Remove rules that are shadowed by crypto policies rules.

[matejak]

sshd_use_approved_ciphers and sshd_use_approved_macs mandated usage of FIPS-enabled algorithms, I have replaced them with FIPS crypto policy setup rules.

Since introduction of crypto policies, those old rules are completely irrelevant - all modifications to the sshd config is overriden by current crypto policy setup in RHEL8 and Fedora.
Those rules were not present in Fedora profiles.

[scrutinizer-notifier]

The inspection completed: No new issues

[redhatrises]

This PR makes sense to me. @shawndwells agree or foresee any issues?

[shawndwells]

How do we make sure the available ciphers are only those that are FIPS validated, vs the machine being in FIPS mode?

[matejak]

@shawndwells Crypto policies are only about setting algorithms in sshd, TLS, SSL libraries etc. The policy may be set to safe defaults, strong settings, legacy settings and FIPS settings, which is the case in this PR.
In other words, the system crypto policy may be set to FIPS without the system running in FIPS mode, because the FIPS policy is like any other crypto policy. On the other hand, when the system is switched into the FIPS mode, I am pretty sure that flipping the current crypto policy to FIPS is part of the process.
I hope that this answers your question - enforcing FIPS crypto policies doesn't mean that the system runs in FIPS mode and exactly that is the case of profiles that I have modified. If we want to ensure the FIPS mode, we have to add another rule, and it certainly wouldn't hurt to have the FIPS crypto policies around as well, which is the case of the current RHEL8 OSPP profile.

[yuumasato]

On the other hand, when the system is switched into the FIPS mode, I am pretty sure that flipping the current crypto policy to FIPS is part of the process.

Yes, command fips-mode-setup --enable will select crypto-policy FIPS. Additionaly, rule enable_fips_mode checks that selected crypto-policy is FIPS.

[redhatrises]

@shawndwells do the statements above satisfy your questions?

[shawndwells]

@redhatrises yeah, seems good!