Fix crypto policy settings in RHEL 8 CIS

Add a new rule `crypto_sub_policies_cis_rhel8` that configures multiple
custom crypto sub policy modules for RHEL 8 CIS. The new rule is very
similar to `fips_custom_stig_sub_policy`. It configures new modules for
system wide crypto policies that reduces the set of usable ciphers in
sshd, MACs, and others.

The rule is templated by a new template `crypto_sub_policies` that is
also introduced in this commit so that the code can be reused in other
similar rules.

This change aligns the RHEL 8 CIS profiles in CaC with the CIS RHEL 8
Benchmark v4.0.0 requirements. All crypto requirements of this profile
are now covered by this single rule. The reason for merging all of the
sub module configuration is to prevent overriding crypto policy
settings. If there would be multiple rules, each of them would call
the `update-crypto-policies` commands with a different sub policy,
overriding each other.

This supersedes ComplianceAsCode#14050

Resolves: https://issues.redhat.com/browse/RHEL-111896

Author: jan-cerny

components/crypto-policies.yml

@@ -12,6 +12,7 @@ rules:
 - configure_openssl_crypto_policy
 - configure_openssl_tls_crypto_policy
 - configure_ssh_crypto_policy
+- crypto_sub_policies_cis_rhel8
 - harden_openssl_crypto_policy
 - harden_ssh_client_crypto_policy
 - harden_sshd_ciphers_openssh_conf_crypto_policy

components/openssh.yml

@@ -9,6 +9,7 @@ packages:
 - openssh-clients
 - openssh-server
 rules:
+- crypto_sub_policies_cis_rhel8
 - directory_groupowner_sshd_config_d
 - directory_owner_sshd_config_d
 - directory_permissions_sshd_config_d

controls/cis_rhel8.yml

@@ -537,8 +537,7 @@ controls:
           - l1_workstation
       status: automated
       rules:
-          - configure_crypto_policy
-          - var_system_crypto_policy=default_nosha1
+          - crypto_sub_policies_cis_rhel8
 
     - id: 1.6.2
       title: Ensure system wide crypto policy disables sha1 hash and signature support (Automated)
@@ -549,31 +548,25 @@ controls:
       notes: |-
           This requirement is already satisfied by 1.6.1.
       related_rules:
-          - configure_crypto_policy
+          - crypto_sub_policies_cis_rhel8
 
     - id: 1.6.3
       title: Ensure system wide crypto policy disables cbc for ssh (Automated)
       levels:
           - l1_server
           - l1_workstation
-      status: pending
-      notes: |-
-          It is necessary a new rule to ensure a module disabling CBC in
-          /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command.
-      related_rules:
-          - configure_crypto_policy
+      status: automated
+      rules:
+          - crypto_sub_policies_cis_rhel8
 
     - id: 1.6.4
       title: Ensure system wide crypto policy disables macs less than 128 bits (Automated)
       levels:
           - l1_server
           - l1_workstation
-      status: pending
-      notes: |-
-          It is necessary a new rule to ensure a module disabling weak MACs in
-          /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command.
-      related_rules:
-          - configure_crypto_policy
+      status: automated
+      rules:
+          - crypto_sub_policies_cis_rhel8
 
     - id: 1.7.1
       title: Ensure message of the day is configured properly (Automated)
@@ -1504,8 +1497,7 @@ controls:
       notes: |-
           Introduced in CIS RHEL8 v3.0.0
       rules:
-          - sshd_use_approved_ciphers
-          - sshd_approved_ciphers=cis_rhel8
+          - crypto_sub_policies_cis_rhel8
 
     - id: 4.2.7
       title: Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured (Automated)
@@ -1594,8 +1586,7 @@ controls:
           - l1_workstation
       status: automated
       rules:
-          - sshd_use_strong_macs
-          - sshd_strong_macs=cis_rhel8
+          - crypto_sub_policies_cis_rhel8
 
