys/crypto/fips_enabled A value of “1” indicates that FIPS mode is enabled. NOTE: “FIPS MODE” operation has been included with OpenSSL version 0.9.8j for SLES 11 SP1 and SP2. As of May, 2012 OpenSSL/SUSE Linux is on the CMVP ‘Modules in Process’ list. However, OpenSSH(v5.1p1) does not work with OpenSSL in FIPS mode. This will be an open finding until the validation is complete and OpenSSH works with OpenSSL in FIPS mode.

Check Text ( C-43277r1_chk )

Determine if the SSH daemon uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy.

Procedure:
# cat /proc/sys/crypto/fips_enabled
A value of “1” indicates that FIPS mode is enabled.

NOTE: “FIPS MODE” operation has been included with OpenSSL version 0.9.8j for SLES 11 SP1 and SP2. As of May, 2012 OpenSSL/SUSE Linux is on the CMVP ‘Modules in Process’ list. However, OpenSSH(v5.1p1) does not work with OpenSSL in FIPS mode. This will be an open finding until the validation is complete and OpenSSH works with OpenSSL in FIPS mode.

Fix Text (F-39360r1_fix)
Configure the SSH daemon to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode). Add “fips=1” as a kernel parameter when the system is booted. Kernel parameters may be specified in the /etc/zipl.conf file as a “parameters” string for a kernel stanza, in a “parmfile” referenced within a kernel stanza, or directly on the z/VM guest IPL command. Additional step(s) required to determine if sshd is operating in FIPS mode when that support is available.

Fix Text (F-39360r1_fix)

Configure the SSH daemon to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode).

Add “fips=1” as a kernel parameter when the system is booted. Kernel parameters may be specified in the /etc/zipl.conf file as a “parameters” string for a kernel stanza, in a “parmfile” referenced within a kernel stanza, or directly on the z/VM guest IPL command.

Additional step(s) required to determine if sshd is operating in FIPS mode when that support is available.