How to install on FIPS-compliant machines

This document provides the Landscape-specific steps needed for a FIPS-compliant Landscape deployment. The FIPS-compliant process is quite similar to the standard installation process.

Install and configure Landscape for FIPS-compliant deployments

Use the Quickstart or Manual installation guides, with the following changes:

  • Use Ubuntu 22.04 LTS

  • Run pro enable fips-updates, then reboot

  • Install Landscape Server (24.04 LTS or 26.04 LTS)

  • Use apt packages instead of snap packages

    • Snap packages can only be used if they are installed on top of a FIPS-compliant core (e.g. core22 from the fips-updates/stable channel)

  • Use external authentication instead of username/password

If you’re configuring Postfix for emails, add the following change:

  • After you’ve used Postconf to configure the /etc/postfix/main.cf file, add an additional step to manually set the SMTP TLS fingerprint digest:

    sudo postconf -e smtp_tls_fingerprint_digest=sha256

    By default, Postfix uses MD5 hashes with the TLS for backward compatibility. In FIPS mode, the MD5 hashing function is not available. SHA-256 is a secure cryptographic hash function that can be used with FIPS.