Preparing the hosts

Prepare cluster hosts for FIPS integration by configuring system entropy, enabling RHEL FIPS mode, and installing JDK 17.

Run the cat/proc/sys/kernel/random/entropy_avail command to check the available entropy.

note
On RHEL 9, the entropy pool size is capped at 256. A value of 256 is normal and expected due to changes in the kernel’s random number generator.
Install and start one of the following tools to maintain high entropy levels on each host:
- rng-tools — Utilizes Hardware Random Number Generators (HWRNGs) or hypervisor entropy sources. For more information on entropy requirements, see Data at Rest Encryption Requirements.
  Run the following commands to install the package, configure the tool to start on system boot, and launch the rngd service immediately:
```
sudo dnf install rng-tools
sudo systemctl enable rngd
sudo systemctl start rngd
```
- haveged — Generates entropy using CPU execution time jitter. This tool is located in the EPEL repository. For advanced configuration instructions, see haveged documentation.
  note
  The haveged tool is found in the EPEL repository but is generally not required for RHEL 9. The kernel includes built-in jitterentropy support.
  Run the following commands to install the package, configure the tool to start on system boot, and launch the haveged service immediately:
```
sudo dnf install haveged
sudo systemctl enable haveged
sudo systemctl start haveged
```
note
Virtual machines might have insufficient sources of entropy, which can cause extreme slowness of many Cloudera Manager and Cloudera operations even with rngd and haveged enabled. To provide sufficient entropy for the strong cryptographic functions mandated by FIPS compliance, perform following hypervisor-level adjustments:
1. Ensure that the HWRNG is enabled by setting disableHwrng to false.
2. Configure alternative entropy sources if necessary.
Configure the host operating system for FIPS compliance.
For instructions on enabling the system-wide cryptographic policy for FIPS mode, see:
- For systems running RHEL 8, see Red Hat security hardening documentation.
- For systems running RHEL 9, see Red Hat Security hardening documentation.

Run either of the following commands to confirm FIPS mode activation across all hosts:

Table 1. FIPS mode activation confirmation commands
Command	Expected results	Meaning
`cat /proc/sys/crypto/fips_enabled`	`crypto.fips_enabled = 1`	A value of 1 confirms FIPS is active
`sysctl crypto.fips_enabled`	`crypto.fips_enabled = 1`	A value of 1 confirms FIPS is active

Set up the repository for Cloudera Manager and the necessary package installations.
1. Download the Cloudera Manager repository configuration file for your OS version from the following link:
```
https://[username]:[password]@archive.cloudera.com/p/cm7/7.13.2.10000/redhat9/yum/cloudera-manager.repo
```
2. Edit /etc/yum.repos.d/cloudera-manager.repo to replace the changeme placeholder values with your user name and password.
```
[cloudera-manager]
name=Cloudera Manager 7.13.2.10000
baseurl=https://archive.cloudera.com/p/cm7/7.13.2.10000/redhat9/yum/
gpgkey=https://archive.cloudera.com/p/cm7/7.13.2.10000/redhat9/yum/
RPM-GPG-KEY-cloudera
username=changeme
password=changeme
gpgcheck=1
enabled=1
autorefresh=0
type=rpm-md
```
3. Set up a local repository for environments with no access to https://archive.cloudera.com. For instructions, see Configuring local package and parcel repositories .
Deploy JDK 17 across all cluster hosts using one of the following installation methods:
- OpenJDK17
- Oracle JDK17
- manual tarball archive
warning
Do not use the yum install method. It installs a RedHat-modified JDK package, that restricts Cloudera installation when FIPS mode is active.
Download the cloudera-sasl JAR file.
1. Download the sasl-sha256aes file from the Cloudera archive:
  - Open https://archive.cloudera.com/p/cdh7/<cdp_version>/maven-repository/com/cloudera/sasl/sasl-sha256aes/, where <cdp_version> is the four digit version number, such as, 7.1.9.20000.
  - Select the 0.1.0.<cdp_version>-<xx> folder, <xx> is an internal build iteration number. For example, for 7.1.9.20000 it is 24.
  - Download the sasl-sha256aes-0.1.0.<cdp_version>-<xx>.jar file.
2. Copy the file to the following locations on all hosts in the cluster:
1. /opt/cloudera/fips/ (or to your designated CCJ/BCTLS storage)
2. /opt/cloudera/parcels/CDH/jars/
3. /opt/cloudera/parcels/CDH/lib/hadoop/
Install CryptoComply for Java (CC for Java) SafeLogic on all hosts.
1. Download the required SafeLogic CC Java module JAR, BCTLS Java module JAR and BCUTIL Java module JAR files.
2. Create the /opt/cloudera/fips/ directory using the sudo mkdir /opt/cloudera/fips/ command.
3. Copy the ccj-4.0.0.jar, bctls-2.0.17.1.jar and bcutil-2.0.1.jar files to the /opt/cloudera/fips/ directory.
4. Change the file permissions of the JAR files to root using the following command:
```
chown root: /opt/cloudera/fips/ccj-4.0.0-fips.jar
chown root: /opt/cloudera/fips/bctls-2.0.17.1.jar
chown root: /opt/cloudera/fips/bcutil-2.0.1.jar
```
5. Set the file permissions of both JAR files to 0644 using the following command:
```
chmod 0644 /opt/cloudera/fips/ccj-4.0.0-fips.jar
chmod 0644 /opt/cloudera/fips/bctls-2.0.17.1.jar
chmod 0644 /opt/cloudera/fips/bcutil-2.0.1.jar
```
  note
  Ensure that the ccj-4.0.0-fips.jar, bctls-2.0.17.1.jar and bcutil-2.0.1.jar files are stored in the same directory.

Create a configuration script named ccj.sh under /etc/profile.d/ to configure the Java environment variables.

echo "export JDK_JAVA_OPTIONS='--module-path=/opt/cloudera/fips/ccj-4.0.0-fips.jar:/opt/cloudera/fips/bctls-2.0.17.1.jar 
--add-exports java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core 
--add-modules com.safelogic.cryptocomply.fips.core,bctls'">/etc/profile.d/ccj.sh

Configure the java.policy file, by adding the CCJ configuration block inside the closing bracket at the end of the $JAVA_HOME/conf/security/java.policy file, in the following format:

//CCJ Java Permissions
permission java.lang.RuntimePermission "getProtectionDomain";
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.util.PropertyPermission "java.runtime.name", "read";
permission java.security.SecurityPermission "putProviderProperty.CCJ";
//CCJ Key Export and Translation
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "exportKeys";
//CCJ SSL
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "tlsAlgorithmsEnabled";
//CCJ Setting of Default SecureRandom
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "defaultRandomConfig";
//CCJ Setting CryptoServicesRegistrar Properties
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "globalConfig";
//CCJ Enable JKS
permission com.safelogic.cryptocomply.jca.enable_jks "true";
};

Append the security provider configuration to the java.security file.

security.provider.1=com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:CCJ
security.provider.3=com.cloudera.security.sasl.ClouderaSaslProvider
security.provider.4=SUN
security.provider.5=SunRsaSign
security.provider.6=SunEC
security.provider.7=SunJSSE
security.provider.8=SunJGSS
security.provider.9=SunSASL
security.provider.10=XMLDSig
security.provider.11=SunPCSC
security.provider.12=JdkLDAP
security.provider.13=JdkSASL
security.provider.14=SunPKCS11

ssl.KeyManagerFactory.algorithm=X.509
ssl.TrustManagerFactory.algorithm=PKIX
security.useSystemPropertiesFile=false
keystore.type=bcfks

Install Cloudera Manager Server