HP StorageWorks 8/80 HP StorageWorks Fabric OS 6.2 administrator guide (5697-0 - Page 157

Table 42 Zeroization Behavior (continued) Keys Zeroization CLI SSH Session Key No CLI required SSH RSA private Key No CLI required RNG Seed Key No CLI required Passwords passwddefault fipscfg --zeroize TLS private keys seccertutil delkey TLS pre-master secret TLS session key TLS authentication key RADIUS secret No CLI required No CLI required No CLI required aaaconfig --remove Description Generated for each SSH session that is established to and from the host. Automatically zeroizes on session termination. Key-based SSH authentication is not used for SSH sessions. /dev/urandom is used as the initial source of seed for RNG. RNG seed key is zeroized on every random number generation. Removes user-defined accounts in addition to default passwords for the root, admin, and user default accounts. However, only root has permissions for this command. So securityadmin and admin roles need to use fipsCfg --zeroize, which in addition to removing user accounts and resetting passwords, also does the complete zerioization of the system. The command secCertUtil delkey is used to zeroize these keys. Automatically zeroized on session termination. Automatically zeroized on session termination. Automatically zeroized on session termination. The aaaConfig --remove zeroizes the secret and deletes a configured server. Power-on self tests POSTs are invoked by powering on the switch in FIPS mode and do not require operator intervention. These POSTs perform power-on self-tests. If any KATs fail, the switch goes into a FIPS Error state which reboots the system to start the tests again. If the switch continues to fail the FIPS POSTs, you will need to boot into single-user mode and perform a recovery procedure to reset the switch. For more information on this procedure, see the Fabric OS Troubleshooting and Diagnostics Guide. Conditional Tests Conditional tests are executed to verify that the randomness of the random number generator. The conditional tests are executed prior to using a random number provided by the random number generator. The results of all self-tests, both power-up and conditional, are recorded in the system log or are output to the local console. This includes logging both passing and failing results. See the Fabric OS Troubleshooting and Diagnostics Guide for recovery instructions if your system cannot get out of the conditional test mode. FIPS mode configuration By default, the switch comes up in non-FIPS mode. You can run the fipsCfg --enable fips command to enable FIPS mode, but you need to configure the switch first. Self-tests mode must be enabled before FIPS mode can be enabled. A set of prerequisites as mentioned in Table 43 must be satisfied for the system to enter FIPS mode. To be FIPS-compliant, the switch must be rebooted. KATs are run on the reboot. If the KATs are successful, the switch enters FIPS mode. If KATs fail, the switch reboots until the KATs succeed. If the switch cannot enter FIPS mode and continues to reboot, you must access the switch in single-user mode to break the reboot cycle. For more information on how to fix this issue, see the Fabric OS Troubleshooting and Diagnostics Guide. Fabric OS 6.2 administrator guide 155