Enable FIPS Mode on AL2

聚焦模式

Enable FIPS Mode on AL2 - Amazon Linux 2

此页面尚未翻译为您的语言。请求翻译

This section explains how to enable Federal Information Processing Standards (FIPS) on AL2. For more information about FIPS, see:

Prerequisites

An existing AL2 Amazon EC2 instance with access to the internet to download required packages. For more information about launching an AL2 Amazon EC2 instance, see AL2 on Amazon EC2.
You must connect to your Amazon EC2 instance using SSH or AWS Systems Manager. .

Important

ED25519 SSH user keys aren't supported in FIPS mode. If you launched your Amazon EC2 instance using an ED25519 SSH key pair, you must generate new keys using another algorithm (such as RSA) or you may lose access to your instance after enabling FIPS mode. For more information see Create key pairs in the Amazon EC2 User Guide.

Enable FIPS Mode

Connect to your AL2 instance using SSH or AWS Systems Manager.
Ensure the system is up to date. For more information, see Package repository.
Install and enable the dracut-fips module by running the following commmands.
```
sudo yum -y install dracut-fips
sudo dracut -f
```
Enable FIPS mode on the Linux kernel command-line using the following command. This will enable FIPS mode system-wide for the modules listed in the AL2 FAQ
```
sudo /sbin/grubby --update-kernel=ALL --args="fips=1"
```
Reboot your AL2 instance.
```
sudo reboot
```
To verify that FIPS mode is enabled, reconnect to your instance and run the following command.
```
sysctl crypto.fips_enabled
```
You should see the following output:
```
crypto.fips_enabled = 1
```
You can also verify that OpenSSH is in FIPS mode by running the following command:
```
ssh localhost 2>&1 | grep FIPS
```
You should see the following output:
```
FIPS mode initialized
```