TMA-POSTGRES-6.7

Ensure FIPS 140-2 OpenSSL Cryptography Is Used

보통레벨 1자동postgres

설명

Install, configure, and use OpenSSL on a platform that has a NIST certified FIPS 140-2 installation of OpenSSL. This provides PostgreSQL instances the ability to generate and validate cryptographic hashes to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owner's requirements. Requires kernel FIPS mode (/proc/sys/crypto/fips_enabled = 1) and an active OpenSSL FIPS provider; the benchmark notes this is natively possible only on RHEL-family systems.

점검 방법

감사 방식: 셸 명령

shell

f=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null) || exit 1; p=$(openssl list -providers 2>/dev/null) || exit 1; if [ "$f" = 1 ] && printf '%s\n' "$p" | grep -qi fips; then echo compliant; else echo noncompliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Enable FIPS mode on a FIPS-capable OS (RHEL/Rocky: fips-mode-setup --enable, then reboot) so OpenSSL, which PostgreSQL uses, runs with the FIPS provider; confirm with fips-mode-setup --check.

속성

운영 체제: 모두
태그: postgresdatabasecryptofips
참고 자료: CIS PostgreSQL 18 Benchmark v1.0.0 - 6.7 Ensure FIPS 140-2 OpenSSL Cryptography Is Used

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target postgres