This SAS KB article describes the process for enabling Federal Information Processing Standard (FIPS) when migrating from Red Hat Enterprise Linux 7.x to Red Hat Enterprise Linux 8.x, specifically for a SAS Viya 3.5 environment.
Note: If you have upgraded to SAS Viya 3.5 (24w44) or later, FIPS is supported only on Red Hat Enterprise Linux 7.9. This article describes a method for upgrading to Red Hat Enterprise Linux 8.2 or later within 8.x with support for FIPS.
To avoid failure, these steps must be followed in order.
This article also discusses an available hot fix for Elasticsearch/OpenSearch failures, as well as a workaround for SAS Micro Analytic Service failures after FIPS enablement on the operating system for deployments on Red Hat Enterprise Linux 8.x.
Perform the following steps as a workaround to fix this issue. The instructions describe how to update the operating system, enable FIPS, reboot the operating system, and restart all services. The instructions assume that you have a 24w44 (or later) SAS Viya 3.5 order deployed and running on a Red Hat Enterprise Linux 7.x machine with FIPS disabled.
1. Update to Red Hat Enterprise Linux 8x: Upgrading to a Newer Major Version of the Operating System
Note: Complete the documentation steps until the restart SAS Viya services step. Then, continue with the steps in this article to enable FIPS.
2. Verify whether FIPS is disabled:
sudo fips-mode-setup --check
3. If necessary, enable FIPS on the operating system:
sudo fips-mode-setup --enable
4. Set a FIPS flag on the JVM:
echo "export java_global_option_com_redhat_fips=\"-Dcom.redhat.fips=false\"" | sudo tee -a /opt/sas/viya/config/etc/sysconfig/sas-javaesntl/sas-java-services-security (To set a FIPS flag on the JVM)
5. Run the following to reboot the operating system:
sudo reboot
6. Start all services by following the steps in General Servers and Services: Operate (Linux).
Elasticsearch/OpenSearch is a component that is required by some SAS Viya 3.5 solutions.
After you enable FIPS at the operating system level for deployments on Red Hat Enterprise Linux 8, the Elasticsearch component might fail. If so, you can apply a hot fix from SAS KB0044802 that has been released as part of the 26w12 ship event for the package sas-svi-elasticsearch-8.14.5 or later.
This workaround is for SAS Micro Analytic Service failures after FIPS enablement at the operating system level for deployments on Red Hat Enterprise Linux 8.
After enabling FIPS in the Red Hat Enterprise Linux 8 based SAS Viya 3.5 deployment and disabling FIPS at JVM level, the following errors occur in the SAS Micro Analytic Service:
crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
1. Identify the libssl.so and libcrypto.so files that must be loaded:
$ ldd $(which openssl)
linux-vdso.so.1 (0x00007fff1c4b9000)
libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fa4a5543000)
libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fa4a5058000)
libz.so.1 => /lib64/libz.so.1 (0x00007fa4a4e40000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007fa4a4c3c000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fa4a4a1c000)
libc.so.6 => /lib64/libc.so.6 (0x00007fa4a4646000)
/lib64/ld-linux-x86-64.so.2 (0x00007fa4a5a93000)
$ strings /lib64/libcrypto.so.1.1 | grep -i "OpenSSL 1.1.1"
OpenSSL 1.1.1k FIPS 25 Mar 2021
2. Add the following environment variable to /etc/init.d/sas-viya-microanalyticservice-default.
export TKECERT_CRYPTO_LIB=/lib64/libcrypto.so.1.1
3. After making these changes, restart the sas-viya-microanalyticservice-default service.