Knowledge base
Needed only in FIPS mode
The cryptographic module configuration file used when FIPS mode is enabled.
Where it lives. /var/lib/pmta/fips/fipsmodule.cnf.
The main trap is forgetting that the file exists. It is not edited every day and so drops out of sight: when setting permissions, when making backups, when investigating. Yet it defines the node’s state on a par with the main file.
What the Hub does. FIPS mode is not enabled here, and the nodes have no such file.
Recommended values
What to check:
| What | What it should be |
|---|---|
| location | what the manual names |
| permissions | the same as the rest of the configuration |
| backup | together with the configuration directory |
Copy it together with the node’s other files — on its own it is rarely remembered.
The order of checks is ours. From the manual come the file’s location and its purpose.
Example configuration
# check whether the file exists and with what permissions ls -l /etc/pmta/
Listing the configuration directory answers both questions at once — whether the file exists and whether it is protected the same way as the others.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · linux
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
- Syntax
- Generated by OpenSSL's fipsinstall, not written by hand.
Everything here comes from the manual, with the section.
⇄
Related entries
1 relation
How to check on the node
Check it together with the other configuration files:
ls -l /etc/pmta/ pmta test config
The first shows presence and permissions. The second — that the configuration as a whole parses: if the file is damaged, it shows up right here.
In the Hub
- Cost of a mistake
- safe: a wrong value breaks nothing