Configuring FIPS 140-3 on the BigFix Server

Starting from BigFix Platform Version 11.0.7, you can configure the BigFix server to use FIPS 140-3.

To verify the appropriate setup and initialization of the module you must check the client log file by completing the following steps:

On the BigFix server, launch the BigFix Administration Tool by selecting Start > All Programs > BigFix > BigFix Administration Tool.
Browse to the location of your site license and click OK
Select the Masthead Management tab.
Click Edit Masthead.
Check Require use of FIPS compliant cryptography to enable FIPS; it will enable the two mutually exclusive FIPS alternatives, with FIPS 140-2 selected by default.
Select the Use FIPS 140-3 compliant cryptography option.
Click OK.
Enter the Administrator password to perform the action.
To ensure that the setting has been enabled check the client log file (default log path: C:\Program Files\BigFix Enterprise\BES Client\__BESData\__Global\Logs\YYYYMMDD.log for the following types of messages:
- FIPS 140-3 Enable log file message
```
FIPS 140-3 Enabled log file message `At 17:36:03 +0200 - 
   FIPS mode enabled by masthead.
At 17:36:04 +0200 - 
   Cryptographic module initialized successfully in FIPS mode.
   FIPS 140-3 Compliant Mode selected.`
```
- FIPS 140-3 Disabled log file message
```
At 14:58:28 -0700 -
FIPS mode disabled by default.
Unrestricted mode
```

Note: To enable FIPS 140-3 on the BigFix Linux server, see the -advRequireFIPS_140_3_Crypto option described in Editing the Masthead on Linux systems.

Note:

The most common error related to the FIPS mode startup occurs on AIX systems when there is not enough system entropy available for the Cryptographic Module.
The FIPS Mode setting and the Message Level Encryption (MLE) setting are independent. You can set FIPS without setting the MLE and viceversa.

For more information on Message Level Encryption, see Message Level Encryption (MLE) Overview and Message Level Encryption and DSA.