securing oracle linux 9 part 7 configuring system wide crypto policy

سیستم عامل و زیرساخت Hits: 3

In the previous part

Securing Oracle Linux 9 (Part 6): Process Hardening and Core Dump Management

was completed.

1. CIS Benchmark Requirements (Section 1.6)

This article covers the following CIS controls related to System-wide Crypto Policy:

  • 1.6.1 Ensure system-wide crypto policy is not set to LEGACY (Automated)
  • 1.6.2 Ensure system-wide crypto policy is configured correctly (Automated)
  • 1.6.3 Ensure no weak hash algorithms are allowed (Automated)
  • 1.6.4 Ensure SSH uses secure cipher suites (Automated)
  • 1.6.5 Ensure SSH uses secure MAC algorithms (Automated)
  • 1.6.6 Ensure SSH uses secure key exchange algorithms (Automated)
  • 1.6.7 Ensure SSH uses secure host and public key algorithms (Automated)

2. Concept and Rationale

In Oracle Linux 9, the system-wide crypto policy provides a centralized mechanism for controlling cryptographic algorithms and settings across the entire operating system. Instead of configuring cryptographic parameters separately for each service, the system relies on a single policy framework, which improves consistency and security.

The CIS objective in this section is to eliminate weak algorithms such as SHA1 and prevent the use of hardcoded cryptographic settings in SSH. This ensures that SSH follows the system-wide crypto policy rather than being overridden by insecure local configuration.

From a security perspective, this approach provides several benefits:

  • Prevents accidental use of weak algorithms
  • Centralizes cryptographic control at the system level
  • Reduces human error in `sshd_config`
  • Improves compliance with CIS auditing requirements

3. Compatibility with Oracle Database and RAC

Changing the system-wide crypto policy in Oracle Linux 9 is generally transparent to Oracle Database and Oracle RAC and does not typically disrupt database operation. The change mainly affects services such as SSH, and it becomes especially important when cryptographic settings are hardcoded in `sshd_config` or related drop-in files.

In Oracle environments, removing hardcoded SSH settings means that `sshd` will use the secure system-wide policy instead of being overridden by local configuration. This is important for remote DBA access because it preserves both security and usability.

This article uses the following policy:

DEFAULT:NO-SHA1:CIS-SSH

And if FIPS mode is in use, the following value is also acceptable:

FIPS:NO-SHA1:CIS-SSH

4. Checking the Current Status (Audit Script)

This script checks the system crypto policy and verifies that no hardcoded SSH cryptographic settings are present:

GitHub link:

modules/audit_07_System_Crypto_Policy.sh

#!/bin/bash
# Script: audit_cis_1_6.sh
# Purpose: Audit System-wide Crypto Policy (CIS 1.6)

echo "==========================================================================" 
echo " CIS Requirement: 1.6 System-wide Crypto Policy"
echo " - Ensure system-wide crypto policy is set correctly (NO-SHA1, CIS-SSH)."
echo " - Ensure no hardcoded crypto settings exist in sshd_config."
echo " Oracle Context:"
echo " 1. Updating the system crypto policy is generally transparent to"
echo "    Oracle Database and RAC installations."
echo " 2. Removing hardcoded SSH ciphers ensures SSHD uses the system-wide"
echo "    secure policy without disrupting DBA remote access."
echo "=========================================================================="

FAIL_COUNT=0

echo -e "\n[*] 1. Checking System Crypto Policy..."
CURRENT_POLICY=$(update-crypto-policies --show 2>/dev/null)
if [[ "$CURRENT_POLICY" == *"DEFAULT:NO-SHA1:CIS-SSH"* || "$CURRENT_POLICY" == *"FIPS:NO-SHA1:CIS-SSH"* ]]; then
    echo -e "  \e[32m[PASS]\e[0m System Crypto Policy is $CURRENT_POLICY."
else
    echo -e "  \e[31m[FAIL]\e[0m Crypto Policy is $CURRENT_POLICY (Expected: DEFAULT:NO-SHA1:CIS-SSH)."
    FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] 2. Checking sshd_config for hardcoded crypto settings..."
HARDCODED=$(grep -h -E -i '^\s*(Ciphers|MACs|KexAlgorithms|GSSAPIKexAlgorithms|HostKeyAlgorithms|PubkeyAcceptedKeyTypes)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null)

if [ -z "$HARDCODED" ]; then
    echo -e "  \e[32m[PASS]\e[0m No hardcoded crypto settings found in SSH config."
else
    echo -e "  \e[31m[FAIL]\e[0m Hardcoded crypto settings found:"
    echo "$HARDCODED"
    FAIL_COUNT=$((FAIL_COUNT + 1))
fi

if [ "$FAIL_COUNT" -eq 0 ]; then
    echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
    echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

