Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server
Overview
Federal Information Processing Standards FIPS 140-2/140-3 define security requirements for cryptographic modules used to protect sensitive information.
Access Server can run on operating systems that provide cryptographic modules validated through the NIST Cryptographic Module Validation Program (CMVP). Running the operating system in FIPS mode generally requires both:
Vendor-provided, NIST-validated cryptographic packages.
A FIPS-enabled kernel configuration that restricts the system to approved cryptographic algorithms.
This tutorial shows you how to enable and verify FIPS mode for Access Server deployments running on:
Ubuntu with Ubuntu Pro FIPS.
Ubuntu Pro with FIPS enabled manually.
Standard Ubuntu with an attached Ubuntu Pro subscription.
RHEL 8.
RHEL 9.
RHEL 10.
For background on how Access Server uses FIPS-validated cryptographic libraries, refer to the FIPS Compliance reference.
A properly configured operating system is one part of deploying a FIPS-compliant VPN. FIPS-compliant deployments are also commonly used in regulated environments implementing Zero Trust Network Access.
Prerequisites
Before you begin, ensure you have:
Console access and the ability to get root access.
For Ubuntu, an Ubuntu Pro subscription or an Ubuntu Pro FIPS image.
For RHEL, a standard Red Hat Enterprise Linux subscription.
Out-of-band or serial console access if the system doesn't boot after the FIPS kernel is installed.
Choose the option that matches your operating system and starting configuration.
Ubuntu Pro FIPS
Use an Ubuntu Pro FIPS image when one is available for your Ubuntu release, AWS region, and architecture.
The AWS Marketplace image includes the Ubuntu Pro subscription and has FIPS enabled as part of the image.
Continue to FIPS Deploy Ubuntu Pro FIPS
Ubuntu Pro
Use a standard Ubuntu Pro image when:
An Ubuntu Pro FIPS image isn't available.
You already use an Ubuntu Pro Marketplace image.
You want to enable FIPS manually.
The Ubuntu Pro subscription is included with the Marketplace image, but FIPS isn’t enabled by default.
Continue to FIPS Enable FIPS on Ubuntu Pro.
Standard Ubuntu
Use a standard Ubuntu image when neither Ubuntu Pro FIPS nor Ubuntu Pro is available or appropriate for your deployment.
You must first attach an Ubuntu Pro subscription, then enable FIPS.
Continue to FIPS Attach Ubuntu Pro and enable FIPS.
RHEL 8, RHEL 9, or RHEL 10
Use a standard RHEL image. RHEL doesn’t require a special FIPS image, but the enablement procedure differs by version.
Continue to FIPS Enable FIPS on RHEL.
Deploy Ubuntu Pro FIPS
AWS Marketplace provides Ubuntu Pro FIPS images with FIPS support already enabled.
Open AWS Marketplace.
Search for Ubuntu Pro FIPS.
Select the image for your required Ubuntu version. For example:
Ubuntu Pro FIPS 22.04 LTS.Launch the instance.
Connect to the instance after it starts and get root privileges.
Continue to FIPS Verify FIPS mode on Ubuntu.
Enable FIPS on Ubuntu Pro
Use this procedure when you deploy an Ubuntu Pro image that doesn’t already have FIPS enabled.
Open AWS Marketplace.
Search for Ubuntu Pro.
Select the image for your required Ubuntu version. For example:
Ubuntu Pro 24.04 LTS.Launch the instance.
Connect to the instance after it starts and get root privileges.
Confirm that the subscription is attached and that FIPS services are available:
pro status --allExample output:
SERVICE ENTITLED STATUS DESCRIPTION anbox-cloud yes disabled Scalable Android in the cloud cc-eal yes n/a Common Criteria EAL2 Provisioning Packages esm-apps yes enabled Expanded Security Maintenance for Applications esm-infra yes enabled Expanded Security Maintenance for Infrastructure fips yes n/a NIST-certified FIPS crypto packages fips-preview yes n/a Preview of FIPS crypto packages undergoing certification with NIST fips-updates yes disabled FIPS compliant crypto packages with stable security updates landscape yes disabled Management and administration tool for Ubuntu livepatch yes n/a Canonical Livepatch service realtime-kernel yes disabled Ubuntu kernel with PREEMPT_RT patches integrated ├ generic yes disabled Generic version of the RT kernel (default) ├ intel-iotg yes n/a RT kernel optimized for Intel IOTG platform └ raspi yes disabled 24.04 Real-time kernel optimised for Raspberry Pi usg yes disabled Security compliance and audit toolsIf you see
fips,fips-updates, andfips-previewin the list, the instance is entitled to install the FIPS packages.
Enable FIPS:
pro enable fips-updatesWhen prompted to continue, enter
y.Example output:
One moment, checking your subscription first This will install the FIPS packages including security updates. Warning: This action can take some time and cannot be undone. Are you sure? (y/N) y Configuring APT access to FIPS Updates Updating FIPS Updates package lists This will downgrade the kernel from 6.17.0 to 6.8.0-1060.63+fips1. Warning: Downgrading the kernel may cause hardware failures. Please ensure the hardware is compatible with the new kernel version before proceeding. Are you sure? (y/N) y Updating standard Ubuntu package lists Installing FIPS Updates packages Installing openssh-client openssh-server openssh-sftp-server FIPS Updates enabled A reboot is required to complete install.This installs the FIPS kernel and validated cryptographic components and configures the system to boot with the
fips=1kernel flag.The packages can include FIPS-enabled versions of OpenSSL, OpenSSH, libgcrypt, and Linux kernel cryptographic components.
Reboot the instance:
rebootWait for the system to restart.
Reconnect to the console.
Continue to FIPS Verify FIPS mode on Ubuntu.
Attach Ubuntu Pro and enable FIPS
A standard Ubuntu image doesn’t include an Ubuntu Pro subscription by default. Attach Ubuntu Pro before enabling FIPS.
Connect to the console and get root privileges.
Check the Ubuntu Pro status:
pro statusExample output:
This machine is not attached to an Ubuntu Pro subscription.This means the system isn't attached.
Obtain your Ubuntu Pro token from your Ubuntu Pro account.
Add the Ubuntu Pro subscription:
pro attach <your_pro_token> --no-auto-enableReplace
<your_pro_token>with your subscription token.
Confirm FIPS entitlement:
pro status --allConfirm that the following services appear:
fips,fips-preview,fips-updates.Example output:
SERVICE ENTITLED STATUS DESCRIPTION fips yes n/a NIST-certified FIPS crypto packages fips-preview yes n/a Preview of FIPS crypto packages undergoing certification with NIST fips-updates yes disabled FIPS compliant crypto packages with stable security updates
Run
fips-updatesto install FIPS-compliant packages while retaining stable security settings:pro enable fips-updatesEnter
ywhen prompted.Review any kernel replacement or compatibility warnings.
Allow the installation to complete.
The process installs the FIPS kernel and configures the
fips=1kernel flag.
Reboot the instance:
rebootWait for the system to restart.
Reconnect to the console.
Continue to FIPS Verify FIPS mode on Ubuntu.
Enable FIPS on RHEL
RHEL doesn’t require a special Marketplace image. Deploy a standard RHEL image, then use the procedure for your installed version.
RHEL 8 and RHEL 9
Deploy a supported RHEL 8 or RHEL 9 instance.
Connect to the console and get root privileges.
Enable FIPS:
fips-mode-setup --enableAllow the command to complete.
Reboot the instance:
rebootWait for the system to restart.
Reconnect to the console.
Continue to FIPS Verify FIPS mode on RHEL.
RHEL 10
RHEL 10 uses a different procedure to configure the fips=1 kernel flag and FIPS initramfs components.
