6

I have Ubuntu 12.04.5 LTS server. Mainly I am running an SFTP server (OpenSSH_5.9), Vsftpd server (vsFTPd 2.3.5) and an IBM Message queue. My client want this server to be FIPS 140-2 certified, about which I have only a limited knowledge.

I have used a utility called modutil for enabling FIPS using below commands.

mkdir -p /root/.pki/nssdb
certutil -N -d /root/.pki/nssdb
modutil -fips true -dbdir /root/.pki/nssdb

But I don't think this will enable FIPS system wide. I think this will enable FIPS for that particular nssdb located at /root/.pki/nssdb. I need at least my SSH & FTP server to be FIPS complaint. How can I achieve this? I know that Red Hat supports FIPS and here is their documentation about enabling FIPS

Does Ubuntu support something like this?

Improve this question

3 Answers 3

Reset to default
7

FWIW, things have changed since this question was posted (exactly a year ago). Canonical has now announced FIPS is available for Ubuntu 16.04.

A couple blurbs from that announcement:

We are pleased to announce that officially certified FIPS 140-2 level 1 cryptographic packages are now available for Ubuntu 16.04 LTS for Ubuntu Advantage Advanced customers and as a separate, stand-alone product.

and

Users interested in FIPS 140-2 compliant modules on Ubuntu 16.04 can purchase Ubuntu Advantage at https://buy.ubuntu.com/ or by contacting the Canonical Sales Team.

For further information please visit https://www.ubuntu.com/security.

I also found a page on how to install. Of course, as mentioned, it's commercial only.

EDIT: CentOS, RHEL users has FIPS natively available

Improve this answer
5
  • Please write article how to setup the FIPS 140-2 compliant in supported Ubuntu. Please use Virtual box so that you can share screenshot
    – user25165
    Apr 13, 2018 at 6:24
  • 1
    Added install instructions. As mentioned, it's commercial only, so I don't have screenshots. BTW, I'd rather not copy-paste instructions here like usual, since I expect they will change, and are not really do-able without being a customer anyway.
    – dpb
    Apr 14, 2018 at 1:56
  • Thanks, i will share this answer to all FIPS 140-2 related Q/A. I have noticed many people do not know what it is even, lot of confusions out there.
    – user25165
    Apr 16, 2018 at 5:56
  • Isn't the license of these open source package saying that once you release/sell something derived, you need to provide source code? Since the FIPS packages are not available to everyone, I did not see the source code either, which sounds fishy.
    – Jakuje
    May 7, 2018 at 8:22
  • People who have access to the binaries also have access to the source; They are regular ubuntu source packages.
    – dpb
    May 8, 2018 at 14:16
0

The upstream project OpenSSH is not FIPS 140-2 compliant out of the box and there are several changes that needed to be done in OpenSSH that makes it certified in Red Hat Enterprise Linux. None of these patches are in Ubuntu OpenSSH so out of the box, you can't make Ubuntu FIPS 140-2 compliant (without rebuilding and modifying significant part of the packages and most probably kernel too).

Improve this answer
4
  • It seems you are correct. From wikipedia comparison en.wikipedia.org/wiki/Comparison_of_SSH_servers , I think I need to go for another SSH server. Do you have any idea about VSFTPD? If I skip ssh, ftp and just need a simple FIPS complaint linux server, is redhat the only option?
    – Midhun Jose
    Apr 10, 2017 at 10:38
  • I don't think it would work. The FIPS support is needed on whole OS level. If you go on with only part of it, the whole system will be not ever be FIPS compliant and the whole security will be defined by the security of the weakest point in the chain.
    – Jakuje
    Apr 10, 2017 at 10:42
  • There are also others vendors providing FIPS complain OS.
    – Jakuje
    Apr 10, 2017 at 10:46
  • The standard Ubuntu 16.04 is only FIPS-1 certified. You have to pay for FIPS-2.
    – Doug
    Oct 26, 2018 at 0:57
0

According to the NIST web site, http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2017.htm the Ubuntu OpenSSL Cryptographic Module was FIPS validated on 04/24/2017.

The web site references a security policy document at http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2888.pdf. It describes how to enable FIPS mode on Ubuntu so you would need to read this and follow the instructions.

A couple of things to keep in mind. The doc says that validation was performed on 16.04 LTS, so the first step would be to upgrade to that version.

But before you do that make sure you get everything else you need. The doc also states that for x86_64, you need to install libssl1.0.0_1.0.2g-1ubuntu4.fips.4.6.2_amd64.deb - I have been googling all day and I have no idea where to find it.

Improve this answer
1
  • It says "To download the FIPS validated version of the module, please contact the Canonical representative for the repository path.", so I suppose that's why you can't google it.
    – Divide
    Jul 10, 2017 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .