• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer navigation

The Geek Diary

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • VCS
  • Interview Questions
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
  • DevOps
    • Docker
    • Shell Scripting
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

How to disable FIPS mode on CentOS/RHEL 7

by admin

What is FIPS Compliance?

The Federal Information Processing Standards (FIPS) are standards specified by the United States Government for approving cryptographic software. The National Institute of Standards and Technology (NIST) has so far issued the FIPS 140-1 and FIPS 140-2 standards, and FIPS PUB 140-2 is the standard for “Security Requirements for Cryptographic Modules”.

The steps to enable FIPS on CentOS/RHEL 7 include installing the dracut-fips package. This package provides a file, /etc/system-fips, that FIPS-enabled software, such as the openssh client, uses to know to check whether FIPS mode is enabled or not in the kernel. Using fips=1 during install tells the installer to also install the dracut-fips package automatically.

Disabling FIPS mode

1. Remove dracut-fips packages.

# yum remove dracut-fips*

2. Take a backup of the FIPS initramfs.

# cp -p /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).backup
Note: Check if the initramfs file has been created or not. Also, you can use another location instead of /boot/ to avoid space issues.

3. Recreate the initramfs file:

# dracut -f

OR

# dracut -f -v /boot/initramfs-$(uname -r).img $(uname -r)

4. Disable fips=1 value from the kernel command-line. Modify the kernel command line of the current kernel in the grub.cfg adding the following option “fips=0” to the GRUB_CMDLINE_LINUX key in the /etc/default/grub file and then rebuild the grub.cfg file:

Example of how GRUB_CMDLINE_LINUX line looks like:

# cat /etc/default/grub | grep GRUB_CMDLINE_LINUX=
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=vg_os/root rd.lvm.lv=vg_os/swap rhgb quiet fips=0"

5. Changes to /etc/default/grub require rebuilding the grub.cfg file as follow:

# grub2-mkconfig -o /boot/grub2/grub.cfg

Or If you have a UEFI-based run:

# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

6. Reboot the server for the changes to take effect:

# shutdown -r now

7. Check that FIPS is not in enforcing mode after a reboot /proc/sys/crypto/fips_enabled should be 0.

Example:

# cat /proc/sys/crypto/fips_enabled
0

Filed Under: CentOS/RHEL 7, Linux

Some more articles you might also be interested in …

  1. The ultimate Linux interview questions : swap
  2. aptitude: command not found
  3. mailq Command Examples in Linux
  4. How To Execute The Pstack Command On CentOS/RHEL
  5. cryptcat Command Examples in Linux
  6. pvck Command Examples in Linux
  7. How to Customize Linux Password Expiration and Complexity Requirements
  8. How to use the “screen” command in Linux
  9. scsi_id Command Examples in Linux
  10. Linux OS Service ‘yppasswdd’

You May Also Like

Primary Sidebar

Recent Posts

  • fprintd-delete Command Examples in Linux
  • fprintd-delete: command not found
  • foreman: command not found
  • foreman Command Examples in Linux

© 2023 · The Geek Diary

  • Archives
  • Contact Us
  • Copyright