1

Hi I'm trying to install openssh-client-hmac for Ubuntu 20.04. Does it not exist yet? Should I downgrade to Ubuntu 18.04 ?

I need it because I'm enabling FIPS and was following the documentation here for Ubuntu 18.04 https://security-certs.docs.ubuntu.com/en/fips - because I was hoping it might work on Ubuntu 20.04. The full command is:

 sudo apt install openssh-client openssh-client-hmac openssh-server openssh-server-hmac openssl libssl1.1 libssl1.1-hmac fips-initramfs linux-fips

From this list I was also unable to install openssh-server-hmac libssl1.1-hmac fips-initramfs linux-fips

So it seems like the pattern is that hmac and fips is in progress for Ubuntu 20.04 ?

It looks like this option is no longer free on Ubuntu 20.04?

This page https://manpages.ubuntu.com/manpages/focal/man1/ubuntu-advantage.1.html has me execute the command

sudo ubuntu-advantage enable fips

which returns

To use 'fips' you need an Ubuntu Advantage subscription
Personal and community subscriptions are available at no charge
See https://ubuntu.com/advantage

I see personal use or enterprise licenses available. Are there any options for small businesses?

2 Answers 2

1

FIPS modules require you to be enrolled in Ubuntu Advantage for your system. This is a paid service from Canonical, and is NOT freely available for the masses at large. Otherwise, the FIPS modules are not available to the average user, If you don't want full paid support from Canonical, then you would be going after Ubuntu Advantage for Infrastructure (UA-I) Essential edition. Costs for this are available at the Ubuntu site. If you need FIPS for your project, you'll have to obtain a UA-I subscription and enroll your system in UA-I. Depending on if it's a VM or a straight bare metal machine, you'll be paying different amounts (especially for Server installs).

You can get a 'free' UA-I Essential subscription for 3 machines maximum for personal use only simply by registering with Ubuntu One accounts, that'll let you enable FIPS on up to 3 systems. If you intend to use this for Business you should be purchasing the full UA-I subscriptions on a yearly basis with your company email (or a generic company email you're on).

2
  • Hi, thanks. For the 3 machine maximums am I allowed to use that for my small business? Or is that only allowed for personal use? Oct 9, 2020 at 13:51
  • @user1709076 Personal use. You should probably be prepared to sink some cash into this project if you intend to use FIPS modules at your business. If you intend to go that route, I suggest you reach out to Canonical to discuss with one of their enterprise customer people/engineers to explain what your needs are and to coordinate with them on the 'best solution' out of the UA offerings for your needs.
    – Thomas Ward
    Oct 9, 2020 at 13:53
0

Even if you got the UA subscription it still wouldn't work. I'm sure it will eventually, but today I got this:

sudo ua enable fips
One moment, checking your subscription first
FIPS is not available for Ubuntu 20.04 LTS (Focal Fossa).

Despite it showing as available:

SERVICE       ENTITLED  STATUS    DESCRIPTION
cc-eal        yes       n/a       Common Criteria EAL2 Provisioning Packages
cis-audit     no        —         Center for Internet Security Audit Tools
esm-apps      no        —         UA Apps: Extended Security Maintenance
esm-infra     yes       enabled   UA Infra: Extended Security Maintenance
fips          yes       n/a       NIST-certified FIPS modules
fips-updates  yes       n/a       Uncertified security updates to FIPS modules
livepatch     yes       enabled   Canonical Livepatch service
3
  • any progress with this? Mar 16, 2023 at 13:24
  • any progress with this please? Mar 16, 2023 at 13:28
  • @desperado06 contact Ubuntu support. I don't work for Canonical.
    – HackSlash
    Mar 16, 2023 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .