Validating the CCJ and CCS installations

Validate CryptoComply for Java (CCJ) and CryptoComply for Server (CCS) installations in FIPS mode by verifying kernel module status, active security providers, and maximum cipher key lengths.

Run the following command to verify that the FIPS configuration is enabled:
```
sysctl crypto.fips_enabled
```
The expected output is
```
crypto.fips_enabled = 1
```
Run the following command to test that the kernel module blocks non-FIPS algorithms, such as MD5:
```
echo greeting | openssl md5
```
A failure of this command confirms that FIPS mode is active.

On the Cloudera Manager server host, create a Java test script named ListSecurityProviders.java:

cat > ListSecurityProviders.java <<-EOF
import java.security.Provider;
import java.security.Security;

public class ListSecurityProviders {
 public static void main(String[] args) {
 Provider[] providers = Security.getProviders();
 for (Provider provider : providers) {
 System.out.println("Provider: " + provider.getName());
 System.out.println("Version: " + provider.getVersionStr());
 System.out.println("Info: " + provider.getInfo());
 System.out.println();
 }
 }
}
EOF

This process locates the ccj JAR file at the designated path, assuming that the bctls file is co-located.

Run the following command with the SafeLogic module path to verify that the FIPS-compliant cryptographic security providers are properly loaded and configured in the Java runtime environment (JRE):
```
java -p /opt/cloudera/fips/ ListSecurityProviders.java
```
The terminal displays the list of security providers linked to these modules. For example,
```
Provider: CCJ
Version: <version>
Info: CryptoComply® for Java version <version>

Provider: BCJSSE
Version: <version>
Info: Bouncy Castle JSSE Provider Version <version>
```

Run the following command to get the maximum allowed key length:

read -r -d '' do_maxAESKeyLength <<EOF
java.lang.System.out.println(javax.crypto.Cipher.getMaxAllowedKeyLength("AES/CBC/PKCS5Padding"));
EOF
answer=`${JAVA_HOME}/bin/jrunscript -Dcom.safelogic.cryptocomply.fips.approved_only=true -e "$do_maxAESKeyLength"`
echo $answer

The expected output is:

2147483647

Install and configure databases