Database Manual / Security / Encryption / TLS/SSL

Configure MongoDB for FIPS为FIPS配置MongoDB

Overview概述

The Federal Information Processing Standard (FIPS) is a U.S. government computer security standard used to certify software modules and libraries that encrypt and decrypt data securely. You can configure MongoDB to run with a FIPS 140-2 certified library for OpenSSL. Configure FIPS to run by default or as needed from the command line.联邦信息处理标准（FIPS）是美国政府的计算机安全标准，用于认证安全加密和解密数据的软件模块和库。您可以将MongoDB配置为使用OpenSSL的FIPS 140-2认证库运行。将FIPS配置为默认运行或根据需要从命令行运行。

A full description of FIPS and TLS/SSL is beyond the scope of this document. This tutorial assumes prior knowledge of FIPS and TLS/SSL.FIPS和TLS/SSL的完整描述超出了本文档的范围。本教程假设您具备FIPS和TLS/SSL的先验知识。

Important

MongoDB and FIPS

FIPS is a property of the encryption system and not the access control system. However, if your environment requires FIPS compliant encryption and access control, you must ensure that the access control system uses only FIPS-compliant encryption.FIPS是加密系统的属性，而不是访问控制系统的属性。但是，如果环境需要符合FIPS的加密和访问控制，则必须确保访问控制系统仅使用符合FIPS的编码。

MongoDB's FIPS support covers the way that MongoDB uses SSL/TLS libraries for network encryption, SCRAM authentication, and X.509 authentication. If you use Kerberos or LDAP authentication, you must ensure that these external mechanisms are FIPS-compliant.MongoDB的FIPS支持涵盖了MongoDB使用SSL/TLS库进行网络加密、SCRAM身份验证和X.509身份验证的方式。如果使用Kerberos或LDAP身份验证，则必须确保这些外部机制符合FIPS标准。

Note

MongoDB disables support for TLS 1.0 encryption on systems where TLS 1.1+ is available.MongoDB在TLS 1.1+可用的系统上禁用对TLS 1.0加密的支持。

Platform Support平台支持

FIPS mode is only available with MongoDB Enterprise edition. See Install MongoDB Enterprise to download and install MongoDB Enterprise.FIPS模式仅适用于MongoDB企业版。请参阅安装MongoDB企业版以下载和安装MongoDB企业版。

FIPS mode is supported on the following platforms:以下平台支持FIPS模式：

PlatformTLS/SSL library
LinuxOpenSSL
WindowsSecure Channel (SChannel)
macOSSecure Transport

OpenSSL3 SupportOpenSSL3支持

Starting in MongoDB 6.0.7, FIPS mode supports OpenSSL3 for the following operating systems:从MongoDB 6.0.7开始，FIPS模式支持以下操作系统的OpenSSL3：

  • Ubuntu 22.04
  • RHEL 9
  • Amazon Linux 2023

Starting in MongoDB 8.0, FIPS mode supports OpenSSL3 for Amazon Linux 2023.3.从MongoDB 8.0开始，FIPS模式支持适用于Amazon Linux 2023.3的OpenSSL3。

Configuring FIPS配置FIPS

Select the tab below for your platform:为平台选择下面的选项卡：

Prerequisites先决条件

Your Linux system must have an OpenSSL library configured with the FIPS 140-2 module in order to support FIPS mode for MongoDB.Linux系统必须有一个配置了FIPS 140-2模块的OpenSSL库，才能支持MongoDB的FIPS模式。

  • Verify that your OpenSSL software includes FIPS support by running the following command:通过运行以下命令验证OpenSSL软件是否包含FIPS支持：

    openssl version

  • For Red Hat Enterprise Linux 6.x (RHEL 6.x) or its derivatives such as CentOS 6.x, the OpenSSL toolkit must be at least version openssl-1.0.1e-16.el6_5 to use FIPS mode. To upgrade the OpenSSL library on these platforms, run the following command:对于Red Hat Enterprise Linux 6x(RHEL 6x)或其衍生版本，如CentOS 6x，OpenSSL工具包必须至少为openssl-1.0.1e-16.el6_5才能使用FIPS模式。要在这些平台上升级OpenSSL库，请运行以下命令：

    sudo yum update openssl

  • Some versions of Linux periodically execute a process to prelink dynamic libraries with pre-assigned addresses. This process modifies the OpenSSL libraries, specifically libcrypto. 某些版本的Linux会定期执行一个进程，用预先分配的地址预链接动态库。此过程修改OpenSSL库，特别是libcrypto。The OpenSSL FIPS mode will subsequently fail the signature check performed upon startup to ensure libcrypto has not been modified since compilation.OpenSSL FIPS模式随后将无法通过启动时执行的签名检查，以确保libcrypto自编译以来未被修改。

