Appendix B. Provisioning FIPS-Compliant Hosts

To provision FIPS-compliant hosts, you must first set the password hashing algorithm that you use in provisioning to SHA256. This configuration setting must be applied for each operating system you want to deploy as FIPS-compliant.

To provision a FIPS-compliant host, you must create a host group and set the host group parameter fips_enabled to true. If this is not set to true, or is absent, the FIPS-specific changes do not apply to the system. You can set this parameter when you provision a host or for a host group.

To set this parameter when provisioning a host, append --parameters fips_enabled=true to the Hammer command.

hammer hostgroup set-parameter --name fips_enabled \
 --value 'true' \
 --hostgroup prod_servers

$ hammer hostgroup set-parameter --name fips_enabled \
 --value 'true' \
 --hostgroup prod_servers

For more information, see the output of the command hammer hostgroup set-parameter --help.

To verify these FIPS compliance changes have been successful, you must provision a host and check its configuration.