Ensure FIPS 140-2 OpenSSL Cryptography Is Used

СредњаНиво 1Аутоматскаpostgres

Опис

Install, configure, and use OpenSSL on a platform that has a NIST certified FIPS 140-2 installation of OpenSSL. This provides PostgreSQL instances the ability to generate and validate cryptographic hashes to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owner's requirements. Requires kernel FIPS mode (/proc/sys/crypto/fips_enabled = 1) and an active OpenSSL FIPS provider; the benchmark notes this is natively possible only on RHEL-family systems.

Како се проверава

Метод провере: Команда љуске

shell

f=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null) || exit 1; p=$(openssl list -providers 2>/dev/null) || exit 1; if [ "$f" = 1 ] && printf '%s\n' "$p" | grep -qi fips; then echo compliant; else echo noncompliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Enable FIPS mode on a FIPS-capable OS (RHEL/Rocky: fips-mode-setup --enable, then reboot) so OpenSSL, which PostgreSQL uses, runs with the FIPS provider; confirm with fips-mode-setup --check.

Својства

Оперативни системи: Било који
Ознаке: postgresdatabasecryptofips
Референца: CIS PostgreSQL 18 Benchmark v1.0.0 - 6.7 Ensure FIPS 140-2 OpenSSL Cryptography Is Used

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target postgres