EFM: FIPS Compliance & Secure Authentication Methods

Nov 21, 2025 by Alex Johnson 53 views

EFM: FIPS Compliance and Secure Authentication Methods

Introduction

This document addresses the critical discussion around Enterprise Failover Manager (EFM) prerequisites, specifically focusing on the transition from older authentication methods like MD5 to more secure, FIPS-compliant alternatives. As EDB continues to enhance EFM with robust security features, it's crucial to ensure that configurations align with the latest standards, particularly in FIPS (Federal Information Processing Standards) environments. This article will delve into the prerequisites for configuring EFM in a FIPS-compliant manner, highlighting the necessary steps and considerations for secure authentication and communication within the cluster. The discussion stems from a concern raised about the documentation depicting MD5 for communication between nodes, which is no longer compliant with FIPS 140-3 standards, especially considering the advancements in EFM versions 5.1 and 4.8. Therefore, this article aims to provide a comprehensive guide on achieving FIPS compliance with EFM, emphasizing secure authentication methods and configurations.

The Issue: MD5 Authentication and FIPS Compliance

The core issue revolves around the use of MD5 (Message Digest 5) for authentication in EFM configurations, as highlighted in the documentation. MD5 is a cryptographic hash function widely used for verifying data integrity but is now considered insecure for authentication purposes due to its vulnerability to collision attacks. The EFM documentation, specifically in the context of configuring pg_hba.conf, illustrates MD5 as a method for inter-node communication within the cluster. However, the introduction of the Bouncy Castle cryptographic library in EFM 5.1, which is FIPS 140-3 certified, inherently excludes support for MD5. This incompatibility poses a challenge for organizations aiming to operate EFM in a FIPS-compliant environment, where only validated cryptographic algorithms are permitted. Moreover, EFM 4.8's enhancement for encrypting database passwords in FIPS environments further underscores the need to move away from MD5. Therefore, it is imperative to update the documentation and provide clear guidance on configuring secure authentication methods that align with FIPS standards, such as scram-sha-256.

Expected Behavior: Secure Authentication Methods

To ensure FIPS compliance and robust security, it is essential to transition from MD5 to more secure authentication methods. The recommended approach involves using scram-sha-256 (Salted Challenge Response Authentication Mechanism with SHA-256) for password encryption and authentication. This method provides a significantly higher level of security compared to MD5, aligning with FIPS requirements and industry best practices. The suggested configuration changes in pg_hba.conf reflect this shift, emphasizing the use of scram-sha-256 for local connections and inter-node communication. Furthermore, the use of hostssl with clientcert=1 adds an extra layer of security by enforcing SSL encryption and requiring client certificates for authentication, which is crucial for a robust FIPS-compliant Public Key Infrastructure (PKI) setup. By adopting these secure authentication methods, EFM can operate securely within FIPS environments, safeguarding sensitive data and ensuring compliance with regulatory standards. The expected behavior is to have all communication within the EFM cluster authenticated using FIPS-compliant methods, eliminating the vulnerabilities associated with MD5.

# TYPE  DATABASE        USER            CIDR-ADDRESS            METHOD          [OPTIONS]

# Allow local connections (optional, adjust as needed)
host    all             all             127.0.0.1/32            scram-sha-256
host    all             all             ::1/128                 scram-sha-256

# Allow communication between cluster nodes, enforcing SSL and FIPS-compliant auth
# Replace with actual IP ranges and specific user/database names if necessary
hostssl all             all             10.0.0.0/8              scram-sha-256   clientcert=1

FIPS 140-3 Configuration Questions and Considerations

Achieving FIPS 140-3 compliance with EFM requires careful consideration of several factors, ranging from general compliance requirements to specific cryptographic configurations. Understanding these considerations is crucial for a successful deployment in a FIPS environment. Here are some key questions and aspects to address:

1. General FIPS Compliance and Support

Understanding the foundational requirements for FIPS compliance is the first step in configuring EFM for secure operation. The following questions need to be addressed:

What are the official EDB requirements or prerequisites (OS, EFM version, database version) for running EFM in a FIPS 140-3-compliant setup? To operate EFM in a FIPS 140-3-compliant manner, it's essential to identify the specific EDB requirements, including the supported operating systems, EFM versions, and database versions. EDB provides guidelines on the versions of EFM and PostgreSQL that are compatible with FIPS mode, ensuring that all components adhere to the necessary security standards. Organizations should consult the official EDB documentation for a comprehensive list of supported platforms and versions, as using unsupported versions may introduce vulnerabilities and compliance issues.
Is there a specific FIPS mode flag or configuration parameter within EFM that needs to be enabled? EFM may have a dedicated FIPS mode or configuration parameter that needs to be enabled to enforce FIPS-compliant operations. This flag ensures that EFM utilizes only FIPS-validated cryptographic modules and algorithms, preventing the use of non-compliant methods. Enabling FIPS mode typically involves modifying the EFM configuration file or using command-line options during installation or setup. Clear documentation on how to enable this mode is critical for administrators to ensure proper FIPS compliance within the EFM environment. It’s also important to understand the implications of enabling FIPS mode, such as potential performance impacts or compatibility issues with certain features or extensions.

