• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer navigation

The Geek Diary

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • VCS
  • Interview Questions
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
  • DevOps
    • Docker
    • Shell Scripting
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

How to disable FIPS mode on CentOS/RHEL 7

by admin

What is FIPS Compliance?

The Federal Information Processing Standards (FIPS) are standards specified by the United States Government for approving cryptographic software. The National Institute of Standards and Technology (NIST) has so far issued the FIPS 140-1 and FIPS 140-2 standards, and FIPS PUB 140-2 is the standard for “Security Requirements for Cryptographic Modules”.

The steps to enable FIPS on CentOS/RHEL 7 include installing the dracut-fips package. This package provides a file, /etc/system-fips, that FIPS-enabled software, such as the openssh client, uses to know to check whether FIPS mode is enabled or not in the kernel. Using fips=1 during install tells the installer to also install the dracut-fips package automatically.

Disabling FIPS mode

1. Remove dracut-fips packages.

# yum remove dracut-fips*

2. Take a backup of the FIPS initramfs.

# cp -p /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).backup
Note: Check if the initramfs file has been created or not. Also, you can use another location instead of /boot/ to avoid space issues.

3. Recreate the initramfs file:

# dracut -f

OR

# dracut -f -v /boot/initramfs-$(uname -r).img $(uname -r)

4. Disable fips=1 value from the kernel command-line. Modify the kernel command line of the current kernel in the grub.cfg adding the following option “fips=0” to the GRUB_CMDLINE_LINUX key in the /etc/default/grub file and then rebuild the grub.cfg file:

Example of how GRUB_CMDLINE_LINUX line looks like:

# cat /etc/default/grub | grep GRUB_CMDLINE_LINUX=
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=vg_os/root rd.lvm.lv=vg_os/swap rhgb quiet fips=0"

5. Changes to /etc/default/grub require rebuilding the grub.cfg file as follow:

# grub2-mkconfig -o /boot/grub2/grub.cfg

Or If you have a UEFI-based run:

# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

6. Reboot the server for the changes to take effect:

# shutdown -r now

7. Check that FIPS is not in enforcing mode after a reboot /proc/sys/crypto/fips_enabled should be 0.

Example:

# cat /proc/sys/crypto/fips_enabled
0

Filed Under: CentOS/RHEL 7, Linux

Some more articles you might also be interested in …

  1. gnome-screenshot: command not found
  2. Using grep to search in reverse
  3. “yum clean all” not clearing yum repository cache in CentOS/RHEL/OEL
  4. ss Command Examples in Linux
  5. bpftool: command not found
  6. clj: Clojure tool to start a REPL or invoke a specific function with data
  7. debsecan Command Examples in Linux
  8. How to Identify NIS Authenticated Users
  9. apache2ctl Command Examples in Linux
  10. How to configure VNC Server on Oracle Linux 6

You May Also Like

Primary Sidebar

Recent Posts

  • ctags: Generates an index (or tag) file of language objects found in source files for many popular programming languages
  • csvtool: Utility to filter and extract data from CSV formatted sources
  • csvstat: Print descriptive statistics for all columns in a CSV file
  • csvsql: Generate SQL statements for a CSV file or execute those statements directly on a database

© 2023 · The Geek Diary

  • Archives
  • Contact Us
  • Copyright