FIPS Checker

[Trevor Vaughan]

Hi All,

Does anyone know of a project that can correlate the running operating
system with the latest information on the FIPS 140 approved products list.

Basically, I'm looking for a command where I can run something like
`fipscertified` and get back a `0` or `1` based on the result of the
latest/updated data.

Bonus points, I'd love to be able to point it at apps and have it tell me,
but that's a long shot given the statically compiled wonderland we all seem
to be living in these days.

Thanks,

Trevor

[Brent Kimberley]

No.

Were you thinking of a signed JSON or XML FIPS-140-approved-products-list metadata / resource file? With a script that runs as a side-car?

From: Trevor Vaughan [mailto:[e-mail]]
Sent: Monday, October 29, 2018 2:43 PM
To: SCAP Security Guide 
Subject: FIPS Checker

Hi All,

Does anyone know of a project that can correlate the running operating system with the latest information on the FIPS 140 approved products list.

Basically, I'm looking for a command where I can run something like `fipscertified` and get back a `0` or `1` based on the result of the latest/updated data.

Bonus points, I'd love to be able to point it at apps and have it tell me, but that's a long shot given the statically compiled wonderland we all seem to be living in these days.

Thanks,

Trevor

--
Trevor Vaughan
Vice President, Onyx Point, Inc
[phone] x788

-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.

[Gabe Alford]

Outside of going to
https://csrc.nist.gov/projects/cryptographic-module-validation-program/valid...
and clicking `search` with empty search parameters, don't know of anything.

On Mon, Oct 29, 2018 at 1:33 PM Trevor Vaughan 
wrote:
> Hi All,
>
> Does anyone know of a project that can correlate the running operating
> system with the latest information on the FIPS 140 approved products list.
>
> Basically, I'm looking for a command where I can run something like
> `fipscertified` and get back a `0` or `1` based on the result of the
> latest/updated data.
>
> Bonus points, I'd love to be able to point it at apps and have it tell me,
> but that's a long shot given the statically compiled wonderland we all seem
> to be living in these days.
>
> Thanks,
>
> Trevor
>
> --
> Trevor Vaughan
> Vice President, Onyx Point, Inc
> [phone] x788
>
> -- This account not approved for unencrypted proprietary information --
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Mark Thacker]

We've definitely talked about this and there isn't a clear programmatic
means to achieve this.
Of course, we do log which specific version of the libraries that we build
and test against in our certification report. So, those could be used to
compare a running system against the certification report.

Yes, I also understand that sometimes the desire is to be able to show that
CentOS or Fedora is NOT FIPS certified verses RHEL. Of course, that assumes
that the RHEL you are running on IS actually certified.

On Mon, Oct 29, 2018 at 3:39 PM Gabe Alford  wrote:
> Outside of going to
> https://csrc.nist.gov/projects/cryptographic-module-validation-program/valid...
> and clicking `search` with empty search parameters, don't know of anything.
>
> On Mon, Oct 29, 2018 at 1:33 PM Trevor Vaughan 
> wrote:
> > Hi All,
> >
> > Does anyone know of a project that can correlate the running operating
> > system with the latest information on the FIPS 140 approved products list.
> >
> > Basically, I'm looking for a command where I can run something like
> > `fipscertified` and get back a `0` or `1` based on the result of the
> > latest/updated data.
> >
> > Bonus points, I'd love to be able to point it at apps and have it tell
> > me, but that's a long shot given the statically compiled wonderland we all
> > seem to be living in these days.
> >
> > Thanks,
> >
> > Trevor
> >
> > --
> > Trevor Vaughan
> > Vice President, Onyx Point, Inc
> > [phone] x788
> >
> > -- This account not approved for unencrypted proprietary information --
> > _______________________________________________
> > scap-security-guide mailing list --
> > [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Trevor Vaughan]

Actually, Mark, you've kind of nailed it on the head for me.

I would like to be able to know that the system is the way it's *supposed*
to be instead of just kind of doing my best and hoping that something
didn't break.

I was hoping that the validated modules area would have an XML file or
something that could be downloaded and processed :-|.

Anyway, it seems like it would be an appropriate addition to the SCAP scans
since there is already the requirement to be enabled being checked for
various profiles. I was just hoping that someone had magically created it.