     - id: 4.2.15
       title: Ensure sshd MaxAuthTries is configured (Automated)

docs/templates/template_reference.md

@@ -253,6 +253,27 @@
 
 -   Languages: OVAL, Kubernetes
 
+#### crypto_sub_policies
+-   Configures a sub policy for system wide crypto policies. Creates a module
+    file `module_name.pmod` in `/etc/crypto-policies/policies/modules/` that
+    contains `key = value`. Then, it applies this module. The template allows
+    to specify multiple crypto policy sub modules at once, which is convenient
+    for use in benchmarks that require multiple custom crypto settings.
+
+-   Parameters:
+
+    -   **base_policy** - The base system wide crypto policy, eg. `DEFAULT`
+
+    -   **sub_policies** - A list of dictionaries. Each dictionary represents one custom crypto sub policy module. The dictionary has the following members:
+
+        -   **module_name** - crypto sub policy name, eg. `NO-SSHWEAKCIPHERS`
+
+        -   **key** - entry key, eg. `cipher@SSH`
+
+        -   **value** - entry value, eg. `-3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305`
+
+-   Languages: Ansible, Bash, OVAL
+
 #### dconf_ini_file
 -   Checks for `dconf` configuration. Additionally checks if the
     configuration is locked so it cannot be overridden by the user.

linux_os/guide/system/software/integrity/crypto/crypto_sub_policies_cis_rhel8/rule.yml

@@ -0,0 +1,67 @@
+documentation_complete: true
+
+title: Implement Custom Crypto Policy Modules for CIS Benchmark for Red Hat Enterprise Linux 8
+
+{{% set sub_policies = [
+    {
+        "module_name": "NO-SSHCBC",
+        "key": "cipher@SSH",
+        "value": "-*-CBC"
+    },
+    {
+        "module_name": "NO-SSHWEAKCIPHERS",
+        "key": "cipher@SSH",
+        "value": "-3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305"
+    },
+    {
+        "module_name": "NO-SSHWEAKMACS",
+        "key": "mac@SSH",
+        "value": "-HMAC-MD5* -UMAC-64* -UMAC-128*"
+    },
+    {
+        "module_name": "NO-WEAKMAC",
+        "key": "mac",
+        "value": "-*-128*"
+    },
+] %}}
+
+description: |-
+    Create a custom crypto policy module to enforce the use of strong ciphers and MACs in SSHD, disable CBC mode ciphers in SSHD and disable the use of weak MACs globally.
+    {{% for sub_policy in sub_policies %}}
+    {{{ describe_crypto_sub_policy(sub_policy.module_name, sub_policy.key, sub_policy.value) }}}
+    {{% endfor %}}
+    Then, set the system wide crypto policy to use the custom policy.
+    <pre>
+    $ sudo update-crypto-policies --set DEFAULT:NO-SHA1:NO-SSHCBC:NO-SSHWEAKCIPHERS:NO-SSHWEAKMACS:NO-WEAKMAC
+    </pre>
+
+rationale: |-
+    CBC mode ciphers are vulnerable to certain attacks, such as the BEAST attack.
+    Disabling CBC mode ciphers helps protect against these attacks and ensures that only
+    strong, proven cryptographic algorithms are used to protect SSH communications.
+    Weak ciphers that are used for authentication to the cryptographic module cannot be
+    relied upon to provide confidentiality or integrity, and system data may be compromised.
+    Message Authentication Codes (MACs) are cryptographic mechanisms used to verify the
+    integrity and authenticity of data transmitted over SSH connections. Weak MACs that
+    are used for authentication to the cryptographic module cannot be relied upon to
+    provide integrity, and system data may be compromised. Implementing a custom crypto
+    policy that disables weak MAC algorithms helps ensure that only strong, proven
+    cryptographic algorithms are used to protect SSH communications.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-86707-7
+
+ocil_clause: 'the custom crypto policy modules do not exist'
+
+ocil: |-
+    {{% for sub_policy in sub_policies %}}
+    {{{ ocil_crypto_sub_policy(sub_policy.module_name, sub_policy.key, sub_policy.value) }}}
+    {{% endfor %}}
+
+template:
+    name: crypto_sub_policies
+    vars:
+        base_policy: "DEFAULT:NO-SHA1"
+        sub_policies: {{{ sub_policies }}}

