3.8. Implementação de uma VPN IPsec compatível com FIPS

Procedimento

1. Instale os pacotes libreswan:

   # yum install libreswan

2. Se você estiver reinstalando Libreswan, remova seu antigo banco de dados NSS:

   # systemctl stop ipsec
   # rm /etc/ipsec.d/*db

3. Iniciar o serviço ipsec, e permitir que o serviço seja iniciado automaticamente na inicialização:

   # systemctl enable ipsec --now

4. Configure o firewall para permitir portas 500 e 4500/UDP para os protocolos IKE, ESP, e AH adicionando o serviço ipsec:

   # firewall-cmd --add-service="ipsec"
   # firewall-cmd --runtime-to-permanent

5. Mude o sistema para o modo FIPS no RHEL 8:

   # fips-mode-setup --enable

6. Reinicie seu sistema para permitir que o kernel mude para o modo FIPS:

   # reboot

Etapas de verificação

1. Para confirmar que Libreswan está funcionando no modo FIPS:

   # ipsec whack --fipsstatus
   000 FIPS mode enabled

2. Alternativamente, verifique as entradas para a unidade ipsec na revista systemd:

   $ journalctl -u ipsec
   ...
   Jan 22 11:26:50 localhost.localdomain pluto[3076]: FIPS Product: YES
   Jan 22 11:26:50 localhost.localdomain pluto[3076]: FIPS Kernel: YES
   Jan 22 11:26:50 localhost.localdomain pluto[3076]: FIPS Mode: YES

3. Para ver os algoritmos disponíveis no modo FIPS:

   # ipsec pluto --selftest 2>&1 | head -11
   FIPS Product: YES
   FIPS Kernel: YES
   FIPS Mode: YES
   NSS DB directory: sql:/etc/ipsec.d
   Initializing NSS
   Opening NSS database "sql:/etc/ipsec.d" read-only
   NSS initialized
   NSS crypto library initialized
   FIPS HMAC integrity support [enabled]
   FIPS mode enabled for pluto daemon
   NSS library is running in FIPS mode
   FIPS HMAC integrity verification self-test passed

4. Para consultar algoritmos desabilitados no modo FIPS:

   # ipsec pluto --selftest 2>&1 | grep disabled
   Encryption algorithm CAMELLIA_CTR disabled; not FIPS compliant
   Encryption algorithm CAMELLIA_CBC disabled; not FIPS compliant
   Encryption algorithm SERPENT_CBC disabled; not FIPS compliant
   Encryption algorithm TWOFISH_CBC disabled; not FIPS compliant
   Encryption algorithm TWOFISH_SSH disabled; not FIPS compliant
   Encryption algorithm NULL disabled; not FIPS compliant
   Encryption algorithm CHACHA20_POLY1305 disabled; not FIPS compliant
   Hash algorithm MD5 disabled; not FIPS compliant
   PRF algorithm HMAC_MD5 disabled; not FIPS compliant
   PRF algorithm AES_XCBC disabled; not FIPS compliant
   Integrity algorithm HMAC_MD5_96 disabled; not FIPS compliant
   Integrity algorithm HMAC_SHA2_256_TRUNCBUG disabled; not FIPS compliant
   Integrity algorithm AES_XCBC_96 disabled; not FIPS compliant
   DH algorithm MODP1024 disabled; not FIPS compliant
   DH algorithm MODP1536 disabled; not FIPS compliant
   DH algorithm DH31 disabled; not FIPS compliant

5. Para listar todos os algoritmos e cifras permitidas no modo FIPS:

   # ipsec pluto --selftest 2>&1 | grep ESP | grep FIPS | sed "s/^.*FIPS//"
   {256,192,*128}  aes_ccm, aes_ccm_c
   {256,192,*128}  aes_ccm_b
   {256,192,*128}  aes_ccm_a
   [*192]  3des
   {256,192,*128}  aes_gcm, aes_gcm_c
   {256,192,*128}  aes_gcm_b
   {256,192,*128}  aes_gcm_a
   {256,192,*128}  aesctr
   {256,192,*128}  aes
   {256,192,*128}  aes_gmac
   sha, sha1, sha1_96, hmac_sha1
   sha512, sha2_512, sha2_512_256, hmac_sha2_512
   sha384, sha2_384, sha2_384_192, hmac_sha2_384
   sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256
   aes_cmac
   null
   null, dh0
   dh14
   dh15
   dh16
   dh17
   dh18
   ecp_256, ecp256
   ecp_384, ecp384
   ecp_521, ecp521