HP A7533A - Brocade 4Gb SAN Switch Base, Administrator'S Manual

Page: 157 / 576

Fabric OS 6.2 administrator guide 155
Power-on self tests
POSTs are invoked by powering on the switch in FIPS mode and do not require operator intervention. These
POSTs perform power-on self-tests. If any KATs fail, the switch goes into a FIPS Error state which reboots the
system to start the tests again. If the switch continues to fail the FIPS POSTs, you will need to boot into
single-user mode and perform a recovery procedure to reset the switch. For more information on this
procedure, see the Fabric OS Troubleshooting and Diagnostics Guide .
Conditional Tests
Conditional tests are executed to verify that the randomness of the random number generator. The
conditional tests are executed prior to using a random number provided by the random number generator.
The results of all self-tests, both power-up and conditional, are recorded in the system log or are output to
the local console. This includes logging both passing and failing results. See the Fabric OS
Troubleshooting and Diagnostics Guide for recovery instructions if your system cannot get out of the
conditional test mode.
FIPS mode configuration
By default, the switch comes up in non-FIPS mode. You can run the
fipsCfg
--
enable fips
command
to enable FIPS mode, but you need to configure the switch first. Self-tests mode must be enabled before
FIPS mode can be enabled. A set of prerequisites as mentioned in Table 43 must be satisfied for the system
to enter FIPS mode. To be FIPS-compliant, the switch must be rebooted. KATs are run on the reboot. If the
KATs are successful, the switch enters FIPS mode. If KATs fail, the switch reboots until the KATs succeed. If
the switch cannot enter FIPS mode and continues to reboot, you must access the switch in single-user mode
to break the reboot cycle. For more information on how to fix this issue, see the Fabric OS Troubleshooting
and Diagnostics Guide .
SSH Session Key No CLI required Generated for each SSH session that is established
to and from the host. Automatically zeroizes on
session termination.
SSH RSA private Key No CLI required Key-based SSH authentication is not used for SSH
sessions.
RNG Seed Key No CLI required
/dev/urandom
is used as the initial source of
seed for RNG. RNG seed key is zeroized on every
random number generation.
Passwords
passwddefault
fipscfg –-zeroize
Removes user-defined accounts in addition to
default passwords for the root, admin, and user
default accounts. However, only root has
permissions for this command. So securityadmin
and admin roles need to use
fipsCfg
–-zeroize
, which in addition to removing user
accounts and resetting passwords, also does the
complete zerioization of the system.
TLS private keys
seccertutil delkey
The command
secCertUtil delkey
is used
to zeroize these keys.
TLS pre-master secret No CLI required Automatically zeroized on session termination.
TLS session key No CLI required Automatically zeroized on session termination.
TLS authentication key No CLI required Automatically zeroized on session termination.
RADIUS secret
aaaconfig –-remove
The
aaaConfig --remove
zeroizes the secret
and deletes a configured server.
Table 42 Zeroization Behavior (continued)
Keys Zeroization CLI Description