• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

The Geek Diary

CONCEPTS | BASICS | HOWTO

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • Linux Services
    • VCS
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
    • Data Guard
  • DevOps
    • Docker
    • Shell Scripting
  • Interview Questions
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

How to disable FIPS mode on CentOS/RHEL 7

By admin

What is FIPS Compliance?

The Federal Information Processing Standards (FIPS) are standards specified by the United States Government for approving cryptographic software. The National Institute of Standards and Technology (NIST) has so far issued the FIPS 140-1 and FIPS 140-2 standards, and FIPS PUB 140-2 is the standard for “Security Requirements for Cryptographic Modules”.

The steps to enable FIPS on CentOS/RHEL 7 include installing the dracut-fips package. This package provides a file, /etc/system-fips, that FIPS-enabled software, such as the openssh client, uses to know to check whether FIPS mode is enabled or not in the kernel. Using fips=1 during install tells the installer to also install the dracut-fips package automatically.

Disabling FIPS mode

1. Remove dracut-fips packages.

# yum remove dracut-fips*

2. Take a backup of the FIPS initramfs.

# cp -p /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).backup
Note: Check if the initramfs file has been created or not. Also, you can use another location instead of /boot/ to avoid space issues.

3. Recreate the initramfs file:

# dracut -f

OR

# dracut -f -v /boot/initramfs-$(uname -r).img $(uname -r)

4. Disable fips=1 value from the kernel command-line. Modify the kernel command line of the current kernel in the grub.cfg adding the following option “fips=0” to the GRUB_CMDLINE_LINUX key in the /etc/default/grub file and then rebuild the grub.cfg file:

Example of how GRUB_CMDLINE_LINUX line looks like:

# cat /etc/default/grub | grep GRUB_CMDLINE_LINUX=
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=vg_os/root rd.lvm.lv=vg_os/swap rhgb quiet fips=0"

5. Changes to /etc/default/grub require rebuilding the grub.cfg file as follow:

# grub2-mkconfig -o /boot/grub2/grub.cfg

Or If you have a UEFI-based run:

# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

6. Reboot the server for the changes to take effect:

# shutdown -r now

7. Check that FIPS is not in enforcing mode after a reboot /proc/sys/crypto/fips_enabled should be 0.

Example:

# cat /proc/sys/crypto/fips_enabled
0

Filed Under: CentOS/RHEL 7, Linux

Some more articles you might also be interested in …

  1. How to Configure rsyslog to Filter/discard Specific IP Address in CentOS/RHEL 6,7
  2. crontab error : “You (user) are not allowed to access to (crontab) because of pam configuration.”
  3. CentOS / RHEL 7 : How to recover from deleted root entry in /etc/shadow and/or /etc/passwd files
  4. CentOS / RHEL : Converting an Existing Root Filesystem to LVM Partition
  5. CentOS / RHEL 7 : How to disable all tty consoles and enable only 1
  6. iSCSI troubleshooting : Targets Not Detected After Reboot
  7. “mlock failed: Cannot allocate memory” lvcreate command error in CentOS/RHEL 7
  8. Linux OS Service ‘kudzu’
  9. CentOS / RHEL 7 : How to configure kdump
  10. CentOS / RHEL : How to add, delete and display LVM tags

You May Also Like

Primary Sidebar

Recent Posts

  • How to Disable IPv6 on Ubuntu 18.04 Bionic Beaver Linux
  • How to Capture More Logs in /var/log/dmesg for CentOS/RHEL
  • Unable to Start RDMA Services on CentOS/RHEL 7
  • How to rename a KVM VM with virsh
  • Archives
  • Contact Us
  • Copyright

© 2021 · The Geek Diary