Chapter 2. Using system-wide cryptographic policies

Procedure

1. Optional: Display the current cryptographic policy:

   $ update-crypto-policies --show
   DEFAULT

   Copy to Clipboard Toggle word wrap

2. Set the new cryptographic policy:

   # update-crypto-policies --set <POLICY>
   <POLICY>

   Copy to Clipboard Toggle word wrap

   Replace <POLICY> with the policy or subpolicy you want to set, for example, FUTURE, LEGACY, or FIPS:OSPP.

3. Restart the system:

   # reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. To switch the system-wide cryptographic policy to LEGACY, enter:

   # update-crypto-policies --set LEGACY
   Setting system policy to LEGACY

   Copy to Clipboard Toggle word wrap

   For the list of available cryptographic policies, see the update-crypto-policies(8) man page on your system.

2. To make your cryptographic settings effective for already running services and applications, restart the system:

   $ reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 10 web console.

2. In the Configuration card of the Overview page, click your current policy value next to Crypto policy.

   

3. In the Change crypto policy dialog window, click on the policy you want to start using on your system.
4. Click the Apply and reboot button.

Procedure

1. Checkout to the /etc/crypto-policies/policies/modules/ directory:

   # cd /etc/crypto-policies/policies/modules/

   Copy to Clipboard Toggle word wrap

2. Create subpolicies for your adjustments, for example:

   # touch <MYCRYPTO-1>.pmod
   # touch <SCOPES-AND-WILDCARDS>.pmod

   Copy to Clipboard Toggle word wrap
   Important

   Use upper-case letters in file names of policy modules.

3. Open the policy modules in a text editor of your choice and insert options that modify the system-wide cryptographic policy, for example:

   # vi <MYCRYPTO-1>.pmod

   Copy to Clipboard Toggle word wrap

   min_rsa_size = 3072
   hash = SHA2-384 SHA2-512 SHA3-384 SHA3-512

   Copy to Clipboard Toggle word wrap

   # vi <SCOPES-AND-WILDCARDS>.pmod

   Copy to Clipboard Toggle word wrap

   # Disable the AES-128 cipher, all modes
   cipher = -AES-128-*
   
   # Disable CHACHA20-POLY1305 for the TLS protocol (OpenSSL, GnuTLS, NSS, and OpenJDK)
   cipher@TLS = -CHACHA20-POLY1305
   
   # Allow using the FFDHE-1024 group with the SSH protocol (libssh and OpenSSH)
   group@SSH = FFDHE-1024+
   
   # Disable all CBC mode ciphers for the SSH protocol (libssh and OpenSSH)
   cipher@SSH = -*-CBC
   
   # Allow the AES-256-CBC cipher in applications using libssh
   cipher@libssh = AES-256-CBC+

   Copy to Clipboard Toggle word wrap
4. Save the changes in the module files.

5. Apply your policy adjustments to the DEFAULT system-wide cryptographic policy level:

   # update-crypto-policies --set DEFAULT:<MYCRYPTO-1>:<SCOPES-AND-WILDCARDS>

   Copy to Clipboard Toggle word wrap

6. To make your cryptographic settings effective for already running services and applications, restart the system:

   # reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a policy file for your customizations:

   # cd /etc/crypto-policies/policies/
   # touch <MYPOLICY>.pol

   Copy to Clipboard Toggle word wrap

   Alternatively, start by copying one of the four predefined policy levels:

   # cp /usr/share/crypto-policies/policies/DEFAULT.pol /etc/crypto-policies/policies/<MYPOLICY>.pol

   Copy to Clipboard Toggle word wrap

2. Edit the file with your custom cryptographic policy in a text editor of your choice to fit your requirements, for example:

   # vi /etc/crypto-policies/policies/<MYPOLICY>.pol

   Copy to Clipboard Toggle word wrap

   See the Custom Policies section in the update-crypto-policies(8) man page and the Crypto Policy Definition Format section in the crypto-policies(7) man page on your system for the complete syntax reference.

3. Switch the system-wide cryptographic policy to your custom level:

   # update-crypto-policies --set <MYPOLICY>

   Copy to Clipboard Toggle word wrap

4. To make your cryptographic settings effective for already running services and applications, restart the system:

   # reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Install the crypto-policies-pq-preview package:

   # dnf install -y crypto-policies-pq-preview

   Copy to Clipboard Toggle word wrap

2. Enable the TEST-PQ cryptographic subpolicy on top of your current system-wide policy, for example:

   # update-crypto-policies --show
   DEFAULT
   # update-crypto-policies --set DEFAULT:TEST-PQ

   Copy to Clipboard Toggle word wrap

3. To make your cryptographic settings effective for already running services and applications, restart the system:

   # reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure cryptographic policies
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure the FUTURE cryptographic security policy on the managed node
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.crypto_policies
         vars:
           - crypto_policies_policy: FUTURE
           - crypto_policies_reboot_ok: true

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   crypto_policies_policy: FUTURE

   Configures the required cryptographic policy (FUTURE) on the managed node. It can be either the base policy or a base policy with some subpolicies. The specified base policy and subpolicies have to be available on the managed node. The default value is null, which means that the configuration is not changed and the crypto_policies RHEL system role only collects the Ansible facts.

   crypto_policies_reboot_ok: true

   Causes the system to reboot after the cryptographic policy change to make sure all of the services and applications will read the new configuration files. The default value is false.

   For details about the role variables and the cryptographic configuration options, see the /usr/share/ansible/roles/rhel-system-roles.crypto_policies/README.md file and the update-crypto-policies(8) and crypto-policies(7) manual pages on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Verification

1. On the control node, create another playbook named, for example, verify_playbook.yml:

   ---
   - name: Verification
     hosts: managed-node-01.example.com
     tasks:
       - name: Verify active cryptographic policy
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.crypto_policies
       - name: Display the currently active cryptographic policy
         ansible.builtin.debug:
           var: crypto_policies_active

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   crypto_policies_active

   An exported Ansible fact that contains the currently active policy name in the format as accepted by the crypto_policies_policy variable.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/verify_playbook.yml

   Copy to Clipboard Toggle word wrap

3. Run the playbook:

   $ ansible-playbook ~/verify_playbook.yml
   TASK [debug] **************************
   ok: [host] => {
       "crypto_policies_active": "FUTURE"
   }

   Copy to Clipboard Toggle word wrap

   The crypto_policies_active variable shows the active policy on the managed node.