Thanks,

Trevor

On Mon, Oct 29, 2018 at 3:59 PM Mark Thacker  wrote:
> We've definitely talked about this and there isn't a clear programmatic
> means to achieve this.
> Of course, we do log which specific version of the libraries that we build
> and test against in our certification report. So, those could be used to
> compare a running system against the certification report.
>
> Yes, I also understand that sometimes the desire is to be able to show
> that CentOS or Fedora is NOT FIPS certified verses RHEL. Of course, that
> assumes that the RHEL you are running on IS actually certified.
>
> On Mon, Oct 29, 2018 at 3:39 PM Gabe Alford  wrote:
> > Outside of going to
> > https://csrc.nist.gov/projects/cryptographic-module-validation-program/valid...
> > and clicking `search` with empty search parameters, don't know of
> > anything.
> >
> > On Mon, Oct 29, 2018 at 1:33 PM Trevor Vaughan 
> > wrote:
> > > Hi All,
> > >
> > > Does anyone know of a project that can correlate the running operating
> > > system with the latest information on the FIPS 140 approved products list.
> > >
> > > Basically, I'm looking for a command where I can run something like
> > > `fipscertified` and get back a `0` or `1` based on the result of the
> > > latest/updated data.
> > >
> > > Bonus points, I'd love to be able to point it at apps and have it tell
> > > me, but that's a long shot given the statically compiled wonderland we all
> > > seem to be living in these days.
> > >
> > > Thanks,
> > >
> > > Trevor
> > >
> > > --
> > > Trevor Vaughan
> > > Vice President, Onyx Point, Inc
> > > [phone] x788
> > >
> > > -- This account not approved for unencrypted proprietary information --
> > > _______________________________________________
> > > scap-security-guide mailing list --
> > > [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> >
> > scap-security-guide mailing list --
> > [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> --
> Mark Thacker
> Principal Technical Product Manager, Security,  Red Hat Enterprise Linux
> Email: [e-mail]
> IRC / Freenode : mthacker
> Mobile: [phone]
>
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Mark Thacker]

AHHH.
Well, checking the signatures of the RPMs verses what we posted in the
certification would be a start. (sorry, manual there unless you automate
using Ansible or OpenSCAP perhaps)
You can check that the kernel is running in FIPS mode, of course, but I'm
not sure that's all you want to check.
 BTW : That process of checking that the system is configured in FIPS does
get easier in the future.....

On Mon, Oct 29, 2018 at 4:03 PM Trevor Vaughan 
wrote:
> Actually, Mark, you've kind of nailed it on the head for me.
>
> I would like to be able to know that the system is the way it's *supposed*
> to be instead of just kind of doing my best and hoping that something
> didn't break.
>
> I was hoping that the validated modules area would have an XML file or
> something that could be downloaded and processed :-|.
>
> Anyway, it seems like it would be an appropriate addition to the SCAP
> scans since there is already the requirement to be enabled being checked
> for various profiles. I was just hoping that someone had magically created
> it.
>
> Thanks,
>
> Trevor
>
> On Mon, Oct 29, 2018 at 3:59 PM Mark Thacker  wrote:
> > We've definitely talked about this and there isn't a clear programmatic
> > means to achieve this.
> > Of course, we do log which specific version of the libraries that we
> > build and test against in our certification report. So, those could be used
> > to compare a running system against the certification report.
> >
> > Yes, I also understand that sometimes the desire is to be able to show
> > that CentOS or Fedora is NOT FIPS certified verses RHEL. Of course, that
> > assumes that the RHEL you are running on IS actually certified.
> >
> > On Mon, Oct 29, 2018 at 3:39 PM Gabe Alford 
> > wrote:
> > > Outside of going to
> > > https://csrc.nist.gov/projects/cryptographic-module-validation-program/valid...
> > > and clicking `search` with empty search parameters, don't know of
> > > anything.
> > >
> > > On Mon, Oct 29, 2018 at 1:33 PM Trevor Vaughan 
> > > wrote:
> > > > Hi All,
> > > >
> > > > Does anyone know of a project that can correlate the running operating
> > > > system with the latest information on the FIPS 140 approved products list.
> > > >
> > > > Basically, I'm looking for a command where I can run something like
> > > > `fipscertified` and get back a `0` or `1` based on the result of the
> > > > latest/updated data.
> > > >
> > > > Bonus points, I'd love to be able to point it at apps and have it tell
> > > > me, but that's a long shot given the statically compiled wonderland we all
> > > > seem to be living in these days.
> > > >
> > > > Thanks,
> > > >
> > > > Trevor
> > > >
> > > > --
> > > > Trevor Vaughan
> > > > Vice President, Onyx Point, Inc
> > > > [phone] x788
> > > >
> > > > -- This account not approved for unencrypted proprietary information --
> > > > _______________________________________________
> > > > scap-security-guide mailing list --
> > > > [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
> > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > >
> > > scap-security-guide mailing list --
> > > [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> >
> > --
> > Mark Thacker
> > Principal Technical Product Manager, Security,  Red Hat Enterprise Linux
> > Email: [e-mail]
> > IRC / Freenode : mthacker
> > Mobile: [phone]
> >
> > scap-security-guide mailing list --
> > [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> --
> Trevor Vaughan
> Vice President, Onyx Point, Inc
> [phone] x788
>
> -- This account not approved for unencrypted proprietary information --
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Trevor Vaughan]

Well, checking to see if the system is in FIPS mode at the kernel level is
pretty easy (fipscheck).