2. Cryptography and Communication Security (SSL/TLS)

Cryptography and secure communication are at the heart of FIPS compliance. This section explores the critical aspects of securing network communications within the EFM cluster.

Does EFM utilize the underlying operating system's FIPS 140-3 validated cryptographic module (e.g., OpenSSL FIPS mode) for all network communications (agent-to-agent, agent-to-database, and application-to-database connections)? EFM should leverage the operating system's FIPS 140-3 validated cryptographic module, such as OpenSSL in FIPS mode, for all network communications. This ensures that cryptographic operations, including encryption, decryption, and hashing, are performed using validated algorithms and modules. Agent-to-agent, agent-to-database, and application-to-database connections must be secured using FIPS-compliant protocols and configurations. Verifying that EFM is configured to use the system's FIPS-validated cryptographic module is crucial for maintaining compliance. This may involve configuring EFM to link against the FIPS-enabled version of OpenSSL or other cryptographic libraries.
What TLS protocols (e.g., TLS 1.2, TLS 1.3) and FIPS-approved cipher suites are supported and required for secure inter-cluster communication? To achieve secure inter-cluster communication, EFM must support and enforce the use of TLS protocols (e.g., TLS 1.2, TLS 1.3) and FIPS-approved cipher suites. These protocols provide encryption and authentication for network connections, ensuring the confidentiality and integrity of data transmitted between EFM nodes. FIPS-approved cipher suites are cryptographic algorithms that have been validated by NIST (National Institute of Standards and Technology) for use in FIPS-compliant systems. Configuring EFM to use only these cipher suites is essential for maintaining FIPS compliance. Administrators should disable any non-compliant or weaker cipher suites to prevent security vulnerabilities. Regularly reviewing and updating the list of supported cipher suites is also crucial as cryptographic standards evolve.
How is key and certificate management handled securely within EFM to meet FIPS requirements for key generation, storage, and access control? Secure key and certificate management is a cornerstone of FIPS compliance. EFM must handle key generation, storage, and access control in a manner that meets FIPS requirements. This includes using FIPS-validated key generation algorithms, storing keys securely using hardware security modules (HSMs) or other FIPS-compliant methods, and implementing strict access controls to prevent unauthorized access to cryptographic keys. Certificate management involves the issuance, distribution, and revocation of digital certificates used for authentication and encryption. EFM should support the use of FIPS-compliant certificate authorities (CAs) and certificate revocation mechanisms. Regularly rotating keys and certificates and monitoring access logs are also important security practices for maintaining FIPS compliance.
Are there any non-FIPS-compliant algorithms or legacy protocols that must be explicitly disabled in the EFM configuration? To ensure strict FIPS compliance, any non-FIPS-compliant algorithms or legacy protocols must be explicitly disabled in the EFM configuration. This includes algorithms like MD5, SHA-1 (Secure Hash Algorithm 1), and older versions of SSL/TLS that are considered insecure. Disabling these protocols and algorithms prevents their use in EFM operations, reducing the risk of security vulnerabilities and compliance violations. Administrators should review the EFM configuration settings and disable any non-compliant options. Regular security audits and vulnerability assessments can help identify and address any remaining non-compliant configurations.

3. Database Connectivity and Replication

EFM's interaction with the database is a critical area for FIPS compliance, particularly in ensuring that connectivity and replication processes adhere to security standards.

What specific PostgreSQL/EDB Postgres Advanced Server configuration settings (e.g., ssl_ciphers, ssl_cert_file) must be aligned with FIPS 140-3 standards to ensure EFM's connectivity to the primary and standby nodes is compliant? To ensure FIPS 140-3 compliance, specific PostgreSQL or EDB Postgres Advanced Server configuration settings must be aligned with FIPS standards. These settings include parameters such as ssl_ciphers and ssl_cert_file, which govern the encryption and authentication of connections. The ssl_ciphers setting should be configured to use only FIPS-approved cipher suites, ensuring that all encrypted communication uses validated algorithms. The ssl_cert_file setting specifies the location of the SSL certificate file used for secure connections, and it must be managed in a FIPS-compliant manner, including secure storage and access controls. Properly configuring these settings is crucial for ensuring that EFM’s connectivity to the primary and standby nodes is secure and compliant. Regular reviews of these settings are recommended to stay aligned with evolving security best practices and FIPS requirements.

Conclusion

In conclusion, achieving FIPS 140-3 compliance with Enterprise Failover Manager (EFM) requires a thorough understanding of FIPS requirements and careful configuration of EFM and its underlying components. Transitioning from non-compliant methods like MD5 to secure authentication mechanisms such as scram-sha-256 is crucial. Additionally, ensuring that all cryptographic operations utilize FIPS-validated modules and algorithms, and that key and certificate management adheres to strict security standards, is essential for maintaining compliance. By addressing the questions and considerations outlined in this article, organizations can confidently deploy EFM in FIPS environments, safeguarding their data and adhering to regulatory requirements. For further information on FIPS 140-3 compliance and best practices, please visit the NIST Computer Security Resource Center. This resource provides comprehensive guidance and standards for implementing FIPS-compliant systems.