3

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant.

From what I've discussed with my co-workers, our platform requires a FIPS-compliant SSH.

We have a FIPS-compliant OpenSSL (well, a version of OpenSSL configured and compiled against the fipscanister object at least). From here, how can I create a FIPS-compliant OpenSSH?

Note:

Our target OS is a derivative of Linux.

I've found some patches that looked promising, like this one, but they either lack documentation, or (in the above case) flat out say this is for the author's use only and everyone else should steer clear.

I think a good answer would be something like:

  • "When you configure OpenSSH, enable/disable these algorithms" or...

  • "Download source for OpenSSH version X and patch it with this patch"

  • Did you see the IBM guide: ibm.com/support/knowledgecenter/en/SSLTBW_2.3.0/… ? – Limit Feb 27 '18 at 0:50
  • I had not. I'll go check that out and probably end up asking a more specific question on here when something there inevitably goes wrong. – DeepDeadpool Feb 27 '18 at 3:22
  • 7
    Just a note, but you should probably hire someone who actually has a background in information security when you are ensuring FIPS-compliance. Otherwise you are opening yourself up to liabilities. – forest Feb 27 '18 at 3:24
  • What are your requirements exactly? There's a world of difference between using software that's undergone a FIPS certification (expensive, and because you can't do security updates, it's very insecure), and using only NIST-approved algorithms (which is the default with many programs anyway). – Gilles Feb 27 '18 at 7:25
  • Let's go with that second one. We're probably going to get our stuff certified at the end, so that seems like the logical first step. – DeepDeadpool Feb 27 '18 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.