This section provides information on specific operating systems to enable FIPS support which is available from Opsview Monitor 6.5.4.
While the rest of the Opsview system will correctly work on a FIPS-enabled server running Red Hat Enterprise Linux 8 (RHEL 8), the Opsview Reporting Module requires a Java Runtime configured to not run in FIPS mode due to the incompatibility with FIPS standards that the keystore algorithm (JCEKS) Jasperserver uses.
There are two workarounds to this issue:
- Install a new JRE for Opsview to run in a non-FIPS compliant mode. This will allow any other Java applications on the system to continue running in FIPS mode while allowing the Reporting Module to run.
- Configure the currently installed JRE on the Orchestrator machine to run in a non-FIPS compliant mode. This will have the side effect of allowing non-FIPS compliant Java applications on the system.
NoteIf there is no Java runtime located on the orchestrator machine, one of the workarounds must be performed so that the Reporting Module has a valid Java installation to use.
These instructions will need to be modified if a later version of the JRE is released.
Get the URL of the latest 1.8 OpenJDK release from Red Hat.
Download the OpenJDK tarball from the above site and transfer it to the Orchestrator host.
scp java-1.8.0-openjdk-<version>.portable.jre.el.x86_64.tar.xz orchestrator-hostname:/tmp/
Create the Opsview Java directory.
Extract the OpenJDK tarball in the newly created Java directory.
tar -xf /tmp/java-1.8.0-openjdk-<version>.portable.jre.el.x86_64.tar.xz -C /opt/opsview/java --strip 1
security.useSystemPropertiesFileto false in the new Java installation
sed -i.bk "s/^security.useSystemPropertiesFile=true/security.useSystemPropertiesFile=false/g" /opt/opsview/java/lib/security/java.security
check-deployplaybook to ensure that Java is now correctly configured. This playbook will additionally set up Python on all systems used.
NoteThis Java installation is currently not managed by Opsview in any way. This means that any security updates will have to be manually installed by rerunning the manual steps listed above.
Follow the instructions below to run in a FIPS non-compliant mode:
check-deployplaybook in Opsview Deploy. This will detect the Java runtime that the Jasper server will choose to use and raise an alarm if it is not configured as needed. This playbook will additionally set up Python on all systems used.
cd /opt/opsview/deploy/ ./bin/opsview-deploy ./lib/playbooks/check-deploy.yml
.... REQUIRED ACTION RECAP ******************************************************************** [HIGH -> rm-op-44104-rhel8-2-orch] Security flag is set to 'true' on system Java | A system Java Runtime (JRE) installation has been located at | /usr/lib/jvm/jre-1.8.0-openjdk, but the security flag 'security.useSystemPropertiesFile' | is currently set to 'true'. | | In order to use the Opsview Reporting module on RedHat 8 with FIPS mode enabled, | this flag must either be set to false or an alternative Java installation | installed for Opsview's usage. | | For more information and instructions, see: | https://knowledge.opsview.com/docs/
Edit the configuration file in the specified Java directory. The following
sedcommand creates a backup named
# In this example, the Java directory is '/usr/lib/jvm/jre-1.8.0-openjdk' as specified by the Deploy in the `REQUIRED ACTION RECAP` output cd /usr/lib/jvm/jre-1.8.0-openjdk/ sed -i.bk "s/^security.useSystemPropertiesFile=true/security.useSystemPropertiesFile=false/g" lib/security/java.security
check_deployplaybook following the first step above to ensure that Java is now correctly configured.
The default anonymous ciphers configured on the Orchestrator and used to communicate with opsview-agent on monitored devices need to be replaced with higher security ones in order for check_nrpe based checks to work in a RHEL8 FIPS environment. The easiest way to accomplish this is to replace the ciphers listed in the NRPE_CIPHERS global variable (Menu > Configuration > Advanced > Variables) with
AECDH-AES256-SHA:AECDH-AES128-SHA and run Apply Changes.
You must ensure that the
opsview-agent on the monitored hosts allows this new cipher configuration (see Opsview Agent Security for more details). They will work with opsview-agent version 6.0.0 and newer using the default configuration. This change is not necessary if you already use authenticated ciphers exclusively.
The need for this change is brought about by the tighter security standards enforced by RHEL8 FIPS (see Strong crypto defaults in RHEL 8 and deprecation of weak crypto algorithms - Red Hat Customer Portal). These new ciphers use Elliptic-Curve Cryptography (ECC) which provides enhanced security as well as improved performance.