Enable FIPS Mode on AL2 - Amazon Linux 2

Enable FIPS Mode on AL2

This section explains how to enable Federal Information Processing Standards (FIPS) on AL2. For more information about FIPS, see:

Prerequisites

  • An existing AL2 Amazon EC2 instance with access to the internet to download required packages. For more information about launching an AL2 Amazon EC2 instance, see AL2 on Amazon EC2.

  • You must connect to your Amazon EC2 instance using SSH or AWS Systems Manager. .

Important

ED25519 SSH user keys aren't supported in FIPS mode. If you launched your Amazon EC2 instance using an ED25519 SSH key pair, you must generate new keys using another algorithm (such as RSA) or you may lose access to your instance after enabling FIPS mode. For more information see Create key pairs in the Amazon EC2 User Guide.

Enable FIPS Mode

  1. Connect to your AL2 instance using SSH or AWS Systems Manager.

  2. Ensure the system is up to date. For more information, see Package repository.

  3. Install and enable the dracut-fips module by running the following commmands.

    sudo yum -y install dracut-fips
sudo dracut -f

  4. Enable FIPS mode on the Linux kernel command-line using the following command.

    sudo /sbin/grubby --update-kernel=ALL --args="fips=1"

  5. Reboot your AL2 instance.

    sudo reboot

  6. To verify that FIPS mode is enabled, reconnect to your instance and run the following command.

    sysctl crypto.fips_enabled

    You should see the following output:

    crypto.fips_enabled = 1

    You can also verify that OpenSSH is in FIPS mode by running the following command:

    ssh localhost 2>&1 | grep FIPS

    You should see the following output:

    FIPS mode initialized