Skip to main content

Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server

Abstract

Enable FIPS 140-2/140-3 mode on Ubuntu or RHEL for Access Server — covers deploying Ubuntu Pro FIPS from AWS Marketplace, enabling FIPS on existing Ubuntu Pro instances, and enabling FIPS on RHEL 8, 9, and 10, with verification commands for each.

Overview

Federal Information Processing Standards FIPS 140-2/140-3 define security requirements for cryptographic modules used to protect sensitive information.

Access Server can run on operating systems that provide cryptographic modules validated through the NIST Cryptographic Module Validation Program (CMVP). Running the operating system in FIPS mode generally requires both:

  • Vendor-provided, NIST-validated cryptographic packages.

  • A FIPS-enabled kernel configuration that restricts the system to approved cryptographic algorithms.

This tutorial shows you how to enable and verify FIPS mode for Access Server deployments running on:

  • Ubuntu with Ubuntu Pro FIPS.

  • Ubuntu Pro with FIPS enabled manually.

  • Standard Ubuntu with an attached Ubuntu Pro subscription.

  • RHEL 8.

  • RHEL 9.

  • RHEL 10.

For background on how Access Server uses FIPS-validated cryptographic libraries, refer to the FIPS Compliance reference.

A properly configured operating system is one part of deploying a FIPS-compliant VPN. FIPS-compliant deployments are also commonly used in regulated environments implementing Zero Trust Network Access.

Prerequisites

Before you begin, ensure you have:

  • Console access and the ability to get root access.

  • For Ubuntu, an Ubuntu Pro subscription or an Ubuntu Pro FIPS image.

  • For RHEL, a standard Red Hat Enterprise Linux subscription.

  • Out-of-band or serial console access if the system doesn't boot after the FIPS kernel is installed.

Important: Create a backup first

Enabling FIPS can replace the kernel and system cryptographic libraries. Create a snapshot, AMI, or equivalent backup before making changes.

On AWS, ensure you can access the EC2 Serial Console or another recovery mechanism before continuing.

Important: A reboot is required

FIPS enforcement relies on the kernel boot configuration, including the fips=1 kernel flag. The system must restart before FIPS mode becomes active.

Important: Test algorithm compatibility

FIPS mode restricts the system to approved cryptographic algorithms. Applications or integrations that rely on non-approved algorithms, older TLS cipher suites, unsupported SSH key types, MD5, SHA-1 signatures, or certain elliptic curves may stop working.

Test the configuration on a non-production system before enabling FIPS in production.

Note

The examples in this tutorial use AWS. The operating-system commands are the same on other supported platforms, but image availability and subscription billing may differ.

Choose your FIPS deployment method

If you use Ubuntu, choose the deployment method that matches your environment.

Ubuntu Pro FIPS

Use an Ubuntu Pro FIPS image when one is available for your Ubuntu release, AWS region, and architecture.

The AWS Marketplace image includes the Ubuntu Pro subscription and has FIPS enabled as part of the image.

Continue to Deploy Ubuntu Pro FIPS

Ubuntu Pro

Use a standard Ubuntu Pro image when:

  • An Ubuntu Pro FIPS image isn't available.

  • You already use an Ubuntu Pro Marketplace image.

  • You want to enable FIPS manually.

The Ubuntu Pro subscription is included with the Marketplace image, but FIPS isn’t enabled by default.

Continue to Enable FIPS on Ubuntu Pro.

Standard Ubuntu

Use a standard Ubuntu image when neither Ubuntu Pro FIPS nor Ubuntu Pro is available or appropriate for your deployment.

You must first attach an Ubuntu Pro subscription, then enable FIPS.

Continue to Step 4: Enable FIPS on standard Ubuntu.

RHEL 8, RHEL 9, or RHEL 10

Use a standard RHEL image. RHEL doesn’t require a special FIPS image, but the enablement procedure differs by version.

Continue to Enable FIPS on RHEL.

Deploy Ubuntu Pro FIPS

AWS Marketplace provides Ubuntu Pro FIPS images with FIPS support already enabled.

  1. Open AWS Marketplace.

  2. Search for Ubuntu Pro FIPS.

  3. Select the image for your required Ubuntu version. For example: Ubuntu Pro FIPS 22.04 LTS.

  4. Launch the instance.

  5. Connect to the instance after it starts and get root privileges.

  6. Continue to Verify FIPS mode on Ubuntu.

Tip

AWS Marketplace lists both Ubuntu Pro and Ubuntu Pro FIPS images. Only the Ubuntu Pro FIPS variants come with FIPS enabled. If you launch a standard Ubuntu Pro image, continue to Step 3.

Enable FIPS on Ubuntu Pro

Use this procedure when you deploy an Ubuntu Pro image that doesn’t already have FIPS enabled.

