How to enable FIPS (Federal Information Processing Standards) on Site Recovery Manager Appliance 8.4
book
Article ID: 312579
calendar_today
Updated On:
Products
VMware Live Recovery
Issue/Introduction
This article summarizes the necessary tasks that must be done in order for Site Recovery Manager product to support running in FIPS mode. Please note this process is only supported on the SRM Appliance.
In each menuentry append at the end of the line that starts with linux.
fips=1
Save the file.
Start UI in strict mode:
Edit /usr/lib/systemd/system/dr-client.service - comment out the existing Environment='CATALINA_OPTS=-Xms768m -Xmx1024m' and uncomment the one under # Uncomment to enable FIPS. The file fragment should look like this:
#Environment='CATALINA_OPTS=-Xms768m -Xmx1024m'
# Uncomment to enable FIPS
Environment='CATALINA_OPTS=-Xms768m -Xmx1024m -Djava.security.properties==/opt/vmware/dr-client/conf/vmware-override-java.security -Djava.ext.dirs=/opt/vmware/dr-client/lib/ext -Dorg.bouncycastle.jca.enable_jks=true -Dorg.bouncycastle.fips.approved_only=true'
Uncomment the <Manager> tag in /opt/vmware/dr-client/conf/context.xml - the file fragment with the tag should look like this:
<!-- Uncomment to enable FIPS mode. -->
<Manager pathname="" secureRandomAlgorithm=""/>
Edit /opt/vmware/dr-client/lib/h5dr.propertiesand modify keyStoreName to point to BCFKS format keystore which contains root CA certificates. The property should look like this:
keyStoreName=h5dr.keystore.bks
Choose java truststore - this is the store which contains root CA certificates. Link to the choosen truststore must be added to /opt/vmware/dr-client/lib/ or /opt/vmware/dr-client/webapps/dr/WEB-INF/classes/.
NOTE: the keystore file used should have Others: Read permission
Start Config UI in strict mode:
Edit /usr/lib/systemd/system/drconfigui.service- comment out the existing Environment='CATALINA_OPTS=-Xms768m -Xmx1024m' and uncomment the one under # Uncomment to enable FIPS. The file fragment should look like this:
#Environment='CATALINA_OPTS=-Xms768m -Xmx1024m'
# Uncomment to enable FIPS
Environment='CATALINA_OPTS=-Xms768m -Xmx1024m -Djava.security.properties==/opt/vmware/drconfigui/conf/vmware-override-java.security -Djava.ext.dirs=/opt/vmware/drconfigui/lib/ext -Dorg.bouncycastle.jca.enable_jks=true -Dorg.bouncycastle.fips.approved_only=true'
Uncomment the <Manager> tag in /opt/vmware/drconfigui/conf/context.xml - the file fragment with the tag should look like this:
<!-- Uncomment to enable FIPS mode. -->
<Manager pathname="" secureRandomAlgorithm=""/>
Reboot the appliance.
Note: SSHD will read that the kernel has enabled FIPS mode and will activate it too. No need to edit anything in the sshd configuration.
Validate FIPS mode is enabled
Validate the kernel commandline.
cat /proc/cmdline
Validate that kernel has enabled FIPS mode.
cat /proc/sys/crypto/fips_enabled
Validate that SSHD has enabled FIPS mode.
journalctl -u sshd -b 0 | grep "FIPS"
Validate that dr-configurator has enabled Fips mode.