I would like to know that it's actually the way the vendor intended but I
couldn't determine a good way to do that. Seems like something that the
vendors would want to supply/encourage for those customers that need it.

On Mon, Oct 29, 2018 at 4:17 PM Mark Thacker  wrote:
> AHHH.
> Well, checking the signatures of the RPMs verses what we posted in the
> certification would be a start. (sorry, manual there unless you automate
> using Ansible or OpenSCAP perhaps)
> You can check that the kernel is running in FIPS mode, of course, but I'm
> not sure that's all you want to check.
>  BTW : That process of checking that the system is configured in FIPS does
> get easier in the future.....
>
> On Mon, Oct 29, 2018 at 4:03 PM Trevor Vaughan 
> wrote:
> > Actually, Mark, you've kind of nailed it on the head for me.
> >
> > I would like to be able to know that the system is the way it's
> > *supposed* to be instead of just kind of doing my best and hoping that
> > something didn't break.
> >
> > I was hoping that the validated modules area would have an XML file or
> > something that could be downloaded and processed :-|.
> >
> > Anyway, it seems like it would be an appropriate addition to the SCAP
> > scans since there is already the requirement to be enabled being checked
> > for various profiles. I was just hoping that someone had magically created
> > it.
> >
> > Thanks,
> >
> > Trevor
> >
> > On Mon, Oct 29, 2018 at 3:59 PM Mark Thacker  wrote:
> > > We've definitely talked about this and there isn't a clear programmatic
> > > means to achieve this.
> > > Of course, we do log which specific version of the libraries that we
> > > build and test against in our certification report. So, those could be used
> > > to compare a running system against the certification report.
> > >
> > > Yes, I also understand that sometimes the desire is to be able to show
> > > that CentOS or Fedora is NOT FIPS certified verses RHEL. Of course, that
> > > assumes that the RHEL you are running on IS actually certified.
> > >
> > > On Mon, Oct 29, 2018 at 3:39 PM Gabe Alford 
> > > wrote:
> > > > Outside of going to
> > > > https://csrc.nist.gov/projects/cryptographic-module-validation-program/valid...
> > > > and clicking `search` with empty search parameters, don't know of
> > > > anything.
> > > >
> > > > On Mon, Oct 29, 2018 at 1:33 PM Trevor Vaughan 
> > > > wrote:
> > > > > Hi All,
> > > > >
> > > > > Does anyone know of a project that can correlate the running operating
> > > > > system with the latest information on the FIPS 140 approved products list.
> > > > >
> > > > > Basically, I'm looking for a command where I can run something like
> > > > > `fipscertified` and get back a `0` or `1` based on the result of the
> > > > > latest/updated data.
> > > > >
> > > > > Bonus points, I'd love to be able to point it at apps and have it tell
> > > > > me, but that's a long shot given the statically compiled wonderland we all
> > > > > seem to be living in these days.
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Trevor
> > > > >
> > > > > --
> > > > > Trevor Vaughan
> > > > > Vice President, Onyx Point, Inc
> > > > > [phone] x788
> > > > >
> > > > > -- This account not approved for unencrypted proprietary information --
> > > > > _______________________________________________
> > > > > scap-security-guide mailing list --
> > > > > [e-mail]
> > > > > To unsubscribe send an email to
> > > > > [e-mail]
> > > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > > List Guidelines:
> > > > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > List Archives:
> > > > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > >
> > > > scap-security-guide mailing list --
> > > > [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
> > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > >
> > > --
> > > Mark Thacker
> > > Principal Technical Product Manager, Security,  Red Hat Enterprise Linux
> > > Email: [e-mail]
> > > IRC / Freenode : mthacker
> > > Mobile: [phone]
> > >
> > > scap-security-guide mailing list --
> > > [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> >
> > --
> > Trevor Vaughan
> > Vice President, Onyx Point, Inc
> > [phone] x788
> >
> > -- This account not approved for unencrypted proprietary information --
> > _______________________________________________
> > scap-security-guide mailing list --
> > [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> --
> Mark Thacker
> Principal Technical Product Manager, Security,  Red Hat Enterprise Linux
> Email: [e-mail]
> IRC / Freenode : mthacker
> Mobile: [phone]
>
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Brent Kimberley]

Like Trusted computing: power-on-self-test, trusted core, trusted interpreter measurements?

