Determining if a Host Is in FIPS Mode

Explains how to use the CLI, REST commands, or the Control System to determine if a host is in FIPS mode.

Determining if a Host Is in FIPS Mode Using the CLI and REST API

About this task

FIPS is a host-specific property, not a cluster-wide property. It is possible to have a mix of FIPS-compliant and non-FIPS compliant nodes in the same cluster.

Release 7.0.0 enhanced the output of the maprcli node list command to include a new isFips field name. When the value of isFips is 1, the Data Fabric core platform is in FIPS mode on the specified host. If the value is 0, the core platform is in non-FIPS mode.

CLI

Run the maprcli node list -json command to determine if a node is in FIPS or non-FIPS mode:

$ maprcli node list -json 
{ 
  "timestamp":1629755217258, 
  "timeofday":"2021-08-23 02:46:57.258 GMT-0700 PM", 
  "status":"OK", 
  "total":1, 
  "data":[ 
    { 
      "id":"3229336703213394432", 
      "ip":"10.163.166.250", 
      "hostname":"fips0.storage.hpecorp.net", 
      "racktopo":"/data/default-rack/fips0.storage.hpecorp.net", 
      "labels":[ 
        "default" 
      ], 
      "isFips":1, 
      "health":0, 
      ...
Another option is to run the sysctl crypto.fips_enabled command. This is the command that the configure.sh script uses to determine if the operating system is FIPS-enabled:
sudo sysctl crypto.fips_enabled
crypto.fips_enabled = 1
Another option is to run the following command:
fips-mode-setup --check
FIPS mode is enabled.
REST
Use the REST equivalent of the maprcli node list command, which returns the isFips value for each node:
curl -u <username>:<password> -X GET -k "https://host:8443/rest/node/list"
Control System
On the Nodes page, double-click a Hostname to display node-detail information that includes the FIPS status:

You can also customize the Nodes pane on the Nodes page to include the FIPS status. See Viewing the list of Nodes and Customizing the List of Columns/Fields.