Use crypto-policies to configure RHEL8 sshd algorithms

[yuumasato]

Description:

• In RHEL8, configure SSHD Ciphers and MACs via system-wide crypto policies

Rationale:

• This is inline with done in harden_sshd_crypto_policy Harden sshd crypto policy #4663

[yuumasato]

See also: #3677

[dahaic]

@vojtapolasek can you review this one? :)

[shawndwells]

Seems like more is needed. For example, how do we ensure the running system is using the FIPS ciphers? What provides assurance sshd is using crypto-policies?

[yuumasato]

Seems like more is needed. For example, how do we ensure the running system is using the FIPS ciphers? What provides assurance sshd is using crypto-policies?

@shawndwells I'm not sure what kind of assurance you are looking for.
I would say that setting a crypto-policy is very similar to setting a config file. In both cases, you set it, and the application will use it. It just happens that with crypto policies there is an extra layer that sets it for a bunch of libraries.

From Chapter 3. Using system-wide cryptographic policies:
Once a system-wide policy is set up, applications in RHEL follow it and refuse to use algorithms and protocols that do not meet the policy, unless you explicitly request the application to do so.

[matusmarhefka]

LGTM