--- title: 'Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server' canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/ product: Access Server Docs description: Enable FIPS 140-2/140-3 mode on Ubuntu or RHEL for Access Server — covers deploying Ubuntu Pro FIPS from AWS Marketplace, enabling FIPS on existing Ubuntu Pro instances, and enabling FIPS on RHEL 8, 9, and 10, with verification commands for each. --- # Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server ## Overview Federal Information Processing Standards FIPS 140-2/140-3 define security requirements for cryptographic modules used to protect sensitive information. Access Server can run on operating systems that provide cryptographic modules validated through the NIST Cryptographic Module Validation Program (CMVP). Running the operating system in FIPS mode generally requires both: - Vendor-provided, NIST-validated cryptographic packages. - A FIPS-enabled kernel configuration that restricts the system to approved cryptographic algorithms. This tutorial shows you how to enable and verify FIPS mode for Access Server deployments running on: - Ubuntu with Ubuntu Pro FIPS. - Ubuntu Pro with FIPS enabled manually. - Standard Ubuntu with an attached Ubuntu Pro subscription. - RHEL 8. - RHEL 9. - RHEL 10. For background on how Access Server uses FIPS-validated cryptographic libraries, refer to the [FIPS Compliance reference](https://openvpn.net/as-docs/v3/fips-compliance.md). A properly configured operating system is one part of deploying a FIPS-compliant VPN. FIPS-compliant deployments are also commonly used in regulated environments implementing [Zero Trust Network Access](https://openvpn.net/use-cases/zero-trust-network-access/). ## Prerequisites Before you begin, ensure you have: - Console access and the ability to get root access. - For Ubuntu, an Ubuntu Pro subscription or an Ubuntu Pro FIPS image. - For RHEL, a standard Red Hat Enterprise Linux subscription. - Out-of-band or serial console access if the system doesn't boot after the FIPS kernel is installed. > **Important** > > **Important: Create a backup first** > > Enabling FIPS can replace the kernel and system cryptographic libraries. Create a snapshot, AMI, or equivalent backup before making changes. > > On AWS, ensure you can access the EC2 Serial Console or another recovery mechanism before continuing. > **Important** > > **Important: A reboot is required** > > FIPS enforcement relies on the kernel boot configuration, including the `fips=1` kernel flag. The system must restart before FIPS mode becomes active. > **Important** > > **Important: Test algorithm compatibility** > > FIPS mode restricts the system to approved cryptographic algorithms. Applications or integrations that rely on non-approved algorithms, older TLS cipher suites, unsupported SSH key types, MD5, SHA-1 signatures, or certain elliptic curves may stop working. > > Test the configuration on a non-production system before enabling FIPS in production. > **Note** > > The examples in this tutorial use AWS. The operating-system commands are the same on other supported platforms, but image availability and subscription billing may differ. ## Step 1: Choose your FIPS deployment method Choose the option that matches your operating system and starting configuration. ### Ubuntu Pro FIPS Use an Ubuntu Pro FIPS image when one is available for your Ubuntu release, AWS region, and architecture. The AWS Marketplace image includes the Ubuntu Pro subscription and has FIPS enabled as part of the image. Continue to [FIPS Deploy Ubuntu Pro FIPS](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#deploy-ubuntu-pro-fips) ### Ubuntu Pro Use a standard Ubuntu Pro image when: - An Ubuntu Pro FIPS image isn't available. - You already use an Ubuntu Pro Marketplace image. - You want to enable FIPS manually. The Ubuntu Pro subscription is included with the Marketplace image, but FIPS isn’t enabled by default. Continue to [FIPS Enable FIPS on Ubuntu Pro](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#enable-fips-on-ubuntu-pro). ### Standard Ubuntu Use a standard Ubuntu image when neither Ubuntu