How to install on FIPS-compliant machines

This document provides the Landscape-specific steps needed for a FIPS-compliant Landscape deployment. The FIPS-compliant process is quite similar to the standard installation process.

Install and configure Landscape for FIPS-compliant deployments

Use the Quickstart or Manual installation guides, with the following changes:

  • Use Ubuntu 22.04 LTS

  • Run pro enable fips-updates, then reboot

  • Install Landscape Server (24.04 LTS or 26.04 LTS)

  • Use apt packages instead of snap packages

    • Snap packages can only be used if they are installed on top of a FIPS-compliant core (e.g. core22 from the fips-updates/stable channel)

  • Use external authentication instead of username/password

If you’re installing Landscape 24.04 LTS on Ubuntu 22.04 LTS with Ubuntu Pro enabled, pin python3-pydantic to the Landscape PPA version before installing Landscape. Otherwise, Ubuntu Pro’s ESM Apps repository may prefer an older python3-pydantic package that doesn’t satisfy Landscape 24.04’s dependency requirements.

printf "Package: python3-pydantic\nPin: version 2.4.2-landscape*\nPin-Priority: 1001\n" | sudo tee /etc/apt/preferences.d/landscape-fips-pydantic
sudo apt-get update

If you’re configuring Postfix for emails, add the following change:

  • After you’ve used Postconf to configure the /etc/postfix/main.cf file, add an additional step to manually set the SMTP TLS fingerprint digest:

    sudo postconf -e smtp_tls_fingerprint_digest=sha256

    By default, Postfix uses MD5 hashes with the TLS for backward compatibility. In FIPS mode, the MD5 hashing function is not available. SHA-256 is a secure cryptographic hash function that can be used with FIPS.