← Back to Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

V-282386

CAT I (High)

TOSS 5 IP tunnels must use FIPS 140-3-approved cryptographic algorithms.

Rule ID

SV-282386r1200138_rule

STIG

Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000068

Discussion

Overriding the system crypto policy makes the behavior of the Libreswan service violate expectations and makes system configuration more fragmented.

Check Content

Verify the IPsec service uses the system crypto policy using the following command:

Note: If the IPsec service is not installed, this requirement is not applicable.

$ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf

/etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config

If the ipsec configuration file does not contain "include /etc/crypto-policies/back-ends/libreswan.config", this is a finding.

Fix Text

Configure Libreswan to use the system cryptographic policy.

Add the following line to "/etc/ipsec.conf":

include /etc/crypto-policies/back-ends/libreswan.config