Security

System-wide crypto policy

In the Enterprise IT, the security landscape is constantly evolving. Without robust cryptographic integrity protections, information can be altered by unauthorized users without detection. With Red Hat Enterprise Linux 8.0 the system-wide crypto policy was introduced. This component configures the core cryptographic subsystems, covering TLS, IPSec, DNSSec, Kerberos, and secure communication protocols. This allows to apply a consistent cryptographic policy at scale. The predefined policies are DEFAULT, LEGACY, FUTURE, FIPS. The default system-wide crypto policy is set to DEFAULT by Red Hat. Beside the vendor-specific policies, it is possible to specify customized crypto policies.

More information here: System-wide crypto policies

Swisscom crypto policy for RHEL 8 and RHEL 9

On Swisscom RHEL 8 and Swisscom RHEL 9 VMs, the SWISSCOM customized crypto policy is enabled and enforced with Ansible. You can check the enabled crypto policy by using the update-crypto-policies tool:

$ update-crypto-policies --show
SWISSCOM

Exception for Crypto policies

If you have an approved security exception and you want to customize the SWISSCOM crypto policy this is documented in this howto-article.

Controlling access to crontab command for users

On Managed RHEL the OS hardening blocks users to perform crontab command tasks such as creating, editing, displaying, or removing their own crontab files. To allow this for a specific user the username must be added to the file /etc/cron.allow

$ echo <username> |sudo tee -a /etc/cron.allow