FIPS Mode - Revision history

Qadmin: Rewrite from the product: remove the 'FIPS 140-3 cert pending' claim and state the real position (140-2 module validation, no 140-3 product certification, SED FDE on FIPS 140-3 media for deployments requiring certification); document the active/ symlink switch and the two OpenSSL versions (3.1.2 FIPS, 3.5.7 general) verified on a 6.9 build; add the three FIPS state values, the reboot requirement, and verification from the WUI, CLI and crypto log; fix the inverted heading levels (QSTOR-12352)

2026-09-03T05:35:19Z

Rewrite from the product: remove the 'FIPS 140-3 cert pending' claim and state the real position (140-2 module validation, no 140-3 product certification, SED FDE on FIPS 140-3 media for deployments requiring certification); document the active/ symlink switch and the two OpenSSL versions (3.1.2 FIPS, 3.5.7 general) verified on a 6.9 build; add the three FIPS state values, the reboot requirement, and verification from the WUI, CLI and crypto log; fix the inverted heading levels (QSTOR-12352)

Show changes

Qadmin: Move to the Administrator Guide: FIPS mode is appliance security configuration, not client-side access (QSTOR-12352)

2026-09-03T03:22:39Z

Move to the Administrator Guide: FIPS mode is appliance security configuration, not client-side access (QSTOR-12352)

← Older revision		Revision as of 03:22, 3 September 2026
Line 1:		Line 1:
	[[Category:~~user_guide~~]]		[[Category:admin_guide]]
	=== QuantaStor FIPS 140-2 Module ===		=== QuantaStor FIPS 140-2 Module ===
	QuantaStor supports FIPS cryptographic standards for NIST standard FIPS 140-2. More information on the 'OSNEXUS Crypto Library' is available at the NIST web site [https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4185 here]. The OSNEXUS Crypto Library FIPS 140-2 Non-proprietary Security Policy can be found [https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4185.pdf here], and the official certificate [https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/March%202022_010422_0648_signed.pdf here]. This page will be updated with instructions to configure your QuantaStor system to enable FIPS mode.		QuantaStor supports FIPS cryptographic standards for NIST standard FIPS 140-2. More information on the 'OSNEXUS Crypto Library' is available at the NIST web site [https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4185 here]. The OSNEXUS Crypto Library FIPS 140-2 Non-proprietary Security Policy can be found [https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4185.pdf here], and the official certificate [https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/March%202022_010422_0648_signed.pdf here]. This page will be updated with instructions to configure your QuantaStor system to enable FIPS mode.

Qadmin: /* Enabling FIPS Mode */

2023-04-06T20:31:40Z

Enabling FIPS Mode

← Older revision		Revision as of 20:31, 6 April 2023
Line 4:		Line 4:

	=== Enabling FIPS Mode ===		=== Enabling FIPS Mode ===
	To run Quantastor in FIPS mode, '''it is required that all of the nodes in your storage grid are running service version ~~'5.9' at minimum and~~ 6.0 ~~at maximum~~''' (FIPS 140-3 cert pending for 6.1 and beyond). If any of your nodes do not meet this requirement, then the storage systems on your grid will be automatically set into FIPS Non-Approved mode. To enable or disable FIPS mode, you will need to use the 'qs-util' CLI tool. Run the following commands as the 'root' user on the QuantaStor system to be put into FIPS mode.		To run Quantastor in FIPS mode, '''it is required that all of the nodes in your storage grid are running qstor-service version "6.0.11"''' (FIPS 140-3 cert pending for 6.1 and beyond). If any of your nodes do not meet this requirement, then the storage systems on your grid will be automatically set into FIPS Non-Approved mode. To enable or disable FIPS mode, you will need to use the 'qs-util' CLI tool. Run the following commands as the 'root' user on the QuantaStor system to be put into FIPS mode.
	<pre>		<pre>
	## enables FIPS mode and restarts the quantastor service		## enables FIPS mode and restarts the quantastor service

Qadmin: /* Enabling FIPS Mode */

2023-04-06T20:28:37Z

Enabling FIPS Mode

← Older revision		Revision as of 20:28, 6 April 2023
Line 20:		Line 20:
	</pre>		</pre>

	~~You should~~ see ~~a WARNLOC alert that looks something like this~~:		Check the QuantaStor alerts to see recent changes to FIPS mode status:<br>
			[[File:Fips mode status update alerts.jpg]]

			Additional logging for the OSNEXUS Crypto Library Module can be followed using the following command:
	<pre>		<pre>
	~~{Wed Jun 17 12:12:02 2020, WARN, e7c79740:alert_manager:543} alert raised~~ / ~~title: 'FIPS Mode Verified', filter: , desc: 'FIPS mode is now verified and active on system 'fips-node5', reboot required upon first activation~~.~~', SNMP OID suffix: '182'~~		# tail -f /var/log/qs/qs_crypto.log
	</pre>		</pre>

	If this is the first time activating FIPS mode on this box, then you will need to run the 'reboot' command and wait for the service to start up again. Crypto module logs can be found in location '/var/log/qs/qs_crypto.log'.

	== Manual Verification and Validatation of FIPS Mode ==		== Manual Verification and Validatation of FIPS Mode ==

Qadmin: /* Enabling FIPS Mode */

2023-04-06T20:20:38Z

Enabling FIPS Mode

← Older revision		Revision as of 20:20, 6 April 2023
Line 14:		Line 14:
	'''REBOOT: After enabling the FIPS mode, reboot the system as there are various checks that need to be done at system startup.'''		'''REBOOT: After enabling the FIPS mode, reboot the system as there are various checks that need to be done at system startup.'''

	You can run the service and check the logs to verify that FIPS mode has been ~~verified using~~ the following command:		You can run the service and check the logs to verify that FIPS mode has been validated from the UI in the storage system properties. You can also run the following command to verify FIPS mode status from the CLI:

	<pre>		<pre>
	# qs-~~showlog -a~~ \| grep FIPS		# qs sys-get \| grep -i FIPS
	</pre>		</pre>

Qadmin: /* Enabling FIPS Mode */

2023-04-06T20:18:27Z

Enabling FIPS Mode

← Older revision		Revision as of 20:18, 6 April 2023
Line 6:		Line 6:
	To run Quantastor in FIPS mode, '''it is required that all of the nodes in your storage grid are running service version '5.9' at minimum and 6.0 at maximum''' (FIPS 140-3 cert pending for 6.1 and beyond). If any of your nodes do not meet this requirement, then the storage systems on your grid will be automatically set into FIPS Non-Approved mode. To enable or disable FIPS mode, you will need to use the 'qs-util' CLI tool. Run the following commands as the 'root' user on the QuantaStor system to be put into FIPS mode.		To run Quantastor in FIPS mode, '''it is required that all of the nodes in your storage grid are running service version '5.9' at minimum and 6.0 at maximum''' (FIPS 140-3 cert pending for 6.1 and beyond). If any of your nodes do not meet this requirement, then the storage systems on your grid will be automatically set into FIPS Non-Approved mode. To enable or disable FIPS mode, you will need to use the 'qs-util' CLI tool. Run the following commands as the 'root' user on the QuantaStor system to be put into FIPS mode.
	<pre>		<pre>
	# enables FIPS mode and restarts the quantastor service		## enables FIPS mode and restarts the quantastor service
	# sudo qs-util enablefips		# sudo qs-util enablefips
	# disables FIPS mode and restarts the quantastor service		## disables FIPS mode and restarts the quantastor service
	# sudo qs-util disablefips		# sudo qs-util disablefips
	</pre>		</pre>

Qadmin: /* Enabling FIPS Mode */

2023-04-06T20:18:05Z

Enabling FIPS Mode

← Older revision		Revision as of 20:18, 6 April 2023
Line 4:		Line 4:

	=== Enabling FIPS Mode ===		=== Enabling FIPS Mode ===
	To run Quantastor in FIPS mode, '''it is required that all of the nodes in your storage grid are running service version '5.9' at minimum and 6.0 at maximum''' (FIPS 140-3 cert pending for 6.1 and beyond). If any of your nodes do not meet this requirement, then the storage systems on your grid will be automatically set into FIPS Non-Approved mode. To enable FIPS mode, you will need to ~~add~~ the '~~tf_fips.enable~~' ~~touchfile to the expected directory~~. Run the following commands as the 'root' user on the QuantaStor system to be put into FIPS mode.		To run Quantastor in FIPS mode, '''it is required that all of the nodes in your storage grid are running service version '5.9' at minimum and 6.0 at maximum''' (FIPS 140-3 cert pending for 6.1 and beyond). If any of your nodes do not meet this requirement, then the storage systems on your grid will be automatically set into FIPS Non-Approved mode. To enable or disable FIPS mode, you will need to use the 'qs-util' CLI tool. Run the following commands as the 'root' user on the QuantaStor system to be put into FIPS mode.
	<pre>		<pre>
	# sudo ~~touch /var/opt/osnexus/~~quantastor~~/touchfiles/tf_fips.enable~~		# enables FIPS mode and restarts the quantastor service
			# sudo qs-util enablefips
			# disables FIPS mode and restarts the quantastor service
			# sudo qs-util disablefips
	</pre>		</pre>

Qadmin: /* Manual Verification and Validatation of FIPS Mode */

2023-04-05T22:24:49Z

Manual Verification and Validatation of FIPS Mode

← Older revision		Revision as of 22:24, 5 April 2023
Line 29:		Line 29:
	Once logged in as the 'qadmin' user you'll want to elevate your permissions to 'root' before running the the following checks.		Once logged in as the 'qadmin' user you'll want to elevate your permissions to 'root' before running the the following checks.

	=== ~~Verify~~ FIPS Mode ~~is Enabled~~ ===		=== Validate osncryptolib configuration is FIPS Mode compliant ===
	This verifies that the of FIPS ~~enablement file as noted above is~~ in ~~place on the system~~. Successful return is 0 ~~fail~~ return is >= 1. See 'qs_crypto' ~~logs~~ for more information on FIPS mode errors.		This command verifies if the user has FIPS mode enabled and that the FIPS module has been validated by self tests. If the FIPS module fails to validate, then the quantastor service will not start if designated to run in FIPS mode. Successful return value is 0, failure return is >= 1. See 'qs_crypto.log' for more information on FIPS mode errors.
	<pre>		<pre>
	# sudo /opt/osnexus/quantastor/bin/osn_fipscheck validate-fips		# sudo /opt/osnexus/quantastor/bin/osn_fipscheck validate-fips
	~~</pre>~~

	~~=== Validate osncryptolib configuration is FIPS Mode compliant ===~~
	The output of these commands should inform the user if they have FIPS mode enabled and that the FIPS module has been validated by self tests. If the FIPS module fails to validate, then the quantastor service will not start if it has been designated to run in FIPS mode.
	~~<pre>~~
	~~# sudo /opt/osnexus/quantastor/bin/osn_fipscheck validate~~
	</pre>		</pre>

Qadmin: /* Verify FIPS Mode is Enabled */

2023-04-05T22:22:05Z

Verify FIPS Mode is Enabled

← Older revision		Revision as of 22:22, 5 April 2023
Line 30:		Line 30:

	=== Verify FIPS Mode is Enabled ===		=== Verify FIPS Mode is Enabled ===
	This verifies that the of FIPS enablement file as noted above is in place on the system.		This verifies that the of FIPS enablement file as noted above is in place on the system. Successful return is 0 fail return is >= 1. See 'qs_crypto' logs for more information on FIPS mode errors.
	<pre>		<pre>
	# sudo /opt/osnexus/quantastor/bin/osn_fipscheck validate-fips		# sudo /opt/osnexus/quantastor/bin/osn_fipscheck validate-fips
	~~# echo $?~~
	~~# success return is 0 fail return is >= 1~~
	</pre>		</pre>

Qadmin: /* Verify FIPS Mode is Enabled */

2023-04-05T22:20:43Z

Verify FIPS Mode is Enabled

← Older revision		Revision as of 22:20, 5 April 2023
Line 34:		Line 34:
	# sudo /opt/osnexus/quantastor/bin/osn_fipscheck validate-fips		# sudo /opt/osnexus/quantastor/bin/osn_fipscheck validate-fips
	# echo $?		# echo $?
	0		# success return is 0 fail return is >= 1
	</pre>		</pre>