  1. Open AWS Marketplace.

  2. Search for Ubuntu Pro.

  3. Select the image for your required Ubuntu version. For example: Ubuntu Pro 24.04 LTS.

  4. Launch the instance.

  5. Connect to the instance after it starts and get root privileges.

  6. Confirm that the subscription is attached and that FIPS services are available:

    pro status --all

    • Example output:

      SERVICE          ENTITLED  STATUS       DESCRIPTION
anbox-cloud      yes       disabled     Scalable Android in the cloud
cc-eal           yes       n/a          Common Criteria EAL2 Provisioning Packages
esm-apps         yes       enabled      Expanded Security Maintenance for Applications
esm-infra        yes       enabled      Expanded Security Maintenance for Infrastructure
fips             yes       n/a          NIST-certified FIPS crypto packages
fips-preview     yes       n/a          Preview of FIPS crypto packages undergoing certification with NIST
fips-updates     yes       disabled     FIPS compliant crypto packages with stable security updates
landscape        yes       disabled     Management and administration tool for Ubuntu
livepatch        yes       n/a          Canonical Livepatch service
realtime-kernel  yes       disabled     Ubuntu kernel with PREEMPT_RT patches integrated
├ generic        yes       disabled     Generic version of the RT kernel (default)
├ intel-iotg     yes       n/a          RT kernel optimized for Intel IOTG platform
└ raspi          yes       disabled     24.04 Real-time kernel optimised for Raspberry Pi
usg              yes       disabled     Security compliance and audit tools

    • If you see fips, fips-updates, and fips-preview in the list, the instance is entitled to install the FIPS packages.

      Tip

      Canonical provides multiple FIPS services. For most deployments, use fips-updates rather than the static fips service because it provides FIPS-compliant cryptographic packages together with stable security updates.

  7. Enable FIPS:

    pro enable fips-updates

  8. When prompted to continue, enter y.

    • Example output:

      One moment, checking your subscription first
This will install the FIPS packages including security updates.
Warning: This action can take some time and cannot be undone.
Are you sure? (y/N) y
Configuring APT access to FIPS Updates
Updating FIPS Updates package lists
This will downgrade the kernel from 6.17.0 to 6.8.0-1060.63+fips1.
Warning: Downgrading the kernel may cause hardware failures.  Please ensure the
         hardware is compatible with the new kernel version before proceeding.

Are you sure? (y/N) y
Updating standard Ubuntu package lists
Installing FIPS Updates packages
Installing openssh-client openssh-server openssh-sftp-server
FIPS Updates enabled
A reboot is required to complete install.

    • This installs the FIPS kernel and validated cryptographic components and configures the system to boot with the fips=1 kernel flag.

    • The packages can include FIPS-enabled versions of OpenSSL, OpenSSH, libgcrypt, and Linux kernel cryptographic components.

      Important

      Enabling fips-updates may replace or downgrade the current kernel with a FIPS-certified kernel. Review any hardware-compatibility warnings before continuing.

  9. Reboot the instance:

    reboot

  10. Wait for the system to restart.

  11. Reconnect to the console.

  12. Continue to Verify FIPS mode on Ubuntu.

Step 4: Enable FIPS on standard Ubuntu

A standard Ubuntu image doesn’t include an Ubuntu Pro subscription by default. Attach Ubuntu Pro before enabling FIPS.

  1. Connect to the console and get root privileges.

  2. Check the Ubuntu Pro status:

    pro status

    • Example output:

      This machine is not attached to an Ubuntu Pro subscription.

    • This means the system isn't attached.

  3. Obtain your Ubuntu Pro token from your Ubuntu Pro account.

  4. Add the Ubuntu Pro subscription:

    pro attach <your_pro_token>1 --no-auto-enable

    1

    Replace <your_pro_token> with your subscription token.

  5. Confirm FIPS entitlement:

    pro status --all

  6. Confirm that the following services appear: fips, fips-pregview, fips-updates.

    • Example output:

      SERVICE          ENTITLED  STATUS       DESCRIPTION
fips             yes       n/a          NIST-certified FIPS crypto packages
fips-preview     yes       n/a          Preview of FIPS crypto packages undergoing certification with NIST
fips-updates     yes       disabled     FIPS compliant crypto packages with stable security updates

  7. Run fips-updates to install FIPS-compliant packages while retaining stable security settings:

    pro enable fips-updates

  8. Enter y when prompted.

  9. Review any kernel replacement or compatibility warnings.

  10. Allow the installation to complete.

    • The process installs the FIPS kernel and configures the fips=1 kernel flag.

  11. Reboot the instance:

    reboot

  12. Wait for the system to restart.

  13. Reconnect to the console.

Verify FIPS mode on Ubuntu

Use the following checks after rebooting the Ubuntu instance.

