Chapter 9. Enabling FIPS mode with RHEL image builder

Procedure

1. Create a plain text file in the Tom’s Obvious, Minimal Language (TOML) format with the following content:

   name = "system-fips-mode-enabled"
   description = "blueprint with FIPS enabled "
   version = "0.0.1"
   
   [customizations]
   fips = true
   
   [[customizations.user]]
   name = "admin"
   password = "admin"
   groups = ["users", "wheel"]

   Copy to Clipboard Toggle word wrap

2. Import the blueprint to the RHEL image builder server:

   # composer-cli blueprints push <blueprint-name>.toml

   Copy to Clipboard Toggle word wrap

3. List the existing blueprints to check whether the created blueprint is successfully imported and exists:

   # composer-cli blueprints show <blueprint-name>

   Copy to Clipboard Toggle word wrap

4. Check whether the components and versions listed in the blueprint and their dependencies are valid:

   # composer-cli blueprints depsolve <blueprint-name>

   Copy to Clipboard Toggle word wrap

5. Build the customized RHEL image:

   # composer-cli compose start \ <blueprint-name> \ <image-type> \

   Copy to Clipboard Toggle word wrap

6. Review the image status:

   # composer-cli compose status
   …
   $ <UUID> FINISHED <date> <blueprint-name> <blueprint-version> <image-type>
   …

   Copy to Clipboard Toggle word wrap

7. Download the image:

   # composer-cli compose image <UUID>

   Copy to Clipboard Toggle word wrap

   RHEL image builder downloads the image to the current directory path. The UUID number and the image size are displayed alongside:

   $ <UUID-image-name.type>: <size> MB

   Copy to Clipboard Toggle word wrap

Verification

1. Log in to the system image with the username and password that you configured in your blueprint.

2. Check if FIPS mode is enabled:

   $ fips-mode-setup --check
   FIPS mode is enabled.

   Copy to Clipboard Toggle word wrap