How to Enable FIPS on SLES

This document (7023789) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)
SUSE Linux Enterprise Server 12 Service Pack 2 (SLES 12 SP2)
SUSE Linux Enterprise Server 12 Service Pack 3 (SLES 12 SP3)
SUSE Linux Enterprise Server 12 (SLES 12)

Federal Information Processing Standard (FIPS)

Situation

Need to setup / enable FIPS (Federal Information Processing Standard) on SLES.

Resolution

Before beginning, check to see if FIPS is already enabled.

       Run: sysctl -a | grep fips


       susesystem:/home/user # sysctl -a | grep fips	
crypto.fips_enabled = 0

crypto.fips_enabled = 0 shows that fips is not running. If crypto.fips_enabled = 1, then fips is running.


Note that it may be wise to make a backup of this system. If this fails, the system will not boot. If you are in this state, you will need to edit the grub line and remove fips=1 and boot.


1. Install the FIPS pattern.:

       Run: zypper in -t pattern fips

2. Edit /etc/default/grub and add fips=1 to end of line. If this system has a separate boot partition, it is REQUIRED to add boot=/dev/sda1 (use the correct path to your boot partition) or fips will fail and the system may not boot. In the following example, there is not a separate boot partition:

GRUB_CMDLINE_LINUX_DEFAULT="resume=/dev/vda1 splash=silent quiet showopts resume=/dev/vda1 splash=silent quiet showopts fips=1"


3. Recreate the grub.cfg file:

       Run: grub2-mkconfig -o /boot/grub2/grub.cfg

4. Recreate the initrd:

       Run: mkinitrd

5. Reboot the system.

6. After the system is booted, verify if FIPS is enabled:

        Run: sysctl -a | grep fips


	susesystem:/home/user # sysctl -a | grep fips
	crypto.fips_enabled = 1



p, li { white-space: pre-wrap; }

Cause

FIPS may be required for specific applications.

Additional Information

Related information can be found here:

https://www.suse.com/support/security/certifications/

https://www.suse.com/support/kb/doc/?id=7016636

https://www.suse.com/c/fipsified/

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7023789
  • Creation Date: 21-Mar-2019
  • Modified Date:03-Mar-2020
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback@suse.com

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.


SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center