Enable FIPS Mode on AL2
This section explains how to enable Federal Information Processing Standards (FIPS) on AL2. For more information about FIPS, see:
Prerequisites
-
An existing AL2 Amazon EC2 instance with access to the internet to download required packages. For more information about launching an AL2 Amazon EC2 instance, see AL2 on Amazon EC2.
-
You must connect to your Amazon EC2 instance using SSH or Amazon Systems Manager. .
Important
ED25519 SSH user keys aren't supported in FIPS mode. If you launched your Amazon EC2 instance using an ED25519 SSH key pair, you must generate new keys using another algorithm (such as RSA) or you may lose access to your instance after enabling FIPS mode. For more information see Create key pairs in the Amazon EC2 User Guide.
Enable FIPS Mode
-
Connect to your AL2 instance using SSH or Amazon Systems Manager.
-
Ensure the system is up to date. For more information, see Package repository.
-
Install and enable the
dracut-fips
module by running the following commmands.sudo yum -y install dracut-fips sudo dracut -f
-
Enable FIPS mode on the Linux kernel command-line using the following command.
sudo /sbin/grubby --update-kernel=ALL --args="fips=1"
-
Reboot your AL2 instance.
sudo reboot
-
To verify that FIPS mode is enabled, reconnect to your instance and run the following command.
sysctl crypto.fips_enabled
You should see the following output:
crypto.fips_enabled = 1
You can also verify that OpenSSH is in FIPS mode by running the following command:
ssh localhost 2>&1 | grep FIPS
You should see the following output:
FIPS mode initialized