Pro FIPS nor Ubuntu Pro is available or appropriate for your deployment. You must first attach an Ubuntu Pro subscription, then enable FIPS. Continue to [FIPS Attach Ubuntu Pro and enable FIPS](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#attach-ubuntu-pro-and-enable-fips). ### RHEL 8, RHEL 9, or RHEL 10 Use a standard RHEL image. RHEL doesn’t require a special FIPS image, but the enablement procedure differs by version. Continue to [FIPS Enable FIPS on RHEL](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#enable-fips-on-rhel). ## Step 2: Configure FIPS for your deployment ### Deploy Ubuntu Pro FIPS AWS Marketplace provides Ubuntu Pro FIPS images with FIPS support already enabled. 1. Open AWS Marketplace. 2. Search for **Ubuntu Pro FIPS**. 3. Select the image for your required Ubuntu version. For example: `Ubuntu Pro FIPS 22.04 LTS`. 4. Launch the instance. 5. Connect to the instance after it starts and get root privileges. 6. Continue to [FIPS Verify FIPS mode on Ubuntu](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#verify-fips-mode-on-ubuntu). > **Tip** > > AWS Marketplace lists both Ubuntu Pro and Ubuntu Pro FIPS images. Only the Ubuntu Pro FIPS variants come with FIPS enabled. If you launch a standard Ubuntu Pro image, continue to [FIPS Enable FIPS on Ubuntu Pro](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#enable-fips-on-ubuntu-pro). ### Enable FIPS on Ubuntu Pro Use this procedure when you deploy an Ubuntu Pro image that doesn’t already have FIPS enabled. 1. Open AWS Marketplace. 2. Search for **Ubuntu Pro**. 3. Select the image for your required Ubuntu version. For example: `Ubuntu Pro 24.04 LTS`. 4. Launch the instance. 5. Connect to the instance after it starts and get root privileges. 6. Confirm that the subscription is attached and that FIPS services are available: ``` pro status --all ``` - Example output: ``` SERVICE ENTITLED STATUS DESCRIPTION anbox-cloud yes disabled Scalable Android in the cloud cc-eal yes n/a Common Criteria EAL2 Provisioning Packages esm-apps yes enabled Expanded Security Maintenance for Applications esm-infra yes enabled Expanded Security Maintenance for Infrastructure fips yes n/a NIST-certified FIPS crypto packages fips-preview yes n/a Preview of FIPS crypto packages undergoing certification with NIST fips-updates yes disabled FIPS compliant crypto packages with stable security updates landscape yes disabled Management and administration tool for Ubuntu livepatch yes n/a Canonical Livepatch service realtime-kernel yes disabled Ubuntu kernel with PREEMPT_RT patches integrated ├ generic yes disabled Generic version of the RT kernel (default) ├ intel-iotg yes n/a RT kernel optimized for Intel IOTG platform └ raspi yes disabled 24.04 Real-time kernel optimised for Raspberry Pi usg yes disabled Security compliance and audit tools ``` - If you see `fips`, `fips-updates`, and `fips-preview` in the list, the instance is entitled to install the FIPS packages. > **Tip** > > Canonical provides multiple FIPS services. For most deployments, use `fips-updates` rather than the static `fips` service because it provides FIPS-compliant cryptographic packages together with stable security updates. 7. Enable FIPS: ``` pro enable fips-updates ``` 8. When prompted to continue, enter `y`. - Example output: ``` One moment, checking your subscription first This will install the FIPS packages including security updates. Warning: This action can take some time and cannot be undone. Are you sure? (y/N) y Configuring APT access to FIPS Updates Updating FIPS Updates package lists This will downgrade the kernel from 6.17.0 to 6.8.0-1060.63+fips1. Warning: Downgrading the kernel may cause hardware failures. Please ensure the hardware is compatible with the new kernel version before proceeding. Are you sure? (y/N) y Updating standard Ubuntu package lists Installing FIPS Updates packages Installing openssh-client openssh-server openssh-sftp-server FIPS Updates enabled A reboot is required to complete install. ``` - This installs the FIPS kernel and validated cryptographic components and configures the system to boot with the `fips=1` kernel flag. - The packages can include FIPS-enabled versions of OpenSSL, OpenSSH, libgcrypt, and Linux kernel cryptographic components. > **Important** > > Enabling `fips-updates` may replace or downgrade the current kernel with a FIPS-certified kernel. Review any hardware-compatibility warnings before continuing. 