Installing FIPS certified packages on SUSE Linux Enterprise Server 15 SP6 and SP7

ByLinux Admin

SUSE has certified and is currently certifying various cryptographic modules for FIPS 140-3 on SUSE Linux Enterprise Server 15 SP6.

Nearly all of those modules certified on SLES 15 SP6 can also be used on SLES 15 SP7, and for this purpose they are delivered to the SLES 15 SP7 Certifications Module.

The modules consists of the RPMs listed in below table (note, occasionally its multiple RPMs, all need to be installed at the specified version).

Module RPM(s) Notes
OpenSSL 3 libopenssl-3-fips-provider-3.1.4-150600.5.15.1 Only the FIPS provider needs to be fixed, the openssl 3.2 on SP7 can use the certified FIPS provider.
GnuTLS
  • libhogweed6-3.9.1-150600.3.2.1
  • libnettle8-3.9.1-150600.3.2.1
  • libgnutls30-3.8.3-150600.4.6.2
  
OpenSSL 1.1 libopenssl1_1-1.1.1w-150600.5.12.2  
libgcrypt libgcrypt20-1.10.3-150600.3.6.1  
Mozilla NSS
    libfreebl3-3.101.2-150400.3.54.1
  • libsoftokn3-3.101.2-150400.3.54.1
  
Kernel
  • kernel-default-6.4.0-150600.23.25.1
  • libkcapi-tools-0.13.0-150600.17.3.1
  • dracut-fips-059+suse.521.g8412a1c0-150600.1.3
 Not available for SP7.
Kernel RT
  • kernel-rt-6.4.0-150600.10.17.1
  • libkcapi-tools-0.13.0-150600.17.3.1
  • dracut-fips-059+suse.521.g8412a1c0-150600.1.3
 Not available for SP7. Needs SLE Realtime subscription.

To install them:

Read moreVisual Studio Code August 2020

Enable the Certifications Module via regular registration workflows (no separate subscription required, it is part of the SLES subscription)

This is only needed on SUSE Linux Enterprise Server 15 SP7. On SP6 they are in the regular Basesystem module.

Install the certified RPM(s):
zypper in -f RPMNAME-VERSION-RELEASE
example:
zypper in -f libopenssl-3-fips-provider-3.1.4-150600.5.15.1

Lock the RPM(s) to avoid future upgrades
zypper addlock RPMNAME
example:
zypper addlock libopenssl-3-fips-provider

Read moreHow Visual Studio Code leverages Azure Pipelines Artifact Caching Tasks to improve CI

Please note that on future updates the update stack will be report conflicts.

When given a conflict resolution choice, always select the option that has only “Do not install patch SUSE-SLE-Module-Basesystem-15-SP7-ID” entries.

Do not select options with “remove lock” or “downgrade” actions.

Also FIPS mode needs to be enabled according to the documentation. One way is to do as root:


zypper in crypto-policies-scripts
fips-mode-setup --enable
reboot

(Visited 1 times, 1 visits today)

Related Posts