Skip to content

v0.4.5 — FIPS-posture scanner

Choose a tag to compare

View all tags
@btdt1983 btdt1983 released this 12 Jul 21:03
v0.4.5
00e7101

FIPS-posture scanner (fips, 9th scanner)

The tool is FIPS-aware — this new scanner audits its own ground: is the host's cryptography actually hardened? It reads /proc/sys/crypto/fips_enabled, /proc/cmdline and the crypto-policies state files (plus fips-mode-setup --check when present) and reports only real gaps:

  • Half-enabled FIPS — kernel in FIPS mode but the system crypto-policy is not (so OpenSSL/GnuTLS/OpenSSH still negotiate non-approved algorithms), or the reverse — important.
  • Inconsistent state per fips-mode-setup --check — important.
  • Weakened crypto-policy — LEGACY, or a SHA-1-restoring sub-policy such as DEFAULT:SHA1 — flagged on any host, FIPS or not.
  • Pending policy change — configured ≠ applied (the crypto analogue of "a patch on disk is not a patch in RAM") — moderate.
  • FIPS required but not enabled — important, only when the config sets fips_required: true.

A consistent non-FIPS host is a legitimate configuration and produces no findings (no false positives). Pure stdlib; in --all, not in the default scanner set.

Also: info now shows the active crypto-policy; new config key fips_required (default false); fixed the stale --scanner help list.

277 tests, bandit clean. Signed el9 + el10 packages are on https://repo.techhack.nl.

Assets 5
Loading