diff --git a/docs/how-to-guides/landscape-installation-and-set-up/install-on-fips-compliant-machines.md b/docs/how-to-guides/landscape-installation-and-set-up/install-on-fips-compliant-machines.md index 8f778ad0..c2e3fd10 100644 --- a/docs/how-to-guides/landscape-installation-and-set-up/install-on-fips-compliant-machines.md +++ b/docs/how-to-guides/landscape-installation-and-set-up/install-on-fips-compliant-machines.md @@ -1,9 +1,11 @@ (how-to-install-fips-compliant)= -# How to install on FIPS-compliant machines +# How to install a FIPS-compliant Landscape Server -This document provides the Landscape-specific steps needed for a FIPS-compliant Landscape deployment. The FIPS-compliant process is quite similar to the standard installation process. +This document provides the Landscape-specific steps needed for a FIPS-compliant Landscape deployment. The FIPS-compliant process is quite similar to the standard installation process. -## Install and configure Landscape for FIPS-compliant deployments +Note that for FIPS-compliant deployments, Landscape Quickstart isn't suitable for large estates (over a few hundred machines). This is due to some performance configuration introduced by the `openssl` 3.0 package which incorporates delays. To manage a large, FIPS-compliant estate, use the Juju deployment method, which allows for horizontal scaling to overcome this limitation. + +## The FIPS-compliant Landscape Quickstart deployment checklist Use the {ref}`Quickstart ` or {ref}`Manual ` installation guides, with the following changes: @@ -23,6 +25,26 @@ If you're {ref}`configuring Postfix for emails `, add By default, Postfix uses MD5 hashes with the TLS for backward compatibility. In FIPS mode, the MD5 hashing function is not available. SHA-256 is a secure cryptographic hash function that can be used with FIPS. +## The FIPS-compliant Landscape Juju deployment checklist + +- Specify that FIPS should be enabled within a cloud-init.yaml file + + ```yaml + #cloud-config + ubuntu_pro: + token: + enable: + - fips-updates + ``` + +- Ensure that every new machine Juju provisions in this model will have FIPS enabled at first boot, by using this cloud-init.yaml file as the model config in Juju: + + ```bash + juju model-config --file cloudinit-userdata.yaml + ``` + +- Follow the [Juju installation steps](../juju-installation/). + ## Related topics Outside of Landscape, there are additional steps you may need when setting up your full FIPS-compliant deployment. See the following related topics: