Install crypto-policies package
Ensures the crypto-policies package is installed so RHEL can enforce a system-wide cryptographic policy (e.g. DEFAULT, FUTURE, FIPS).
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on it. Use of weak or untested encryption algorithms undermines the very purpose of encryption to protect data.
What Pavois checks
Pavois verifies that the crypto-policies package is present via rpm. This package backs the update-crypto-policies tool that drives the effective TLS/SSH/kernel crypto settings; without it, each application picks its own (often weaker) defaults instead of a coherent, auditable baseline.
describe package('crypto-policies') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q crypto-policies, which should return an installed version. Confirm the active policy with update-crypto-policies --show (expected DEFAULT, FUTURE or FIPS per your baseline).
Inspect & investigate
Verify the package with rpm -q crypto-policies and inspect the resolved policy under /etc/crypto-policies/; policy changes are reported by update-crypto-policies --show.
Remediation
Pavois's harden plan installs the crypto-policies package (resource package, action install) and is applied with pavois harden apply. After installing, set the desired policy with update-crypto-policies --set.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | crypto-policies |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without centralized crypto policies, services may negotiate weak ciphers, exposing data in transit. Installing the package is safe and non-disruptive; however, switching to a stricter policy like FUTURE or FIPS afterward can break legacy clients or services using deprecated algorithms, test connectivity (SSH, TLS endpoints) before tightening the policy.