5

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space.

So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the distribution configuration?

CentOS has "fips" mode, but, again, you have to tackle CentOS configuration to make it FIPS compliant. I'm looking to "just install" distribution.

Improve this question
1
  • Fire-and-Forget FIPS? I doubt it.
    – schroeder ♦
    Commented Apr 12, 2017 at 11:56

1 Answer 1

Reset to default
3

Red Hat regularly puts its OS through FIPS 140-2 certification​. See this press release from 2016.

Whether it works out of the box with zero config, I'm not sure, but that config should be easy to automate.

Also, be careful with the term "fips mode". Typically this means that, while running in this mode, the software only uses FIPS-approved crypto algorithms, and performs FIPS-style power-on self-checks, but simply turning on this setting does not mean that you meet all aspects of FIPS compliance. Unfortunately, unless you're buying a packaged hardware appliance like an HSM, there's no way around needing to read the manufacturer documentation to see what steps you need to do to be FIPS compliant.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .