Making Configuration Changes; Set Up Fips 140-2 Certificates - Fidelis Common Criteria Configuration Manual

Component
K2
K2
Direct Sensor
Collector
Mail (Milter)
Mail (MTA)
Web Sensor

Making Configuration Changes

The vi editor (/bin/vi) may be used when making manual changes to files on a Fidelis Network system.

Set Up FIPS 140-2 Certificates

Fidelis Network ships with FIPS 140-2 mode for communication enabled by default. Users must install
and set up FIPS 140-2-compliant certificates and enable FIPS 140-2 encryption for data storage on K2.
To install and set up FIPS 140-2-compliant certificates, refer to Appendix A in the Enterprise Setup and
Configuration Guide[1].
The Common Criteria-compliant Random Number Generation (RNG), cipher suites, DH and RSA key
sizes, hash algorithms, NIST elliptic curves, and TLS version 1.2 are configured by default and do not
require user intervention, when the procedures in Appendix A of the Enterprise Setup and
Configuration Guide [1] are followed. For example, when generating a Certificate Signing Request (CSR),
no additional configuration is required to generate a new RSA private key. A new RSA key of 3072-bit
length is generated by default .
Fidelis Network Common Criteria Configuration Guide Version 9.0.3
Process Name Privilege
netspool Runs with
setuid
httpd Runs as root
sniffer Runs as root
sesdbd Runs with
setuid
mailer Runs with
setuid
postfix Runs as root
icapd Runs with
setuid
Description
Accepts alert and statistical data
from the different components
configured
Web server for spawning GUI for
users
Captures packets from the sniffing
interfaces configured and
reassembles them into transport
protocol sessions
Receives metadata sent from
sensors and writes it into the
database
Receives emails for processing
from an MTA and processes them
for policy violations
Serves as a MTA that receives,
analyzes and forwards email traffic
Receives ICAP traffic from a Web
Proxy and processes it for policy
violations.
18 www.fidelissecurity.com