2

I want to encrypt my swap, root, and home with FIPS compliant encryption on CentOS.

According to the below RedHat link, I should be able to 'add the fips=1 kernel option to the kernel command line during system installation'. I tried to do this with LUKS encryption enabled in the install menu and when I do this, the system will not boot. And since my /boot is a different partition, I tried adding boot=<partition of boot> to the kernel as well, which also stopped the system from booting.

The expected behavior is that upon first boot that there would be a compliant encryption over the entire drive and fips enabled. Do I need to have dracut-fips installed before the first boot, so I can regenerate initramfs? Or any other steps?

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations

The other guides and solutions mention installing the OS, enabling fips, and then encrypting the filesystem, but I do not believe I can do this and encrypt the entire drive.

http://geekswing.com/geek/how-to-encrypt-a-filesystem-on-redhat-6-4centos-6-4-linux-fips-or-no-fips/

Is there a way that I can change the LUKS setting to use a fips compliant algorithm and then enable fips after installation when the drive is encrypted? Or is there a way to install, enable fips, and the encrypt the entire drive while maintaining the fips setting?

I am a daily user of linux but by no means an expert. Any help is very much appreciated. FIPS compliance is currently a business requirement, and we do not need to be FIPS certified.

  • 1
    According to the sources you provided, you can do exactly what you are asking. Please update your post with information concerning the exact part of the guide you linked are messing up. You have to boot into recovery mode using your installation media and complete additional steps to be able to boot as pointed out in the linked guide. – kemotep Mar 20 '18 at 15:39
  • @kemotep I am not sure why adding 'fips=1' and 'boot=<my boot partition>' to the kernel command line did not work. The expected behavior is that the encryption goes through and fips is enabled. Do I need to install dracut-fips before installation somehow? Any guide on other steps that I need to follow to enable FIPS on installation or some insight as to what I am messing up with the current steps would be very helpful. Thank you. – mark-shep Mar 20 '18 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.