products/rhel8/profiles/default.profile

@@ -726,3 +726,4 @@ selections:
     - service_rlogin_disabled
     - service_zebra_disabled
     - package_rsh-server_removed
+    - sshd_use_strong_macs

shared/macros/01-general.jinja

@@ -1446,3 +1446,20 @@ Create a rule description for rules using the `audit_rules_kernel_module_loading
     If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt> utility,
     add the line to file <tt>/etc/audit/audit.rules</tt>.
 {{% endmacro %}}
+
+{{#
+Create a description text for rules that use the crypto_sub_policies template.
+
+:param module_name: crypto sub policy name, eg. `NO-SSHWEAKCIPHERS`
+:type module_name: str
+:param key: The entry key, eg. cipher@SSH
+:type key: str
+:param value: The entry value, eg. -3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305
+:type value: str
+#}}
+{{% macro describe_crypto_sub_policy(module_name, key, value) %}}
+    Add the following line to the file <tt>/etc/crypto-policies/policies/modules/{{{ module_name }}}.pmod</tt>:
+    <pre>
+    {{{ key }}} = {{{ value }}}
+    </pre>
+{{%- endmacro %}}

shared/macros/10-ocil.jinja

@@ -1538,3 +1538,20 @@ Create an OCIL text for rules that use the audit_rules_watch platform.
     -w {{{ path }}} -p wa -k {{{ key }}}
 {{% endif %}}
 {{% endmacro %}}
+
+{{#
+Create an OCIL text for rules that use the crypto_sub_policies template.
+
+:param module_name: crypto sub policy name, eg. `NO-SSHWEAKCIPHERS`
+:type module_name: str
+:param key: The entry key, eg. cipher@SSH
+:type key: str
+:param value: The entry value, eg. -3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305
+:type value: str
+#}}
+{{% macro ocil_crypto_sub_policy(module_name, key, value) %}}
+    Verify that <tt>/etc/crypto-policies/policies/modules/{{{ module_name }}}.pmod</tt> exists and has the following content:
+    <pre>
+    {{{ key }}} = {{{ value }}}
+    </pre>
+{{% endmacro %}}

shared/references/cce-redhat-avail.txt

@@ -72,7 +72,6 @@ CCE-86702-8
 CCE-86703-6
 CCE-86704-4
 CCE-86706-9
-CCE-86707-7
 CCE-86708-5
 CCE-86709-3
 CCE-86710-1

shared/templates/crypto_sub_policies/ansible.template

@@ -0,0 +1,28 @@
+# platform = multi_platform_all
+# reboot = true
+# strategy = configure
+# complexity = low
+# disruption = low
+
+{{% for sub_policy in SUB_POLICIES %}}
+-   name: "{{{ rule_title }}} - Create custom crypto policy module {{{ sub_policy.module_name }}}"
+    ansible.builtin.lineinfile:
+        path: /etc/crypto-policies/policies/modules/{{{ sub_policy.module_name }}}.pmod
+        owner: root
+        group: root
+        mode: '0644'
+        line: {{{ sub_policy.key }}} = {{{ sub_policy.value }}}
+        create: true
+        regexp: "{{{ sub_policy.key }}}"
+{{% endfor %}}
+
+-   name: "{{{ rule_title }}} - Check current crypto policy"
+    ansible.builtin.command: update-crypto-policies --show
+    register: current_crypto_policy
+    changed_when: false
+    failed_when: false
+    check_mode: false
+
+-   name: "{{{ rule_title }}} - Update crypto-policies"
+    ansible.builtin.command: update-crypto-policies --set {{{ BASE_POLICY }}}:{{{ CONFIGURE_CRYPTO_POLICY_MODULES }}}
+    when: current_crypto_policy.stdout.strip() != "{{{ BASE_POLICY }}}:{{{ CONFIGURE_CRYPTO_POLICY_MODULES }}}"