Title

NGINX must be configured to use a FIPS-validated cryptographic module for confidentiality and integrity. (Cat II impact)

Discussion

FIPS 140-2/140-3 precludes using invalidated cryptography for the cryptographic protection of sensitive or valuable data within federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2/140-3 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2/140-3 standard. The cryptographic module used must have at least one validated digital signature function. This validated hash algorithm must be used to generate digital signatures for all cryptographic security function within the product being evaluated. Satisfies: SRG-APP-000630, SRG-APP-000635

Check Content

Verify NGINX is using OpenSSL with FIPS enabled. For version 1.x: # nginx -V nginx version: nginx/1.15.2 (nginx-plus-r16) built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017" If the response does not include "fips" in the OpenSSL version, this is a finding. For version 3.x: # openssl list -providers Providers: base name: OpenSSL Base Provider version: 3.2.2 status: active default name: OpenSSL Default Provider version: 3.2.2 status: active fips name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider version: 3.2.2-622cc79c634cbbef status: active If the response does not list a FIPS provider with a status of "active", this is a finding.

Fix Text

FIPS must be enabled on the operating system. Follow the OS guidelines for installing FIPS mode. After installation, confirm that FIPS is enabled: # sudo sysctl –a | grep fips crypto.fips_enabled = 1 Install the FIPS-validated version of OpenSSL to the operating system.

Additional Identifiers

Rule ID: SV-278407r1172754_rule

Vulnerability ID: V-278407

Group Title: SRG-APP-000630

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.