  1. Verify Ubuntu Pro reports FIPS enabled:

    pro status

    • Example output:

      SERVICE          ENTITLED  STATUS       DESCRIPTION
anbox-cloud      yes       disabled     Scalable Android in the cloud
esm-apps         yes       enabled      Expanded Security Maintenance for Applications
esm-infra        yes       enabled      Expanded Security Maintenance for Infrastructure
fips-updates     yes       enabled      FIPS compliant crypto packages with stable security updates
landscape        yes       disabled     Management and administration tool for Ubuntu
realtime-kernel* yes       disabled     Ubuntu kernel with PREEMPT_RT patches integrated
usg              yes       disabled     Security compliance and audit tools

    • Confirm that fips-updates is enabled.

  2. Verify the kernel FIPS state:

    cat /proc/sys/crypto/fips_enabled

    • Example output:

      1

    • A value of 1 means FIPS mode is active. A value of 0, or a missing /proc/sys/crypt/fips_enabled file, means FIPS mode isn't active.

  3. Verify the FIPS kernel:

    uname -r

    • Example output:

      6.8.0-1060-aws-fips

    • Confirm that the kernel version contains fips.

  4. Verify the OpenSSL FIPS provider (on Ubuntu releases using OpenSSL 3.x):

    openssl list -providers

    • Example output:

      Providers:
  base
    name: OpenSSL Base Provider
    version: 3.0.13
    status: active
  fips
    name: Ubuntu 24.04 OpenSSL Cryptographic Module
    version: 3.0.13-0ubuntu3.6+Fips1
    status: active

    • Confirm that the FIPS provider reports status:active

Expected result: Ubuntu is running the FIPS kernel, FIPS cryptographic packages are active, and the system reports FIPS mode enabled.

If you use Ubuntu, your operating-system FIPS configuration is complete.

Enable FIPS on RHEL

RHEL doesn’t require a special Marketplace image. Deploy a standard RHEL image, then use the procedure for your installed version.

RHEL 8 and RHEL 9

  1. Deploy a supported RHEL 8 or RHEL 9 instance.

  2. Connect to the console and get root privileges.

  3. Enable FIPS:

    fips-mode-setup --enable

  4. Allow the command to complete.

  5. Reboot the instance:

    reboot

  6. Wait for the system to restart.

  7. Reconnect to the console.

  8. Continue to Verify FIPS mode on RHEL.

RHEL 10

RHEL 10 uses a different procedure to configure the fips=1 kernel flag and FIPS initramfs components.

  1. Deploy a supported RHEL 10 instance.

  2. Connect to the console and get root privileges.

  3. Add the fips=1 kernel argument, install the FIPS dracut packages, and regenerate the initramfs:

    grubby --update-kernel=ALL --args="fips=1"
dnf install dracut-fips dracut-fips-aesni -y
dracut -f

  4. Reboot the instance:

    reboot

  5. Wait for the system to restart.

  6. Reconnect to the console.

  7. Continue to Verify FIPS mode on RHEL.

Verify FIPS mode on RHEL

Use the following checks after rebooting the RHEL instance.

  1. Verify the kernel FIPS state:

    cat /proc/sys/crypto/fips_enabled

    • Example output:

      1

    • A value of 1 means FIPS mode is active. A value of 0, or a missing file, means FIPS mode isn't active.

  2. Check the FIPS configuration (for RHEL versions that provide fips-mode-setup):

    fips-mode-setup --check

    • Expected output:

      FIPS mode is enabled.

  3. Check the system crypto policy:

    update-crypto-policies --show

    • Expected output:

      FIPS

  4. Verify the OpenSSL FIPS provider (on RHEL releases using OpenSSL 3.x):

    openssl list -providers

    • Example ouptut:

      Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.5
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.5
    status: active
  fips
    name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider
    version: 3.0.7-395c1a240fbfffd8
    status: active

    • Confirms that the FIPS provider reports status: active.

Expected result: RHEL is running with FIPS enforcement enabled and the operating-system cryptographic policy is set ot FIPS.

Verify Access Server after enabling FIPS

After confirming that the operating system is running in FIPS mode, verify that Access Server starts and that your required functionality still works with the restricted cryptographic environment.

  1. Confirm that Access Server is running.

  2. Sign in to the Admin Web UI.

  3. Confirm that the Client Web UI loads successfully.

  4. Connect with a supported VPN client.

  5. Verify that authentication succeeds.

  6. Verify access to the required private resources.

  7. Test any integrations that depend on:

    • TLS.

    • SSH.

    • External authentication.

    • Certificates.

    • Cryptographic keys.

  8. Review Access Server and system logs for cryptographic algorithm or compatibility errors.

If an integration fails after enabling FIPS, determine whether it depends on an algorithm or key type that the operating system no longer permits.

See also

In this section: