I want to encrypt my swap, root, and home with FIPS compliant encryption on CentOS.
According to the below RedHat link, I should be able to 'add the fips=1 kernel option to the kernel command line during system installation'. I tried to do this with LUKS encryption enabled in the install menu and when I do this, the system will not boot. And since my
/boot is a different partition, I tried adding
boot=<partition of boot> to the kernel as well, which also stopped the system from booting.
The expected behavior is that upon first boot that there would be a compliant encryption over the entire drive and fips enabled. Do I need to have dracut-fips installed before the first boot, so I can regenerate initramfs? Or any other steps?
The other guides and solutions mention installing the OS, enabling fips, and then encrypting the filesystem, but I do not believe I can do this and encrypt the entire drive.
Is there a way that I can change the LUKS setting to use a fips compliant algorithm and then enable fips after installation when the drive is encrypted? Or is there a way to install, enable fips, and the encrypt the entire drive while maintaining the fips setting?
I am a daily user of linux but by no means an expert. Any help is very much appreciated. FIPS compliance is currently a business requirement, and we do not need to be FIPS certified.