3 ways to check FIPS mode in Linux

FIPS stands for Federal Information Processing Standards—a set of standards and guidelines developed by the U.S. federal government to establish uniform requirements for information security, including computer security, data protection, and cryptography.

What is FIPS?

FIPS publications are used by federal agencies and organizations that handle sensitive government information, such as military, law enforcement, and financial institutions. They cover a wide range of topics, including encryption algorithms, key management, digital signatures, and access control.

FIPS compliance is often a requirement for vendors supplying products and services to the U.S. government, and many countries outside the U.S. recognize FIPS standards as well. The National Institute of Standards and Technology (NIST) is the agency responsible for developing and maintaining the FIPS publications.

How to enable FIPS mode on Red Hat Linux

RHEL 8 and later provide the dedicated fips-mode-setup command to enable or disable FIPS mode.

1. Open a terminal on your Linux system.
2. Switch to the root user:su -
3. Enable FIPS mode:fips-mode-setup --enable Output:Setting system policy to FIPS Note: System-wide crypto policies are applied on application start-up. It is recommended to restart the system for the change of policies to fully take place. FIPS mode will be enabled. Please reboot the system for the setting to take effect.
4. Reboot so the kernel can switch into FIPS mode:reboot

Note: For a system that must be fully FIPS-compliant, Red Hat recommends enabling FIPS mode during installation (so all keys and certificates are generated by FIPS-approved algorithms from the start). fips-mode-setup --enable is the supported way to convert an already-installed system.

Troubleshooting: fips-mode-setup: command not found

If the command isn’t available:

fips-mode-setup

-bash: fips-mode-setup: command not found

The command is provided by the crypto-policies-scripts package. Confirm which package owns it:

rpm -qf $(command -v fips-mode-setup)

Output:

crypto-policies-scripts-20210209-1.gitbfb6bed.el8_3.noarch

Check whether that package is installed:

yum list installed | grep crypto-policies-scripts

If you need to install the package:

See also: Mastering the Linux Command Line — Your Complete Free Training Guide

yum install crypto-policies-scripts

Three ways to check FIPS mode

1. Use fips-mode-setup --check (recommended)

The clearest way to check FIPS status is the --check option. When FIPS is off:

fips-mode-setup --check

Output:

FIPS mode is disabled.

2. Use the command exit status

fips-mode-setup --is-enabled sets an exit status you can read with echo $?. An exit status of 0 means success (enabled); a non-zero value means it’s not enabled:

fips-mode-setup --is-enabled
echo $?

Output:

2

Here the exit status 2 indicates FIPS mode is disabled.

3. Read /proc/sys/crypto/fips_enabled

The /proc/sys tree exposes kernel configuration values. The crypto/fips_enabled entry reports FIPS state directly:

cat /proc/sys/crypto/fips_enabled

Output:

0

A value of 1 means FIPS mode is enabled; 0 means it is not.

What the checks look like when FIPS is enabled

After enabling FIPS and rebooting, all three checks agree:

fips-mode-setup --check

FIPS mode is enabled.

cat /proc/sys/crypto/fips_enabled

1

fips-mode-setup --is-enabled
echo $?

0

Summary

Check	Command	Disabled	Enabled
Status message	fips-mode-setup --check	FIPS mode is disabled.	FIPS mode is enabled.
Exit status	fips-mode-setup --is-enabled; echo $?	2	0
Kernel flag	cat /proc/sys/crypto/fips_enabled	0	1

Use fips-mode-setup --check for a human-readable answer, --is-enabled when scripting, and /proc/sys/crypto/fips_enabled for a quick kernel-level confirmation. Remember that enabling FIPS requires a reboot to take full effect.