Configuring Arctera InfoScale Operations Manager Management Server and Agents in FIPS mode on Linux

Last published : Jun 19, 2026
The Federal Information Processing Standards (FIPS) 140-2 standard (commonly referred as FIPS mode) specifies the security requirements for cryptographic modules. The U.S. federal government has set an encryption standard for its non-military agencies, contractors, and service providers who work with the U.S. government must also follow FIPS. Hence, it is mandatory to configure and enable the FIPS 140-2 standard.
You can configure and enable FIPS mode for Arctera InfoScale Operations Manager Management Server and Agents. By default, FIPS-compliant mode is turned off when the Arctera InfoScale Operations Manager Management Server platform is installed. However, you can turn on FIPS mode for one or more nodes in your deployment. Configuration of Arctera InfoScale Operations Manager to run in FIPS mode includes the following sequence of process:
  • Enabling the FIPS mode on Arctera InfoScale Operations Manager Management Server (installed on Linux)
  • Enabling the FIPS mode on the third-party components that are used in Arctera InfoScale Operations Manager (Tomcat, Java)
  • Enabling the FIPS mode on Arctera InfoScale Operations Manager Agents (Linux, Solaris, and AIX)
Prerequisites to configure Arctera InfoScale Operations Manager in FIPS mode
  • FIPS mode can be enabled only with a fresh installation of Arctera InfoScale Operations Manager Server on a Linux system. Configuration of an existing Arctera InfoScale Operations Manager to run in FIPS mode is not supported in this release.
  • FIPS mode can be enabled only on Agents running on Linux, Solaris, or AIX. In this release, agents that are running on other operating systems cannot be configured in FIPS mode.
  • To verify if OpenSSL is installed, run the /usr/bin/openssl version command.
To enable FIPS mode on fresh installation of Arctera InfoScale Operations Manager Management Server on Linux
  1. Perform a fresh installation of Arctera InfoScale Operations Manager Management Server on Linux.
  2. Open theVRTSatlocal.conf configuration file that is located at/opt/VRTSsfmcs/sec/bin/.
  3. Under the Security\Authentication\Client section, enable the FIPS mode as follows:
[Security\Authentication\Client] "FipsMode"=dword:00000001 "ConnectTimeout"=dword:00000014
  1. Open a browser and configure Arctera InfoScale Operations Manager Management Server.
  2. Once the Arctera InfoScale Operations Manager Management Server configuration is successful, you may open the VRTSatlocal.confconfiguration file that is located at/var/opt/VRTSsfmcs/sec/root/.VRTSat/profile/and verify if the "FipsMode"=dword:00000001 is set.
To enable FIPS mode on Tomcat and Java components used in Arctera InfoScale Operations Manager
  1. Create a trusted Java KeyStore (JKS) for the Tomcat web server with imported certificates provided by a trusted Certificate Authority. For more information, seehttps://helpcenter.cloud.com/wolken-support/kbsearch-article-100026835
  2. Back up the following files:
    • /opt/VRTSsfmcs/webgui/jre/conf/security/java.security
    • /opt/VRTSsfmcs/webgui/tomcat/conf/server.xml
  3. Copy and overwrite the following files as follows:
    • cp /opt/VRTSsfmcs/webgui/jre/conf/security/java.security.fips /opt/VRTSsfmcs/webgui/jre/conf/security/java.security
    • cp/opt/VRTSsfmcs/webgui/tomcat/conf/server.xml.fips /opt/VRTSsfmcs/webgui/tomcat/conf/server.xml
    • cp /opt/VRTSsfmcs/webgui/tomcat/bin/setenv.sh.fips /opt/VRTSsfmcs/webgui/tomcat/bin/setenv.sh
  4. Edit the server.xml that is located at /opt/VRTSsfmcs/webgui/tomcat/conf/ and add the CMS hostname (FQDN) in the Connector tag and Connector > SSLHostConfig tag respectively as follows:
    • defaultSSLHostConfigName="<FQDN>"
    • hostName="<FQDN>"
  5. Convert the Java KeyStore (JKS) to the BC FIPS Keystore (BCFKS) format using the following command:
/opt/VRTSsfmcs/webgui/jre/bin/keytool -importkeystore -srckeystore .keystore -srcstoretype pkcs12 -deststoretype BCFKS -destkeystore .keystore -srcstorepass changeit -deststorepass changeit -providerclass com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider -J--module-path=/opt/VRTSsfmcs/webgui/jre/lib/ccj-3.0.1.jar -J--add-modules=ccj -J--add-exports=java.base/sun.security.provider=ccj -J--add-exports=java.base/sun.security.internal.spec=ccj
Note: To verify the conversion of JKS to BCFKS use the following command:/opt/VRTSsfmcs/webgui/jre/bin/keytool -list -keystore /opt/VRTSsfmcs/webgui/tomcat/cert/.keystore -storepass changeit -storetype BCFKS -providername CCJ -providerpath "/opt/VRTSsfmcs/webgui/jre/lib/ext/ccj-3.0.1.jar" -providerclass com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
  1. Restart Arctera InfoScale Operations Manager web server using the following command:/opt/VRTSsfmcs/bin/vomsc --restart web
To enable FIPS mode on Arctera InfoScale Operations Manager Agents running on Linux, Solaris, AIX
  1. Open Arctera InfoScale Operations Manager Management Server in a browser.
  2. Add Linux, Solaris, or AIX Agents having Arctera InfoScale Operations Manager version 8.0, 8.0.2 to Arctera InfoScale Operations Manager Management Server.
The FIPS mode can be enabled only on Agents running on Linux, Solaris, or AIX having Arctera InfoScale Operations Manager version 8.0 and 8.0.2
Note: In this release, agents that are running on other operating systems cannot be configured in FIPS mode.