{"description": "\nTo enable FIPS mode, run the following command:\n<pre>fips-mode-setup --enable</pre>\n<br />\nThe <tt>fips-mode-setup</tt> command will configure the system in\nFIPS mode by automatically configuring the following:\n<ul>\n<li>Setting the kernel FIPS mode flag (<tt>/proc/sys/crypto/fips_enabled</tt>) to <tt>1</tt></li>\n<li>Creating <tt>/etc/system-fips</tt></li>\n<li>Setting the system crypto policy in <tt>/etc/crypto-policies/config</tt> to <tt><sub idref=\"var_system_crypto_policy\" /></tt></li>\n<li>Loading the Dracut <tt>fips</tt> module</li>\n</ul>", "rationale": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to\nprotect data. The operating system must implement cryptographic modules adhering to the higher\nstandards approved by the federal government since this provides assurance they have been tested\nand validated.", "severity": "high", "references": {"nerc-cip": ["CIP-003-8 R4.2", "CIP-007-3 R5.1"], "nist": ["CM-3(6)", "SC-12(2)", "SC-12(3)", "IA-7", "SC-13", "CM-6(a)", "SC-12"], "ospp": ["FCS_COP.1(1)", "FCS_COP.1(2)", "FCS_COP.1(3)", "FCS_COP.1(4)", "FCS_CKM.1", "FCS_CKM.2", "FCS_TLSC_EXT.1", "FCS_RBG_EXT.1"], "srg": ["SRG-OS-000478-GPOS-00223", "SRG-OS-000396-GPOS-00176"], "ism": ["1446"]}, "control_references": {"ism": ["1446"]}, "components": [], "identifiers": {}, "ocil_clause": "FIPS mode is not enabled", "ocil": "To verify that FIPS mode is enabled properly, run the following command:\n<pre>cat /proc/sys/crypto/fips_enabled</pre>\nThe output be must:\n<pre>1</pre>", "oval_external_content": null, "fixtext": "Configure Ubuntu 22.04 to run in FIPS mode.\n\nThe installer for the system must be booted with kernel parameter <tt>fips=1</tt>.", "checktext": "", "vuldiscussion": "", "srg_requirement": "Ubuntu 22.04 must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.", "warnings": [{"general": "To configure Ubuntu 22.04 to run in FIPS 140 mode, the kernel parameter \"fips=1\" needs to be added during its installation.\nOnly enabling FIPS 140 mode during the Ubuntu 22.04 installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place.\nEnabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported."}, {"regulatory": "This rule DOES NOT CHECK if the components of the operating system are FIPS certified.\nYou can find the list of FIPS certified modules at \n<a xmlns='http://www.w3.org/1999/xhtml' href='https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search'>https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search</a>.\nThis rule checks if the system is running in FIPS mode."}], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.", "vuldiscussion": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to\nprotect data. The operating system must implement cryptographic modules adhering to the higher\nstandards approved by the federal government since this provides assurance they have been tested\nand validated.", "checktext": "Verify that Ubuntu 22.04 is in FIPS mode with the following command:\n\n$ fips-mode-setup --check\n\nFIPS mode is enabled.\n\nIf FIPS mode is not enabled, this is a finding.", "fixtext": "Configure Ubuntu 22.04 to run in FIPS mode with the following command:\n\n$ sudo fips-mode-setup --enable\n\nThe system needs to be rebooted for these changes to take effect."}}, "platform": "system_with_kernel and not osbuild", "platforms": ["system_with_kernel and not osbuild"], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": ["not_osbuild_and_system_with_kernel"], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Enable FIPS Mode", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml", "template": null}