The logic of this script is straightforward: first, it reads the active system policy using `update-crypto-policies --show`. If the value matches `DEFAULT:NO-SHA1:CIS-SSH` or `FIPS:NO-SHA1:CIS-SSH`, the policy check passes. Then it scans the SSH configuration files to confirm that no hardcoded directives such as `Ciphers` or `MACs` remain.

5. Applying the Configuration (Remediation Script)

This script disables insecure SSH settings, creates a custom crypto policy module, and then applies the policy:

GitHub link:

modules/remediate_07_System_Crypto_Policy.sh

#!/bin/bash
# Script: remediate_cis_1_6.sh
# Purpose: Configure System-wide Crypto Policy based on CIS (CIS 1.6)
# Context: Oracle Linux 9 (Database/RAC compatible)

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

echo -e "\n[+] Applying System-wide Crypto Policy (CIS 1.6)..."

# 1. Remove hardcoded crypto settings from SSH configs (CIS 1.6.2)
echo "[*] Cleaning up hardcoded crypto settings from sshd_config..."
sed -ri 's/^\s*(Ciphers|MACs|KexAlgorithms|GSSAPIKexAlgorithms|HostKeyAlgorithms|PubkeyAcceptedKeyTypes)/# \1/' /etc/ssh/sshd_config
if ls /etc/ssh/sshd_config.d/*.conf 1> /dev/null 2>&1; then
    sed -ri 's/^\s*(Ciphers|MACs|KexAlgorithms|GSSAPIKexAlgorithms|HostKeyAlgorithms|PubkeyAcceptedKeyTypes)/# \1/' /etc/ssh/sshd_config.d/*.conf
fi

# 2. Create custom policy module for SSH restrictions (CIS 1.6.4 to 1.6.7)
echo "[*] Creating custom module /etc/crypto-policies/policies/modules/CIS-SSH.pmod..."
cat < /etc/crypto-policies/policies/modules/CIS-SSH.pmod
# Disable CBC and ChaCha20-Poly1305 for SSH
cipher@ssh = -*CBC -CHACHA20-POLY1305

# Disable MACs less than 128 bits
mac@ssh = -*MD5* -*UMAC-64*
EOF

# 3. Apply the Crypto Policy (CIS 1.6.1, 1.6.3)
echo "[*] Applying DEFAULT:NO-SHA1:CIS-SSH policy..."
update-crypto-policies --set DEFAULT:NO-SHA1:CIS-SSH

# 4. Restart SSHD to apply changes
echo "[*] Restarting SSHD service..."
systemctl restart sshd

echo -e "\n[+] Crypto policy updated and SSHD restarted successfully."

This remediation script performs four main tasks: it comments out hardcoded settings from `sshd_config` and its drop-in files, creates a policy module named `CIS-SSH.pmod`, applies the system-wide policy `DEFAULT:NO-SHA1:CIS-SSH`, and finally restarts the `sshd` service.

The custom policy module contains the following settings:

# Disable CBC and ChaCha20-Poly1305 for SSH
cipher@ssh = -*CBC -CHACHA20-POLY1305

# Disable MACs less than 128 bits
mac@ssh = -*MD5* -*UMAC-64*

6. Conclusion

In this section, the Oracle Linux 9 system-wide crypto policy was reviewed and remediated according to CIS 1.6. The result is the removal of weak algorithms, the elimination of hardcoded SSH settings, and the use of a centralized and secure policy across the system.

From an Oracle perspective, this change is compatible with Database and RAC environments while preserving secure administrative access. Therefore, this control is recommended both for compliance and for operational security on Oracle servers.

In the next part

Configuring Login Warning Banners for Command Line Access

will be covered.