Review configure_crypto_policy tests with OSPP profile about content

[vojtapolasek]

Hello. I am unable to reproduce the issue. I tried connecting from both Fedora 38 and Fedora 39 to RHEL 9.4 machine and I can't reproduce the issue.
Even after enabling the FIPS:OSPP cryptopolicy manually on the RHEL machine, I can still connect without problems.
When following the steps to reproduce, I receive only following errors, which don't look so scary:

...
WARNING - Script policy_default_set.pass.sh - profile xccdf_org.ssgproject.content_profile_standard not found in data stream
...
ERROR - Script cis_l2.pass.sh using profile xccdf_org.ssgproject.content_profile_cis_workstation_l2 found issue:
ERROR - Rule xccdf_org.ssgproject.content_rule_configure_crypto_policy has not been evaluated! Wrong profile selected in test scenario?
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_configure_crypto_policy'.
INFO - Script policy_default_cis_l1.pass.sh using profile xccdf_org.ssgproject.content_profile_cis_server_l1 OK
ERROR - Script policy_default_cis_l1.pass.sh using profile xccdf_org.ssgproject.content_profile_cis_workstation_l1 found issue:
ERROR - Rule xccdf_org.ssgproject.content_rule_configure_crypto_policy has not been evaluated! Wrong profile selected in test scenario?
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_configure_crypto_policy'.

[marcusburghardt]

Thanks for this information @vojtapolasek . Since you couldn't reproduce the session issue mentioned in the description using fresh installed VMs, it is likely my local test environment has something more or less that is impeding an ssh connection when FIPS:OSPP policy is selected.

So I checked again the original tests and the errors there match with the errors in your test environment:
ERROR - Rule xccdf_org.ssgproject.content_rule_configure_crypto_policy has not been evaluated! Wrong profile selected in test scenario?

[marcusburghardt]

Hum, it seems this is not a new issue. See #10895

[marcusburghardt]

In the original description of this issue I also questioned an OVAL tests included in the rule.
For this, I filed a separate issue to not mix two different topics on the same issue: #11536

[mildas]

@marcusburghardt Do you agree with closing this issue, as it's duplicate of #10895 ?

[marcusburghardt]

@marcusburghardt Do you agree with closing this issue, as it's duplicate of #10895 ?

Yes, let's centralize in #10895