{"description": "System running in FIPS mode is indicated by kernel parameter\n<tt>'crypto.fips_enabled'</tt>. This parameter should be set to <tt>1</tt> in FIPS mode.\n\nTo enable FIPS mode, run the following command:\n<pre>fips-mode-setup --enable</pre>\n\n\n\nTo enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel boot\nparameters during system installation so key generation is done with FIPS-approved algorithms\nand continuous monitoring tests in place.", "rationale": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to\nprotect data. The operating system must implement cryptographic modules adhering to the higher\nstandards approved by the federal government since this provides assurance they have been tested\nand validated.", "severity": "high", "references": {"nerc-cip": ["CIP-003-8 R4.2", "CIP-007-3 R5.1"], "nist": ["SC-12(2)", "SC-12(3)", "IA-7", "SC-13", "CM-6(a)", "SC-12"], "srg": ["SRG-OS-000033-GPOS-00014", "SRG-OS-000125-GPOS-00065", "SRG-OS-000250-GPOS-00093", "SRG-OS-000393-GPOS-00173", "SRG-OS-000394-GPOS-00174", "SRG-OS-000396-GPOS-00176", "SRG-OS-000423-GPOS-00187", "SRG-OS-000478-GPOS-00223"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "crypto.fips_enabled is not 1", "ocil": "To verify that kernel parameter 'crypto.fips_enabled' is set properly, run the following command:\n<pre>sysctl crypto.fips_enabled</pre>\nThe output should contain the following:\n<pre>crypto.fips_enabled = 1</pre>", "oval_external_content": null, "fixtext": "Configure the operating system to implement FIPS mode with the following command:\n\n$ sudo fips-mode-setup --enable\n\nReboot the system for the changes to take effect.", "checktext": "Verify that Ubuntu 22.04 is in FIPS mode with the following command:\n$ sudo fips-mode-setup --check\nFIPS mode is enabled.\nIf FIPS mode is not enabled, this is a finding.", "vuldiscussion": "", "srg_requirement": "Ubuntu 22.04 must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.", "warnings": [{"general": "The system needs to be rebooted for these changes to take effect."}, {"regulatory": "System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications.\nFIPS-140 is applicable to all Federal agencies that use cryptographic-based security\nsystems to protect sensitive information in computer and telecommunication systems\n(including voice systems) as defined in Section 5131 of the Information Technology\nManagement Reform Act of 1996, Public Law 104-106. This standard shall be used in designing\nand implementing cryptographic modules that Federal departments and agencies operate or are\noperated for them under contract.\nSee <b>\n<a xmlns='http://www.w3.org/1999/xhtml' href='https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf'>https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</a></b>\nTo meet this, the system has to have cryptographic software provided by a vendor that has\nundergone this certification. This means providing documentation, test results, design\ninformation, and independent third party review by an accredited lab. While open source\nsoftware is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to\nthis process."}], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 must implement NIST FIPS-validated cryptography for the following: to\nprovision digital signatures, to generate cryptographic hashes, and to\nprotect data requiring data-at-rest protections in accordance with\napplicable federal laws, Executive Orders, directives, policies,\nregulations, and standards.", "vuldiscussion": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to\nprotect data. The operating system must implement cryptographic modules adhering to the higher\nstandards approved by the federal government since this provides assurance they have been tested\nand validated.", "checktext": "Verify that Ubuntu 22.04 is in FIPS mode with the following command:\n\n$ sudo fips-mode-setup --check\n\nFIPS mode is enabled.\n\nIf FIPS mode is not enabled, this is a finding.", "fixtext": "Configure the operating system to implement FIPS mode with the following command\n\n$ sudo fips-mode-setup --enable\n\nReboot the system for the changes to take effect."}}, "platform": "system_with_kernel and not osbuild", "platforms": ["system_with_kernel and not osbuild"], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": ["not_osbuild_and_system_with_kernel"], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Set kernel parameter 'crypto.fips_enabled' to 1", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/software/integrity/fips/sysctl_crypto_fips_enabled/rule.yml", "template": null}