9. Reboot the instance: ``` reboot ``` 10. Wait for the system to restart. 11. Reconnect to the console. 12. Continue to [FIPS Verify FIPS mode on Ubuntu](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#verify-fips-mode-on-ubuntu). ### Attach Ubuntu Pro and enable FIPS A standard Ubuntu image doesn’t include an Ubuntu Pro subscription by default. Attach Ubuntu Pro before enabling FIPS. 1. Connect to the console and get root privileges. 2. Check the Ubuntu Pro status: ``` pro status ``` - Example output: ``` This machine is not attached to an Ubuntu Pro subscription. ``` - This means the system isn't attached. 3. Obtain your Ubuntu Pro token from your [Ubuntu Pro account](https://ubuntu.com/pro/subscribe). 4. Add the Ubuntu Pro subscription: ``` pro attach --no-auto-enable ``` Replace `` with your subscription token. 5. Confirm FIPS entitlement: ``` pro status --all ``` 6. Confirm that the following services appear: `fips`, `fips-preview`, `fips-updates`. - Example output: ``` SERVICE ENTITLED STATUS DESCRIPTION fips yes n/a NIST-certified FIPS crypto packages fips-preview yes n/a Preview of FIPS crypto packages undergoing certification with NIST fips-updates yes disabled FIPS compliant crypto packages with stable security updates ``` 7. Run `fips-updates` to install FIPS-compliant packages while retaining stable security settings: ``` pro enable fips-updates ``` 8. Enter `y` when prompted. 9. Review any kernel replacement or compatibility warnings. 10. Allow the installation to complete. - The process installs the FIPS kernel and configures the `fips=1` kernel flag. 11. Reboot the instance: ``` reboot ``` 12. Wait for the system to restart. 13. Reconnect to the console. 14. Continue to [FIPS Verify FIPS mode on Ubuntu](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#verify-fips-mode-on-ubuntu). ### Enable FIPS on RHEL RHEL doesn’t require a special Marketplace image. Deploy a standard RHEL image, then use the procedure for your installed version. #### RHEL 8 and RHEL 9 1. Deploy a supported RHEL 8 or RHEL 9 instance. 2. Connect to the console and get root privileges. 3. Enable FIPS: ``` fips-mode-setup --enable ``` 4. Allow the command to complete. 5. Reboot the instance: ``` reboot ``` 6. Wait for the system to restart. 7. Reconnect to the console. 8. Continue to [FIPS Verify FIPS mode on RHEL](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#verify-fips-mode-on-rhel). #### RHEL 10 RHEL 10 uses a different procedure to configure the `fips=1` kernel flag and FIPS initramfs components. 1. Deploy a supported RHEL 10 instance. 2. Connect to the console and get root privileges. 3. Add the `fips=1` kernel argument, install the FIPS dracut packages, and regenerate the initramfs: ``` grubby --update-kernel=ALL --args="fips=1" dnf install dracut-fips dracut-fips-aesni -y dracut -f ``` 4. Reboot the instance: ``` reboot ``` 5. Wait for the system to restart. 6. Reconnect to the console. 7. Continue to [FIPS Verify FIPS mode on RHEL](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#verify-fips-mode-on-rhel). ## Step 3: Verify FIPS mode ### Verify FIPS mode on Ubuntu Use the following checks after rebooting the Ubuntu instance. 1. Verify Ubuntu Pro reports FIPS enabled: ``` pro status ``` - Example output: ``` SERVICE ENTITLED STATUS DESCRIPTION anbox-cloud yes disabled Scalable Android in the cloud esm-apps yes enabled Expanded Security Maintenance for Applications esm-infra yes enabled Expanded Security Maintenance for Infrastructure fips-updates yes enabled FIPS compliant crypto packages with stable security updates landscape yes disabled Management and administration tool for Ubuntu realtime-kernel* yes disabled Ubuntu kernel with PREEMPT_RT patches integrated usg yes disabled Security compliance and audit tools ``` - Confirm that `fips-updates` is `enabled`. 