The SSH client must use a FIPS 140-2 validated cryptographic module (operating in FIPS mode).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-23827	GEN005495	SV-45995r1_rule	DCNR-1	Medium

Description
Cryptographic modules used by the system must be validated by the NIST CVMP as compliant with FIPS 140-2. Cryptography performed by modules not validated is viewed by NIST as providing no protection for the data.

STIG	Date
SUSE Linux Enterprise Server v11 for System z	2013-04-26

Details

Check Text ( C-43278r1_chk )
Determine if the SSH client uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy. Procedure: # cat /proc/sys/crypto/fips_enabled A value of “1” indicates that FIPS mode is enabled. # grep " Cipher" /etc/ssh/ssh_config The "Cipher" entry should indicate"3des" which is the default. If the Cipher entry has not been commented out and it does not contain "3des" it is a finding. The "Ciphers" entry should only support "aes128-ctr","aes192-ctr" and "aes256-ctr". The default is not acceptable because "blowfish", "arcfour" and "cast128" are not FIPS-140-2 compliant. The default also includes CBC ciphers which are not permitted by GEN005506, this is a finding. NOTE: “FIPS MODE” operation has been included with OpenSSL version 0.9.8j for SLES 11 SP1 and SP2. As of May, 2012 OpenSSL/SUSE Linux is on the CMVP ‘Modules in Process’ list. However, OpenSSH(v5.1p1) does not work with OpenSSL in FIPS mode. This will be an open finding until the validation is complete and OpenSSH works with OpenSSL in FIPS mode.

Check Text ( C-43278r1_chk )

Determine if the SSH client uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy.

Procedure:
# cat /proc/sys/crypto/fips_enabled
A value of “1” indicates that FIPS mode is enabled.

# grep " Cipher" /etc/ssh/ssh_config
The "Cipher" entry should indicate"3des" which is the default. If the Cipher entry has not been commented out and it does not contain "3des" it is a finding.

The "Ciphers" entry should only support "aes128-ctr","aes192-ctr" and "aes256-ctr". The default is not acceptable because "blowfish", "arcfour" and "cast128" are not FIPS-140-2 compliant. The default also includes CBC ciphers which are not permitted by GEN005506, this is a finding.

NOTE: “FIPS MODE” operation has been included with OpenSSL version 0.9.8j for SLES 11 SP1 and SP2. As of May, 2012 OpenSSL/SUSE Linux is on the CMVP ‘Modules in Process’ list. However, OpenSSH(v5.1p1) does not work with OpenSSL in FIPS mode. This will be an open finding until the validation is complete and OpenSSH works with OpenSSL in FIPS mode.

Fix Text (F-39361r1_fix)
Configure the SSH client to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode). Add “fips=1” as a kernel parameter when the system is booted. Kernel parameters may be specified in the /etc/zipl.conf file as a “parameters” string for a kernel stanza, in a “parmfile” referenced within a kernel stanza, or directly on the z/VM guest IPL command. Additional step(s) required to determine if the SSH client is operating in FIPS mode when that support is available

Fix Text (F-39361r1_fix)

Configure the SSH client to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode).

Add “fips=1” as a kernel parameter when the system is booted. Kernel parameters may be specified in the /etc/zipl.conf file as a “parameters” string for a kernel stanza, in a “parmfile” referenced within a kernel stanza, or directly on the z/VM guest IPL command.

Additional step(s) required to determine if the SSH client is operating in FIPS mode when that support is available