Enable FIPS mode

[fly1ng_circus]

I have searched all over and have found no information on how to enable FIPS mode. Needing to do some testing but can't find documentation on how to enable it.

[the_rock]

I think its fairly obvious from my responses lol

Anyway, here it is...web UI broken, ssh broken, VPN broken...Im sure there is more, just have not had chance to confirm.

Andy

[Malcolm_Levy]

As stated, webui and ssh are being made fips compliant and will be enabled in fips mode. 

Not sure what you mean by vpn broken. IPsec is tested, You should open a support ticket.

[the_rock]

Well, I sure learned based on testing NOT to bother with fips, breaks all the important stuff.

Cheers,

Andy

[Fire_Verse]

I have to agree with Andy on the fips on/off. There shouldn't be an 'off' if it not longer does anything. Otherwise there should be a warning to the customer for fips 'on':

Warning! These changes you are about make are permanent. These changes are permanent and this gateway will need to be re-imaged in order to restore its functinoality. Do you wish to proceed? Y/n

Are you sure? Y/n

I wonder how many customers thought "Hmmmm. This FIPS mode looks like a good way to lock down the box. Oh looks like there is a command to turn it off if it's too much. Let's give it a try...." 

[the_rock]

You got it @Fire_Verse . I learned in my early 20s NOT to waste my time/energy on stuff I cant change. If CP thinks this is the right way to have FIPS configured, then I have a choice not to bother with it 🤣🤣

Andy

[Malcolm_Levy]

the lack of support tickets indicates that fips mode is hardly used.

the feedback we received on webui and ssh are being addressed

[the_rock]

In my mind mate, something hardly used does NOT mean it should not be configured as user friendly/logical manner.

Just saying : - )

Andy

Anyway, onto something way more important now. Im done discussing FIPS for today and probably forseable future lol

[Fire_Verse]

I have a customer right now with FBI/CJIS requirements stating appliances need to be run in FIPS-mode. Based on what I have documented in the lab, they are now going to have to bring in another vendor, probably Cisco because of its FIPS compliance. The main driver is what looks like the loss of IPSEC B2B and IPSEC remote access (IKE issues) with FIPS 'on'

I'm actually fine with making the changes to SSH and SSL manually...and am documenting that process on my own. 

Is there an ETA on when the 'fips' command is going to be changed to allow SSH and the WebUI? Will IPSEC availability be addressed?

[the_rock]

Awesome! Please be free to share it when done, it would be greatly appreciated.

Cheers,

Andy

[Fire_Verse]

Part 1 from a few weeks ago:

https://fireverse.org/2023/08/25/r81-20-ciphers/ 

[Malcolm_Levy]

Your page needs updating:

Is ChaCha20-Poly1305 FIPS compliant?

FIPS is a US government standard that specifies, among other things, the ciphers and modes of operation that are approved for government use. AES and CCM are part of FIPS, but ChaCha20 and Poly1305 are not

also from https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/ass.... 

For example, the ChaCha20 algorithm is not FIPS-approved, and the FIPS cryptographic policy ensures that TLS servers and clients do not announce the TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS cipher suite, because any attempt to use such a cipher fails.

[Fire_Verse]

To be fair I don't claim that the two 'ChaChas' are FIPS-compliant, just that they can be used.

At the bottom of the post I made, the only two recommended ciphers that work "out of the box" without creating a new certificate for the gateways, and that are FIPS-compliant:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

https://fireverse.org/2023/08/25/r81-20-ciphers/

[Malcolm_Levy]

SSH and WebUI are targeted for R82. Once validated I will ask to include in next JHF for R81.10 and R81.20

You can ask for a customer hot fix if more urgent. 

I'm not familiar with an IPsec issue which is why I suggest you open a formal ticket. 

[Fire_Verse]

Any word if there is a new FIPS-mode script that allows SSH and the WebUI to be enabled?

[Malcolm_Levy]

This is still targeted for R82. Backporting looks more challenging than I understood.