付録B Provisioning FIPS-Compliant Hosts
Satellite supports provisioning hosts that comply with the National Institute of Standards and Technology’s Security Requirements for Cryptographic Modules standard, reference number FIPS 140-2, referred to here as FIPS.
To enable the provisioning of hosts that are FIPS-compliant, complete the following tasks:
- Change the provisioning password hashing algorithm for the operating system
- Create a host group and set a host group parameter to enable FIPS
For more information about creating host groups, see Creating a Host Group in the Managing Hosts guide.
The provisioned hosts have the FIPS-compliant settings applied. To confirm that these settings are enabled, complete the steps in 「Verifying FIPS Mode is Enabled」.
B.1. Change the Provisioning Password Hashing Algorithm リンクのコピーリンクがクリップボードにコピーされました!
To provision FIPS-compliant hosts, you must first set the password hashing algorithm that you use in provisioning to SHA256. This configuration setting must be applied for each operating system you want to deploy as FIPS-compliant.
Identify the Operating System IDs.
hammer os list
$ hammer os listCopy to Clipboard Copied! Toggle word wrap Toggle overflow Update each operating system’s password hash value.
hammer os update --title Operating_System \ --password-hash SHA256
$ hammer os update --title Operating_System \ --password-hash SHA256Copy to Clipboard Copied! Toggle word wrap Toggle overflow Repeat this command for each of the operating systems, using the matching value in the
TITLEcolumn:hammer os update --title "RedHat version_number" \ --password-hash SHA256
$ hammer os update --title "RedHat version_number" \ --password-hash SHA256Copy to Clipboard Copied! Toggle word wrap Toggle overflow Note that you cannot use a comma-separated list of values.