How to enable FIPS (Federal Information Processing Standards) on Site Recovery Manager Appliance 8.4

Products

VMware Live Recovery

Issue/Introduction

This article summarizes the necessary tasks that must be done in order for Site Recovery Manager product to support running in FIPS mode. Please note this process is only supported on the SRM Appliance.

Note: This article is for Site Recovery Manager 8.4/8.3. For Site Recovery Manager 8.5, please see: https://kb.vmware.com/s/article/88013

Environment

VMware Site Recovery Manager 8.4.x
VMware Site Recovery Manager 8.3.x

Resolution

Enable FIPS mode manually in the Site Recovery Manager appliance

Three(3) configuration files need to be edited
1. /opt/vmware/srm/conf/drconfig.xml
2. /opt/vmware/srm/conf/vmware-dr.template.xml
3. /opt/vmware/srm/conf/vmware-dr.xml (Optional) If the appliance is configured.

Edit the three(3) configuration files in step 1 for the Site Recovery Manager services and add the following tag:

<Config>
    <vmacore>
        <ssl>
            <fips>true</fips>
        </ssl>
    </vmacore>
</Config>

As root user edit the kernel cmdline
1. Open /boot/grub/grub.cfg.
2. Locate the menuentry entry.
3. In each menuentry append at the end of the line that starts with linux.
  - fips=1
4. Save the file.

Start UI in strict mode:

Edit /usr/lib/systemd/system/dr-client.service - comment out the existing Environment='CATALINA_OPTS=-Xms768m -Xmx1024m' and uncomment the one under # Uncomment to enable FIPS. The file fragment should look like this:

#Environment='CATALINA_OPTS=-Xms768m -Xmx1024m'
# Uncomment to enable FIPS
Environment='CATALINA_OPTS=-Xms768m -Xmx1024m -Djava.security.properties==/opt/vmware/dr-client/conf/vmware-override-java.security -Djava.ext.dirs=/opt/vmware/dr-client/lib/ext -Dorg.bouncycastle.jca.enable_jks=true -Dorg.bouncycastle.fips.approved_only=true'

Uncomment the <Manager> tag in /opt/vmware/dr-client/conf/context.xml - the file fragment with the tag should look like this:
```

<Manager pathname="" secureRandomAlgorithm=""/>
```
Edit /opt/vmware/dr-client/lib/h5dr.properties and modify keyStoreName to point to BCFKS format keystore which contains root CA certificates. The property should look like this:
```
keyStoreName=h5dr.keystore.bks
```

Choose java truststore - this is the store which contains root CA certificates. Link to the choosen truststore must be added to /opt/vmware/dr-client/lib/ or /opt/vmware/dr-client/webapps/dr/WEB-INF/classes/.

$JAVA_HOME/bin/keytool -importkeystore -srckeystore <path-to-jks-keystore> -srcstoretype JKS -srcstorepass <keystorepass> -destkeystore <path-to-target-bks-keystore> -deststoretype BCFKS -deststorepass <keystorepass> -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath /opt/vmware/dr-client/lib/ext/bc-fips-1.0.2.jar

NOTE: the keystore file you use should have Others: Read permission

Start Config UI in strict mode:

Edit /usr/lib/systemd/system/drconfigui.service - comment out the existing Environment='CATALINA_OPTS=-Xms768m -Xmx1024m' and uncomment the one under # Uncomment to enable FIPS. The file fragment should look like this:

#Environment='CATALINA_OPTS=-Xms768m -Xmx1024m'
# Uncomment to enable FIPS
Environment='CATALINA_OPTS=-Xms768m -Xmx1024m -Djava.security.properties==/opt/vmware/drconfigui/conf/vmware-override-java.security -Djava.ext.dirs=/opt/vmware/drconfigui/lib/ext -Dorg.bouncycastle.jca.enable_jks=true -Dorg.bouncycastle.fips.approved_only=true'

Uncomment the <Manager> tag in /opt/vmware/drconfigui/conf/context.xml - the file fragment with the tag should look like this:
```

<Manager pathname="" secureRandomAlgorithm=""/>
```

Reboot the appliance.

Note: SSHD will read that the kernel has enabled FIPS mode and will activate it too. No need to edit anything in the sshd configuration.

Validate FIPS mode is enabled

Validate the kernel commandline.
- cat /proc/cmdline
Validate that kernel has enabled FIPS mode.
- cat /proc/sys/crypto/fips_enabled
Validate that SSHD has enabled FIPS mode.
- journalctl -u sshd -b 0 | grep "FIPS"
Validate that dr-configurator has enabled Fips mode.
- journalctl -u dr-configurator -b 0 | grep "FIPS"
Validate that vmware-dr has enabled FIPS mode.
- journalctl -u srm-server -b 0 | grep "FIPS"