Policy "Hardened Amazon Linux 2023 (version 2)" is failing on the latest AL 2023 with the FUTURE crypto policy.

[Houlistonm]

The problem is we made the boxes more secure by usr/bin/update-crypto-policies --set FUTURE which dropped some Ciphers, Group exchange, Key exchange, and MACs and added others.

Maybe a new policy for DEFAULT crypto policy and another for FUTURE?

Love the tool, working out well as we harden our OS.

[perkelix]

Just out of curiosity, where did that update-crypto-policies command come from, @Houlistonm ?

[Houlistonm]

Appears to upstream from Amazon ...

link to redhat docs

[perkelix]

You mean these?

That apparently was ported to other distros as well, but is not actively maitnained outside of RHEL.

[Houlistonm]

looks right (from memory), I'm on holiday this week, so I can't compare to one of our VMs.