4

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space.

So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the distribution configuration?

CentOS has "fips" mode, but, again, you have to tackle CentOS configuration to make it FIPS compliant. I'm looking to "just install" distribution.

  • Fire-and-Forget FIPS? I doubt it. – schroeder Apr 12 '17 at 11:56
3

Red Hat regularly puts its OS through FIPS 140-2 certification​. See this press release from 2016.

Whether it works out of the box with zero config, I'm not sure, but that config should be easy to automate.

Also, be careful with the term "fips mode". Typically this means that, while running in this mode, the software only uses FIPS-approved crypto algorithms, and performs FIPS-style power-on self-checks, but simply turning on this setting does not mean that you meet all aspects of FIPS compliance. Unfortunately, unless you're buying a packaged hardware appliance like an HSM, there's no way around needing to read the manufacturer documentation to see what steps you need to do to be FIPS compliant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.