From: Trevor Vaughan [mailto:[e-mail]]
Sent: Monday, October 29, 2018 4:24 PM
To: SCAP Security Guide 
Subject: Re: FIPS Checker

Well, checking to see if the system is in FIPS mode at the kernel level is pretty easy (fipscheck).

I would like to know that it's actually the way the vendor intended but I couldn't determine a good way to do that. Seems like something that the vendors would want to supply/encourage for those customers that need it.

On Mon, Oct 29, 2018 at 4:17 PM Mark Thacker <[e-mail]> wrote:
AHHH.
Well, checking the signatures of the RPMs verses what we posted in the certification would be a start. (sorry, manual there unless you automate using Ansible or OpenSCAP perhaps)
You can check that the kernel is running in FIPS mode, of course, but I'm not sure that's all you want to check.
 BTW : That process of checking that the system is configured in FIPS does get easier in the future.....

On Mon, Oct 29, 2018 at 4:03 PM Trevor Vaughan <[e-mail]> wrote:
Actually, Mark, you've kind of nailed it on the head for me.

I would like to be able to know that the system is the way it's *supposed* to be instead of just kind of doing my best and hoping that something didn't break.

I was hoping that the validated modules area would have an XML file or something that could be downloaded and processed :-|.

Anyway, it seems like it would be an appropriate addition to the SCAP scans since there is already the requirement to be enabled being checked for various profiles. I was just hoping that someone had magically created it.

Thanks,

Trevor

On Mon, Oct 29, 2018 at 3:59 PM Mark Thacker <[e-mail]> wrote:
We've definitely talked about this and there isn't a clear programmatic means to achieve this.
Of course, we do log which specific version of the libraries that we build and test against in our certification report. So, those could be used to compare a running system against the certification report.

Yes, I also understand that sometimes the desire is to be able to show that CentOS or Fedora is NOT FIPS certified verses RHEL. Of course, that assumes that the RHEL you are running on IS actually certified.

On Mon, Oct 29, 2018 at 3:39 PM Gabe Alford <[e-mail]> wrote:
Outside of going to https://csrc.nist.gov/projects/cryptographic-module-validation-program/valid...
and clicking `search` with empty search parameters, don't know of anything.

On Mon, Oct 29, 2018 at 1:33 PM Trevor Vaughan <[e-mail]> wrote:
Hi All,

Does anyone know of a project that can correlate the running operating system with the latest information on the FIPS 140 approved products list.

Basically, I'm looking for a command where I can run something like `fipscertified` and get back a `0` or `1` based on the result of the latest/updated data.

Bonus points, I'd love to be able to point it at apps and have it tell me, but that's a long shot given the statically compiled wonderland we all seem to be living in these days.

Thanks,

Trevor

--
Trevor Vaughan
Vice President, Onyx Point, Inc
[phone] x788

-- This account not approved for unencrypted proprietary information --
_______________________________________________
scap-security-guide mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
_______________________________________________
scap-security-guide mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

--
Mark Thacker
Principal Technical Product Manager, Security,  Red Hat Enterprise Linux
Email: [e-mail]
IRC / Freenode : mthacker
Mobile: [phone]
_______________________________________________
scap-security-guide mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

--
Trevor Vaughan
Vice President, Onyx Point, Inc
[phone] x788

-- This account not approved for unencrypted proprietary information --
_______________________________________________
scap-security-guide mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

--
Mark Thacker
Principal Technical Product Manager, Security,  Red Hat Enterprise Linux
Email: [e-mail]
IRC / Freenode : mthacker
Mobile: [phone]
_______________________________________________
scap-security-guide mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

--
Trevor Vaughan
Vice President, Onyx Point, Inc
[phone] x788

-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.

[Shawn Wells]

On 10/29/18 4:11 PM, Mark Thacker wrote:
> AHHH.
> Well, checking the signatures of the RPMs verses what we posted in the 
> certification would be a start. (sorry, manual there unless you 
> automate using Ansible or OpenSCAP perhaps)
> You can check that the kernel is running in FIPS mode, of course, but 
> I'm not sure that's all you want to check.

Current content evaluates FIPS enablement (e.g grub fips=1).

