Edit the configuration files for the Site Recovery Manager services with:
|
In each "menuentry" that starts with "linux" append the following at the end of the line:
|
Edit /usr/lib/systemd/system/dr-client.service - comment out the existing Environment='CATALINA_OPTS=-Xms768m -Xmx1024m' and uncomment (remove the #) from the line below # Uncomment to enable FIPS. The file fragment should look like this:
|
Uncomment the <Manager> tag in /opt/vmware/dr-client/conf/context.xml - the file fragment with the tag should look like this:
|
Edit /opt/vmware/dr-client/lib/h5dr.properties and modify keyStoreName to point to BCFKS format keystore which contains root CA certificates. The property should look like this:
|
If you choose to use a truststore other than the default one, link to it should be added to /opt/vmware/dr-client/lib/ or /opt/vmware/dr-client/webapps/dr/WEB-INF/classes/. Keystore format should be BCFKS. To import it from JKS format use the following command:
|
NOTE: the keystore file you use should have Others: Read permission
Restart dr-client (only if FIPS has already been enabled for the appliance, otherwise skip this step):
|
Edit /usr/lib/systemd/system/drconfigui.service - comment out the existing Environment='CATALINA_OPTS=-Xms768m -Xmx1024m' and uncomment the one under # Uncomment to enable FIPS. The file fragment should look like this:
|
Uncomment the <Manager> tag in /opt/vmware/drconfigui/conf/context.xml - the file fragment with the tag should look like this:
|
Restart drconfigui (only if FIPS has already been enabled for the appliance, otherwise skip this step):
|
Validate the kernel command line
|
Validate that kernel has enabled FIPS mode
|
Validate that SSHD has enabled FIPS mode
journalctl -u sshd -b 0 | grep "FIPS" |
Validate that dr-configurator
has enabled Fips mode
|
Validate that vmware-dr
has enabled FIPS mode
grep "FIPS" /var/log/vmware/srm/vmware-dr* |
Validate UI strict mode