Appendix B. Provisioning FIPS-Compliant Hosts
Appendix B. Provisioning FIPS-Compliant Hosts Satellite supports provisioning hosts that comply with the National Institute of Standards and Technology's Security Requirements for Cryptographic Modules standard, reference number FIPS 140-2, referred to here as FIPS. To enable the provisioning of hosts that are FIPS-compliant, complete the following tasks: Change the provisioning password hashing algorithm for the operating system Create a host group and set a host group parameter to enable FIPS For more information, see Creating a Host Group in the Managing Hosts guide. The provisioned hosts have the FIPS-compliant settings applied. To confirm that these settings are enabled, complete the steps in Section B.3, "Verifying FIPS Mode is Enabled" . B.1. Changing the Provisioning Password Hashing Algorithm To provision FIPS-compliant hosts, you must first set the password hashing algorithm that you use in provisioning to SHA256. This configuration setting must be applied for each operating system you want to deploy as FIPS-compliant. Procedure Identify the Operating System IDs: Update each operating system's password hash value. Note that you cannot use a comma-separated list of values. B.2. Setting the FIPS-Enabled Parameter To provision a FIPS-compliant host, you must create a host group and set the host group parameter fips_enabled to true . If this is not set to true , or is absent, the FIPS-specific changes do not apply to the system. You can set this parameter when you provision a host or for a host group. To set this parameter when provisioning a host, append --parameters fips_enabled=true to the Hammer command. For more information, see the output of the command hammer hostgroup set-parameter --help . B.3. Verifying FIPS Mode is Enabled To verify these FIPS compliance changes have been successful, you must provision a host and check its configuration. Procedure Log on to the host as root or with an admin-level account. Enter the following command: A value of 1 confirms that FIPS mode is enabled.
hammer os list hammer os update --password-hash SHA256 --title " My_Operating_System " hammer hostgroup set-parameter --hostgroup " My_Host_Group " --name fips_enabled --value "true" cat /proc/sys/crypto/fips_enabled