2. Verify the kernel FIPS state: ``` cat /proc/sys/crypto/fips_enabled ``` - Example output: ``` 1 ``` - A value of `1` means FIPS mode is active. A value of `0`, or a missing `/proc/sys/crypto/fips_enabled` file, means FIPS mode isn't active. 3. Verify the FIPS kernel: ``` uname -r ``` - Example output: ``` 6.8.0-1060-aws-fips ``` - Confirm that the kernel version contains `fips`. 4. Verify the OpenSSL FIPS provider (on Ubuntu releases using OpenSSL 3.x): ``` openssl list -providers ``` - Example output: ``` Providers: base name: OpenSSL Base Provider version: 3.0.13 status: active fips name: Ubuntu 24.04 OpenSSL Cryptographic Module version: 3.0.13-0ubuntu3.6+Fips1 status: active ``` - Confirm that the FIPS provider reports `status: active` **Expected result:** Ubuntu is running the FIPS kernel, FIPS cryptographic packages are active, and the system reports FIPS mode enabled. Continue to [FIPS Verify Access Server after enabling FIPS](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#step-4--verify-access-server-after-enabling-fips). ### Verify FIPS mode on RHEL Use the following checks after rebooting the RHEL instance. 1. Verify the kernel FIPS state: ``` cat /proc/sys/crypto/fips_enabled ``` - Example output: ``` 1 ``` - A value of `1` means FIPS mode is active. A value of `0`, or a missing file, means FIPS mode isn't active. 2. Check the FIPS configuration (for RHEL versions that provide `fips-mode-setup`): ``` fips-mode-setup --check ``` - Expected output: ``` FIPS mode is enabled. ``` 3. Check the system crypto policy: ``` update-crypto-policies --show ``` - Expected output: ``` FIPS ``` 4. Verify the OpenSSL FIPS provider (on RHEL releases using OpenSSL 3.x): ``` openssl list -providers ``` - Example output: ``` Providers: base name: OpenSSL Base Provider version: 3.5.5 status: active default name: OpenSSL Default Provider version: 3.5.5 status: active fips name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider version: 3.0.7-395c1a240fbfffd8 status: active ``` - Confirms that the FIPS provider reports `status: active`. **Expected result:** RHEL is running with FIPS enforcement enabled and the operating-system cryptographic policy is set to FIPS. Continue to [FIPS Verify Access Server after enabling FIPS](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel/#step-4--verify-access-server-after-enabling-fips). ## Step 4: Verify Access Server after enabling FIPS After confirming that the operating system is running in FIPS mode, verify that Access Server starts and that your required functionality still works with the restricted cryptographic environment. 1. Confirm that Access Server is running. 2. Sign in to the Admin Web UI. 3. Confirm that the Client Web UI loads successfully. 4. Connect with a supported VPN client. 5. Verify that authentication succeeds. 6. Verify access to the required private resources. 7. Test any integrations that depend on: - TLS. - SSH. - External authentication. - Certificates. - Cryptographic keys. 8. Review Access Server and system logs for cryptographic algorithm or compatibility errors. If an integration fails after enabling FIPS, determine whether it depends on an algorithm or key type that the operating system no longer permits. ## See also - [FIPS Compliance reference](https://openvpn.net/as-docs/v3/fips-compliance.md) - [Security & Certificates tutorials](https://openvpn.net/as-docs/v3/tutorials/security---certificates.md) - [Tutorial: Install a Let's Encrypt Wildcard SSL Certificate on Access Server with Certbot](https://openvpn.net/as-docs/v3/tutorials/tutorial--lets-encrypt-ssl-certificate-access-server.md) - [Zero Trust Network Access](https://openvpn.net/use-cases/zero-trust-network-access/) --- Prev: [Tutorial: Restrict Public Access to the Admin Web UI](https://openvpn.net/as-docs/v3/tutorials/tutorial--restrict-admin-web-ui-access.md) Next: [Tutorial: Set Up an IP Allowlist Using Access Server's Split Tunneling Functionality for Enhanced SaaS Security](https://openvpn.net/as-docs/v3/tutorials/tutorial--saas-allowlist-security-with-split-tunneling.md) Index: https://openvpn.net/as-docs/llms.txt