FIPS Compliance for the Vertica Server
To make Vertica FIPS-compliant, you must:
- Set the RequireFIPS parameter to 1.
- Hash your passwords with SHA-512. See Hash Authentication for details.
- Generate a signed TLS certificate to establish a secure connection to the client.
RequireFIPS Parameter
Vertica sets the RequireFIPS configuration parameter on the server on startup to reflect the state of FIPS on the system: 1 if FIPS is enabled and 0 if FIPS is disabled.
The value of RequireFIPS matches the value of crypto.fips_enabled
file.
Vertica sets the RequireFIPS
parameter based on the contents
of crypto.fips_enabled
:
- If the file
/proc/sys/crypto/fips_enabled
exists and contains a 1 (FIPS-enabled), Vertica sets RequireFIPS to 1. - If the file
/proc/sys/crypto/fips_enabled
does not exist, or exists and contains a 0 (non-FIPS), Vertica automatically sets RequireFIPS to 0. - If the FIPS state of a node, as determined from the existence of
/proc/sys/crypto/fips_enabled
, differs from the state received from the cluster initiator, the node fails. This behavior prevents the creation of clusters of mixed FIPS and non-FIPS systems.
If you attempt to restore a FIPS-enabled node to a non-FIPS cluster, the restore will fail.
Secure Client-Server Connection
It's important to secure client-server connections with TLS. For instructions on setting up client-server TLS, see Configuring Client-server TLS.
FIPS-Compliant AWS Endpoints
To configure AWS to use a FIPS-compliant S3 Endpoint, set the following S3 Parameters:
AWSEndpoint = s3-fips.dualstack.us-east-1.amazonaws.com S3EnableVirtualAddressing = 1