|
| 1 | + |
| 2 | +# The SUSE Linux Enterprise 15 SP4 LTSS FIPS-140-3 container image |
| 3 | + |
| 4 | + |
| 5 | + |
| 6 | +[-Level_4-Green)](https://documentation.suse.com/sbp/server-linux/html/SBP-SLSA4/) |
| 7 | +[](https://documentation.suse.com/container/all/html/Container-guide/index.html#container-verify) |
| 8 | + |
| 9 | +## Description |
| 10 | + |
| 11 | + |
| 12 | +This SUSE Linux Enterprise 15 SP4 LTSS-based container image includes the |
| 13 | +OpenSSL and libgcrypt modules that have been interim validated to FIPS 140-3. |
| 14 | + |
| 15 | +The [FIPS 140-3 certified OpenSSL module](https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4725.pdf) |
| 16 | +is a cryptographic module that provides a FIPS 140-3 compliant cryptographic |
| 17 | +library. The module is designed to provide the same functionality as the |
| 18 | +standard OpenSSL library, with additional security features to meet the FIPS |
| 19 | +140-3 requirements. [An interim validation has been issued](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4725) |
| 20 | +by NIST. |
| 21 | + |
| 22 | +Similarly, the [FIPS 140-3 certified libgcrypt module](https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4722.pdf) |
| 23 | +is designed to provide the same functionality as the standard libgcrypt |
| 24 | +library, with additional security features enforced to meet the FIPS 140-3 |
| 25 | +requirements. [An interim validation has been issued](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4722) |
| 26 | +by NIST. |
| 27 | + |
| 28 | + |
| 29 | + |
| 30 | +## Usage |
| 31 | +The image is configured to enforce the use of FIPS mode by default, |
| 32 | +independent of the host environment setup by specifying the following |
| 33 | +environment variables: |
| 34 | +* `OPENSSL_FIPS=1`: Initialize the OpenSSL FIPS mode |
| 35 | +* `OPENSSL_FORCE_FIPS_MODE=1`: Set FIPS mode to enforcing independent of the host kernel |
| 36 | +* `LIBGCRYPT_FORCE_FIPS_MODE=1`: Set FIPS mode in libgcrypt to enforcing |
| 37 | + |
| 38 | +Below is a list of other environment variables that can be used to configure the OpenSSL library: |
| 39 | + |
| 40 | +* `OPENSSL_ENFORCE_MODULUS_BITS=1`: Restrict the OpenSSL module to only generate |
| 41 | +the acceptable key sizes of RSA. |
| 42 | +## Accessing the container image |
| 43 | + |
| 44 | +Accessing this container image requires a valid SUSE subscription. In order |
| 45 | +to access the container image, you must login to the SUSE Registry with your credentials. |
| 46 | +There are three ways to do that which are described below. The first two methods |
| 47 | +leverage the system registration of your host system, while the third method |
| 48 | +requires you to obtain the organisation SCC mirroring credentials. |
| 49 | + |
| 50 | +### Use the system registration of your host system |
| 51 | + |
| 52 | +If the host system you are using to build or run a container is already registered with |
| 53 | +the correct subscription required for accessing the LTSS container images, you can use |
| 54 | +the registration information from the host to log in to the registry. |
| 55 | + |
| 56 | +The file `/etc/zypp/credentials.d/SCCcredentials` contains a username and a password. |
| 57 | +These credentials allow you to access any container that is available under the |
| 58 | +subscription of the respective host system. You can use these credentials to log |
| 59 | +in to SUSE Registry using the following commands |
| 60 | +(use the leading space before the echo command to avoid storing the credentials in the |
| 61 | +shell history): |
| 62 | + |
| 63 | +```ShellSession |
| 64 | +set +o history |
| 65 | + echo PASSWORD | podman login -u USERNAME --password-stdin registry.suse.com |
| 66 | +set -o history |
| 67 | +``` |
| 68 | + |
| 69 | +### Use a separate SUSE Customer Center registration code |
| 70 | + |
| 71 | +If the host system is not registered with SUSE Customer Center, you can use a valid |
| 72 | +SUSE Customer Center registration code to log in to the registry: |
| 73 | + |
| 74 | +```ShellSession |
| 75 | +set +o history |
| 76 | + echo SCC_REGISTRATION_CODE | podman login -u "regcode" --password-stdin registry.suse.com |
| 77 | +set -o history |
| 78 | +``` |
| 79 | +The user parameter in this case is the verbatim string `regcode`, and |
| 80 | +`SCC_REGISTRATION_CODE` is the actual registration code obtained from SUSE. |
| 81 | + |
| 82 | +### Use the organization mirroring credentials |
| 83 | + |
| 84 | +You can also use the organization mirroring credentials to log in to the |
| 85 | +SUSE Registry: |
| 86 | + |
| 87 | +```ShellSession |
| 88 | +set +o history |
| 89 | + echo SCC_MIRRORING_PASSWORD | podman login -u "SCC_MIRRORING_USER" --password-stdin registry.suse.com |
| 90 | +set -o history |
| 91 | +``` |
| 92 | + |
| 93 | +These credentials give you access to all subscriptions the organization owns, |
| 94 | +including those related to container images in the SUSE Registry. |
| 95 | +The credentials are highly privileged and should be preferably used for |
| 96 | +a private mirroring registry only. |
| 97 | +## Licensing |
| 98 | + |
| 99 | +`SPDX-License-Identifier: MIT` |
| 100 | + |
| 101 | +This documentation and the build recipe are licensed as MIT. |
| 102 | +The container itself contains various software components under various open source licenses listed in the associated |
| 103 | +Software Bill of Materials (SBOM). |
| 104 | + |
| 105 | +This image is based on [SUSE Linux Enterprise Server](https://www.suse.com/products/server/), a reliable, |
| 106 | +secure, and scalable server operating system built to power mission-critical workloads in physical and virtual environments. |
0 commit comments