7.0 Configuring JRE for FIPS

To configure the JRE for BCFIPS approved-only mode:

1. Add the BCFIPS.jar files to the Java classpath.

   The required BCFIPS files are as follows:

   • bc-fips-1.0.2.5.jar

   • bcpkix-fips-1.0.7.jar

   • bctls-fips-1.0.19.jar

   NOTE:You can download the above mentioned jars from the following maven repositories:

   • bc-fips

   • bcpkix-fips

   • bctls-fips

2. Modify the java.security file in the <jre-root>/conf/security directory and set a BCFIPS-defined Java system property.

   In a text editor, open the above file for the JRE that is hosting the web container at <jre-root>/conf/security/java.security. Find the list of security providers, comment on all the existing providers, and replace the entries with the following:

   • security.provider.1=BCFIPS

   • security.provider.2=BCJSSE

   • security.provider.3=SunJSSE

   • security.provider.4=SUN

   • security.provider.5=SunJCE

   The SunJSSE provider (Java 11) is required because OSP requires specific TrustManager implementations when initializing its truststores. In addition to the changes to the security providers, the BCFIPS JSSE KeyManager implementation must be used. This is necessary mostly because deficiencies in the Sun implementation does not allow certain FIPS-required determinations about keys to be made. It is accomplished by replacing the following line in java.security:

   with

   ssl.KeyManagerFactory.algorithm=SunX509

   ssl.KeyManagerFactory.algorithm=PKIX

   It is also better to disable older SSL and TLS algorithms. This is because the algorithms required for SSL/TLS versions before TLS v2.0 are not available in BCFIPS approved mode. To disable the older algorithms, locate the jdk.tls.disabledAlgorithms entry. For example,

   jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC

   Add TLSv1, TLSv1.1, TLSv1.2 to the list:

   jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, TLSv1.2, RC4, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC

   Disabling TLSv1 and TLSv1.1 is optional, however it prevents cryptic error messages when OSP attempts to securely connect with services such as, LDAP that only support TLS v1.1 or earlier. The error messages that appear when the earlier TLS versions are disabled are more understandable and directly indicate the problem.

3. To enable permissions for the above.jar files, run the following commands:

   chown novlua:novlua <jar-file>

   chmod 755 <jar-file>

4. To set the environment variable, run the following commands:

   export IS_FIPS_ENABLED=true

   export BC_FIPS_VERSION=1.0.2.5

   export JAVA_OPTS=" -Dorg.bouncycastle.fips.approved_only=true  -Dorg.bouncycastle.rsa.allow_multi_use=true"

   export CLASSPATH=/opt/netiq/common/jre/lib/bc-fips-1.0.2.5.jar

   After setting up, you can verify all the environment variables using the echo command.

   NOTE:To access dxcmd on port 636, enable SSL EC Certificate in the LDAP settings.

5. Navigate to the /opt/netiq/common/jre/lib/security/directory.

6. Take a backup of the cacerts file.

7. To support security enhancement, convert the cacerts file to bcfks using the following command:

   keytool -importkeystore -srckeystore cacerts -srcstorepass novell -srcstoretype JKS -destkeystore cacerts -deststorepass changeit -deststoretype BCFKS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH