Configure Operations Agent for FIPS 140-2 Compliance

To install Operations Agent in FIPS mode, follow these steps:

1. Create a profile file manually on the node.

2. Add the following line to the file:

   set nonXPL.config:FIPS_MODE=true
   

   If JRE is installed on the agent system, also add the following line:

   set nonXPL.config:FIPS_JAVAHOME=<jre_dir_path>

   Replace <jre_dir_path> with the location of the JRE on the node, for example "C:\Program Files (x86)\Java\jre1.8.0_66". The agent installation automatically sets the FIPS_JAVAHOME variable if the HPE Software ovJREb shared component is installed.

3. Install Operations Agent by using the profile file.

   Example:

   cscript oainstall.vbs -i -a -agent_profile <path>\<profile_file> -s <management_server> [-cs <certificate_server>]

   Depending on your OMi deployment, specify the gateway server, load balancer, or reverse proxy as the agent's management server, and the data processing server as certificate server.

   For detailed information on how to install Operations Agent by using the profile file, see the Operations Agent Help.

4. In the OMi user interface, open the Certificate Requests manager and accept the new certificate request:

   Administration > Setup and Maintenance > Certificate Requests

   Alternatively, click Certificate Requests.

   For more information on granting certificate requests in OMi, see the Administer section.

5. Optional. Check that the agent is running in FIPS mode:

   ovbbccb –status

   If the output includes FIPS mode: ON, the agent is running in FIPS mode.

You can switch an already installed Operations Agent to FIPS mode by running FIPS_tool locally on the agent system. If there are already policy templates installed on the node, you must redeploy the configuration from OMi.

To switch an already installed Operations Agent to FIPS mode, follow these steps:

1. Run the FIPS_tool CLI on the Operations Agent system:

   1. Navigate to the following location:

      • Windows: %OvInstallDir%\lbin\secco\FIPS_tool

        %OvInstallDir% default: C:\Program Files\HP\HP BTO Software\

      • HP-UX, Linux, and Solaris: /opt/OV/lbin/secco/FIPS_tool

      • AIX: /usr/lpp/OV/lbin/secco/FIPS_tool

   2. Run the following command:

      perl FIPS_tool -enable_FIPS [-Java_Home <jre_dir_path>]

      Alternatively, use an already installed Java on your system, and set -Java_Home with the location of the JRE on the system.

      Example:

      "C:\Program Files\HP\HP BTO Software\nonOV\perl\a\bin\perl.exe" FIPS_tool -enable_FIPS -Java_Home "C:\Program Files (x86)\Java\jre1.8.0_66"

      Note The FIPS_tool CLI automatically sets the -Java_Home option if the HPE Software OvJREB shared component is installed on the node.

      Note Make sure to run the FIPS_tool CLI under the same user as the agent processes.

   For more information on the FIPS_tool CLI, run FIPS_tool -help.

2. Optional. Check that the agent is running in FIPS mode:

   ovbbccb –status

   If the output includes FIPS mode: ON, the agent is running in FIPS mode.

3. If the agent was previously not connected to an OMi sever running in FIPS mode, connect the agent to it and reassign the configuration to the monitored node.

4. Redeploy the assignments to the node.