Demo
Demo

Knowledge base

PMTA knowledge base›Procedure§ 2.8

Enabling FIPS mode

FIPS support on Linux
A restricted set of cryptography

PowerMTA 6.0 runs on OpenSSL 3.0.8, which includes a certified FIPS 140-2 module (certificate #4282). By default the engine takes algorithms from the regular module; in FIPS mode, only approved ones.

It is enabled by a file, not a configuration line. In /var/lib/pmta/fips run ./openssl fipsinstall -out fipsmodule.cnf -module ./fips.so; at startup the engine checks whether fipsmodule.cnf exists and logs that FIPS is enabled. To disable it, delete the file and restart the engine.

The main trap is enabling the mode and expecting the same cryptography. FIPS mode restricts algorithms: some familiar encryption and signing settings become unavailable — they are checked before enabling, not after the first failures.
What the Hub does. It is not enabled here. The requirement arises with clients who have special obligations; enabling it will narrow the choice of signing and encryption algorithms.
Recommended values

Enable and disable:

Action How What confirms it
enable openssl fipsinstall in /var/lib/pmta/fips, start a FIPS entry in the log
disable delete fipsmodule.cnf, restart no such entry in the startup log
The OpenSSL version, the module certificate, the command, the startup check and disabling come from the manual (§ 2.8); the mode’s restrictions are § 11.24. The table is ours.
Example configuration
cd /var/lib/pmta/fips
./openssl fipsinstall -out fipsmodule.cnf -module ./fips.so
The manual’s commands; then the engine is started again — the file is checked only at startup.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · linux
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

1 relation

Does not work without

FIPS module configuration fileThe file this procedure is about. § 2.8

Referenced from

What is not allowed in FIPS modeThe procedure in which the mechanism is applied. § 11.24

How to check on the node
Check whether the mode is enabled:
grep -n 'FIPS' /var/log/pmta/log | tail -1
ls -l /var/lib/pmta/fips/fipsmodule.cnf
A FIPS entry after the last start and the file in place — the mode is in effect.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security