Deploy a supported RHEL 10 instance.
Connect to the console and get root privileges.
Add the
fips=1kernel argument, install the FIPS dracut packages, and regenerate the initramfs:grubby --update-kernel=ALL --args="fips=1" dnf install dracut-fips dracut-fips-aesni -y dracut -fReboot the instance:
rebootWait for the system to restart.
Reconnect to the console.
Continue to FIPS Verify FIPS mode on RHEL.
Verify FIPS mode on Ubuntu
Use the following checks after rebooting the Ubuntu instance.
Verify Ubuntu Pro reports FIPS enabled:
pro statusExample output:
SERVICE ENTITLED STATUS DESCRIPTION anbox-cloud yes disabled Scalable Android in the cloud esm-apps yes enabled Expanded Security Maintenance for Applications esm-infra yes enabled Expanded Security Maintenance for Infrastructure fips-updates yes enabled FIPS compliant crypto packages with stable security updates landscape yes disabled Management and administration tool for Ubuntu realtime-kernel* yes disabled Ubuntu kernel with PREEMPT_RT patches integrated usg yes disabled Security compliance and audit toolsConfirm that
fips-updatesisenabled.
Verify the kernel FIPS state:
cat /proc/sys/crypto/fips_enabledExample output:
1A value of
1means FIPS mode is active. A value of0, or a missing/proc/sys/crypto/fips_enabledfile, means FIPS mode isn't active.
Verify the FIPS kernel:
uname -rExample output:
6.8.0-1060-aws-fipsConfirm that the kernel version contains
fips.
Verify the OpenSSL FIPS provider (on Ubuntu releases using OpenSSL 3.x):
openssl list -providersExample output:
Providers: base name: OpenSSL Base Provider version: 3.0.13 status: active fips name: Ubuntu 24.04 OpenSSL Cryptographic Module version: 3.0.13-0ubuntu3.6+Fips1 status: activeConfirm that the FIPS provider reports
status: active
Expected result: Ubuntu is running the FIPS kernel, FIPS cryptographic packages are active, and the system reports FIPS mode enabled.
Continue to FIPS Verify Access Server after enabling FIPS.
Verify FIPS mode on RHEL
Use the following checks after rebooting the RHEL instance.
Verify the kernel FIPS state:
cat /proc/sys/crypto/fips_enabledExample output:
1A value of
1means FIPS mode is active. A value of0, or a missing file, means FIPS mode isn't active.
Check the FIPS configuration (for RHEL versions that provide
fips-mode-setup):fips-mode-setup --checkExpected output:
FIPS mode is enabled.
Check the system crypto policy:
update-crypto-policies --showExpected output:
FIPS
Verify the OpenSSL FIPS provider (on RHEL releases using OpenSSL 3.x):
openssl list -providersExample output:
Providers: base name: OpenSSL Base Provider version: 3.5.5 status: active default name: OpenSSL Default Provider version: 3.5.5 status: active fips name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider version: 3.0.7-395c1a240fbfffd8 status: activeConfirms that the FIPS provider reports
status: active.
Expected result: RHEL is running with FIPS enforcement enabled and the operating-system cryptographic policy is set to FIPS.
Continue to FIPS Verify Access Server after enabling FIPS.
After confirming that the operating system is running in FIPS mode, verify that Access Server starts and that your required functionality still works with the restricted cryptographic environment.
Confirm that Access Server is running.
Sign in to the Admin Web UI.
Confirm that the Client Web UI loads successfully.
Connect with a supported VPN client.
Verify that authentication succeeds.
Verify access to the required private resources.
Test any integrations that depend on:
TLS.
SSH.
External authentication.
Certificates.
Cryptographic keys.
Review Access Server and system logs for cryptographic algorithm or compatibility errors.
If an integration fails after enabling FIPS, determine whether it depends on an algorithm or key type that the operating system no longer permits.