back to labs
System-Wide TLS Crypto Policy (OpenSSL)
MediumLinux Security20-25 minThe brief
Every OpenSSL-linked service on this host inherits its defaults from /etc/ssl/openssl.cnf — and right now that file sets no floor, so a service could still negotiate TLS 1.0 or a 1024-bit key. Establish a system-wide crypto policy in openssl.cnf: wire up a system_default_sect, set the minimum protocol to TLS 1.2, and raise the cipher security level to SECLEVEL=2 (which rejects weak keys and legacy ciphers). This is the file-based crypto-policy control a SCAP scan checks.
What you'll do
- Wire openssl_conf → ssl_conf → system_default → system_default_sect in /etc/ssl/openssl.cnf
- Set MinProtocol to TLSv1.2 (or higher)
- Set CipherString to raise the security level to SECLEVEL=2 or above
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.