Cloudera Docs

Step 1: Prepare hosts

Prepare the hosts for FIPS integration.

  1. Cryptographic operations require entropy to ensure randomness. Check the available entropy by using the following command: 
    cat/proc/sys/kernel/random/entropy_avail
    • In order to keep the entropy high, install the following tools and keep them running:
      • rng-tools - For information about checking available entropy and using the rng-tools tool, see Entropy Requirements in Data at Rest Encryption Requirements.

        Install, enable and start the rng-tools tool by using the following commands:

        1. sudo dnf install rng-tools
        2. sudo systemctl enable rngd
        3. sudo systemctl start rngd
      • haveged, available in the Extra Packages for Enterprise Linus (EPEL) Repository - For more instructions about using the haveged entropy daemon, see the haveged documentation.

        Install, enable and start the havaged entropy daemon by using the following commands:

        1. sudo dnf install haveged
        2. sudo systemctl enable haveged
        3. sudo systemctl start haveged
  2. Configure the operating system for FIPS.
    For RHEL 7, see:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations.
    For RHEL 8, see: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#switching-the-system-to-fips-mode_using-the-system-wide-cryptographic-policies
  3. On all hosts, run one of the following commands to verify that FIPS mode is enabled: 
    • cat /proc/sys/crypto/fips_enabled
    OR
    • sysctl crypto.fips_enabled
    Expected output is:
    crypto.fips_enabled = 1 (1 indicates FIPS enabled)
  4. Configure a repository to install Cloudera Manager and other required packages.
    1. On the Cloudera Manager server host, download the repository file for your operating system and version. 
      https://[username]:[password]@archive.cloudera.com/p/cm7/7.11.3/redhat8/yum/cloudera-manager.repo
    2. Open the /etc/yum.repos.d/cloudera-manager.repo file in a text editor and replace the changeme placeholder values with your user name and password. 
      [cloudera-manager]
name=Cloudera Manager 7.11.3
baseurl=https://archive.cloudera.com/p/cm7/7.11.3/redhat8/yum/
gpgkey=https://archive.cloudera.com/p/cm7/7.11.3/redhat8/yum/
RPM-GPG-KEY-cloudera
username=changeme
password=changeme
gpgcheck=1
enabled=1
autorefresh=0
type=rpm-md
    3. If your hosts do not have access to https://archive.cloudera.com, you must set up a local repository. For instructions see, Configuring a Local Package Repository.
  5. Manually install OpenJDK 8 / Oracle JDK 8 or with a tar file (From Cloudera Runtime 7.1.9 SP1 release onwards) on all hosts.
  6. Download and Install CryptoComply for Java (CC for Java) SafeLogic - Java JCE Provider on all hosts.
    1. Obtain the SafeLogic CC Java module JAR file.
    2. Copy the ccj-3.0.2.1.jar file to the $JAVA_HOME/jre/lib/ext directory.
    3. Obtain the SafeLogic BCTLS Java module JAR file.
    4. Copy the bctls-safelogic.jar file to the $JAVA_HOME/jre/lib/ext directory.
    5. Change the file permissions on both the ccj-3.0.2.1.jar and bctls-safelogic.jar files to root and 0644. 
      chown root: ${java_home}/jre/lib/ext/ccj-3.0.2.1.jar
chmod 0644 ${java_home}/jre/lib/ext/ccj-3.0.2.1.jar
chown root: ${java_home}/jre/lib/ext/bctls-safelogic.jar
chmod 0644 ${java_home}/jre/lib/ext/bctls-safelogic.jar
  7. To configure the java.policy policy, add the CCJ configuration to the bottom of the $JAVA_HOME/conf/security/java.policy file within the closed bracket: 
    //CCJ Java Permissions
permission java.lang.RuntimePermission "getProtectionDomain";
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.util.PropertyPermission "java.runtime.name", "read";
permission java.security.SecurityPermission "putProviderProperty.CCJ";
//CCJ Key Export and Translation
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "exportKeys";
//CCJ SSL
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "tlsAlgorithmsEnabled";
//CCJ Setting of Default SecureRandom
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "defaultRandomConfig";
//CCJ Setting CryptoServicesRegistrar Properties
permission com.safelogic.cryptocomply.crypto.CryptoServicesPermission "globalConfig";
//CCJ Enable JKS
permission com.safelogic.cryptocomply.jca.enable_jks "true";
};
  8. Edit the $JAVA_HOME/jre/lib/security/java.security file as follows:
    1. Add the following lines: 
      
# List of providers and their preference orders (see above):
security.provider.1=com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:CCJ
security.provider.3=sun.security.provider.Sun
security.provider.4=sun.security.rsa.SunRsaSign
security.provider.5=sun.security.ec.SunEC
#security.provider.6=com.sun.net.ssl.internal.ssl.Provider
security.provider.6=com.sun.crypto.provider.SunJCE
security.provider.7=sun.security.jgss.SunProvider
security.provider.8=com.sun.security.sasl.Provider
security.provider.9=org.jcp.xml.dsig.internal.dom.XMLDSigRI
#security.provider.11=sun.security.smartcardio.SunPCSC
    2. Comment out the ssl.KeyManagerFactory.algorithm=SunX509 line and add a new line with the text ssl.KeyManagerFactory.algorithm=X.509. 
      # Determines the default key and trust manager factory algorithms for
# the javax.net.ssl package.
#ssl.KeyManagerFactory.algorithm=SunX509
ssl.KeyManagerFactory.algorithm=X.509
ssl.TrustManagerFactory.algorithm=PKIX
Install Cloudera Manager Server