We can *easily* enhance these checks to ensure the appropriate RPMs are 
installed to. If this would be valuable, it's very very quick/trivial to 
do.
> BTW : That process of checking that the system is configured in FIPS 
> does get easier in the future.....

hayyyyy I thought the first rule of $thingThatShallNotBeNamed was to not 
talk about $thingThatShallNotBeNamed in public? Don't worry, I won't tell ;)

[Trevor Vaughan]

I think that it's valuable since it's a more correct check.

Also, if FIPS checking is the next killer feature, well.....

On Mon, Oct 29, 2018, 10:57 PM Shawn Wells  wrote:
> On 10/29/18 4:11 PM, Mark Thacker wrote:
> > AHHH.
> > Well, checking the signatures of the RPMs verses what we posted in the
> > certification would be a start. (sorry, manual there unless you
> > automate using Ansible or OpenSCAP perhaps)
> > You can check that the kernel is running in FIPS mode, of course, but
> > I'm not sure that's all you want to check.
>
> Current content evaluates FIPS enablement (e.g grub fips=1).
>
> We can *easily* enhance these checks to ensure the appropriate RPMs are
> installed to. If this would be valuable, it's very very quick/trivial to
> do.
> > BTW : That process of checking that the system is configured in FIPS
> > does get easier in the future.....
>
> hayyyyy I thought the first rule of $thingThatShallNotBeNamed was to not
> talk about $thingThatShallNotBeNamed in public? Don't worry, I won't tell
> ;)
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Gabe Alford]

We do have an installed_OS_is_certified check to handle verification that
an OS is vendor
supported, and to some degree, is a FIPS certified system.

On Mon, Oct 29, 2018 at 2:53 PM Trevor Vaughan 
wrote:
> Actually, Mark, you've kind of nailed it on the head for me.
>
> I would like to be able to know that the system is the way it's *supposed*
> to be instead of just kind of doing my best and hoping that something
> didn't break.
>
> I was hoping that the validated modules area would have an XML file or
> something that could be downloaded and processed :-|.
>
> Anyway, it seems like it would be an appropriate addition to the SCAP
> scans since there is already the requirement to be enabled being checked
> for various profiles. I was just hoping that someone had magically created
> it.
>
> Thanks,
>
> Trevor
>
> On Mon, Oct 29, 2018 at 3:59 PM Mark Thacker  wrote:
> > We've definitely talked about this and there isn't a clear programmatic
> > means to achieve this.
> > Of course, we do log which specific version of the libraries that we
> > build and test against in our certification report. So, those could be used
> > to compare a running system against the certification report.
> >
> > Yes, I also understand that sometimes the desire is to be able to show
> > that CentOS or Fedora is NOT FIPS certified verses RHEL. Of course, that
> > assumes that the RHEL you are running on IS actually certified.
> >
> > On Mon, Oct 29, 2018 at 3:39 PM Gabe Alford 
> > wrote:
> > > Outside of going to
> > > https://csrc.nist.gov/projects/cryptographic-module-validation-program/valid...
> > > and clicking `search` with empty search parameters, don't know of
> > > anything.
> > >
> > > On Mon, Oct 29, 2018 at 1:33 PM Trevor Vaughan 
> > > wrote:
> > > > Hi All,
> > > >
> > > > Does anyone know of a project that can correlate the running operating
> > > > system with the latest information on the FIPS 140 approved products list.
> > > >
> > > > Basically, I'm looking for a command where I can run something like
> > > > `fipscertified` and get back a `0` or `1` based on the result of the
> > > > latest/updated data.
> > > >
> > > > Bonus points, I'd love to be able to point it at apps and have it tell
> > > > me, but that's a long shot given the statically compiled wonderland we all
> > > > seem to be living in these days.
> > > >
> > > > Thanks,
> > > >
> > > > Trevor
> > > >
> > > > --
> > > > Trevor Vaughan
> > > > Vice President, Onyx Point, Inc
> > > > [phone] x788
> > > >
> > > > -- This account not approved for unencrypted proprietary information --
> > > > _______________________________________________
> > > > scap-security-guide mailing list --
> > > > [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
> > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > >
> > > scap-security-guide mailing list --
> > > [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]...
> >
> > --
> > Mark Thacker
> > Principal Technical Product Manager, Security,  Red Hat Enterprise Linux
> > Email: [e-mail]
> > IRC / Freenode : mthacker
> > Mobile: [phone]
> >
> > scap-security-guide mailing list --
> > [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> --
> Trevor Vaughan
> Vice President, Onyx Point, Inc
> [phone] x788
>
> -- This account not approved for unencrypted proprietary information --
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...