    To configure the Linux prelink process to not prelink libcrypto, run the following command:要将Linux预链接进程配置为不预链接libcrypto，请运行以下命令：

    sudo bash -c "echo '-b /usr/lib64/libcrypto.so.*' >>/etc/prelink.conf.d/openssl-prelink.conf"

Once you have configured your Linux system to support FIPS-compliant operation, follow the steps below to configure your mongod or mongos instance to operate in FIPS mode.将Linux系统配置为支持FIPS兼容操作后，请按照以下步骤配置mongod或mongos实例以在FIPS模式下运行。

Procedure过程

A. Configure MongoDB to use TLS/SSL配置MongoDB以使用TLS/SSL

See Configure mongod and mongos for TLS/SSL on Self-Managed Deployments for details about configuring your deployment to use TLS/SSL. Ensure that your certificate is FIPS-compliant.有关配置部署以使用TLS/SSL的详细信息，请参阅在自我管理部署上配置mongod和mongos的TLS/SSL。确保证书符合FIPS标准。

B. Run MongoDB instance in FIPS mode在FIPS模式下运行MongoDB实例

Perform these steps after you Configure mongod and mongos for TLS/SSL on Self-Managed Deployments.在自我管理部署上配置mongod和mongos的TLS/SSL后执行这些步骤。

1
Change configuration file.更改配置文件。

To configure your mongod or mongos instance to use FIPS mode, shut down the instance and update the configuration file with the net.tls.FIPSMode setting:要将mongod或mongos实例配置为使用FIPS模式，请关闭实例并使用net.tls.FIPSMode设置更新配置文件：

net:
   tls:
      FIPSMode: true
2
Start mongod or mongos instance with configuration file.使用配置文件启动mongod或mongos实例。

For example, run this command to start the mongod instance with its configuration file:例如，运行以下命令以启动mongod实例及其配置文件：

mongod --config /etc/mongod.conf

C. Confirm that FIPS mode is running确认FIPS模式正在运行

Check the server log file for a message that FIPS is active:检查服务器日志文件，查看FIPS处于活动状态的消息：

FIPS 140-2 mode activated

Prerequisites先决条件

Microsoft provides the following resource on configuring FIPS mode for Windows 10 and Windows Server 2016 or later:Microsoft提供了以下关于为Windows 10和Windows Server 2016或更高版本配置FIPS模式的资源：

➤ FIPS 140-2 Validation on Windows

Once you have configured your Windows system to support FIPS-compliant operation, follow the steps below to configure your mongod or mongos instance to operate in FIPS mode.将Windows系统配置为支持FIPS兼容操作后，请按照以下步骤配置mongod或mongos实例以在FIPS模式下运行。

Procedure过程

A. Configure MongoDB to use TLS/SSL配置MongoDB以使用TLS/SSL

See Configure mongod and mongos for TLS/SSL on Self-Managed Deployments for details about configuring your deployment to use TLS/SSL. Ensure that your certificate is FIPS-compliant.有关配置部署以使用TLS/SSL的详细信息，请参阅在自我管理部署上配置mongod和mongos的TLS/SSL。确保证书符合FIPS标准。

B. Run MongoDB instance in FIPS mode在FIPS模式下运行MongoDB实例

Perform these steps after you Configure mongod and mongos for TLS/SSL on Self-Managed Deployments.在自我管理部署上配置mongod和mongos的TLS/SSL后执行这些步骤。

1
Change configuration file.更改配置文件。

To configure your mongod or mongos instance to use FIPS mode, shut down the instance and update the configuration file with the net.tls.FIPSMode setting:要将mongod或mongos实例配置为使用FIPS模式，请关闭实例并使用net.tls.FIPSMode设置更新配置文件：

net:
   tls:
      FIPSMode: true
2
Start mongod or mongos instance with configuration file.使用配置文件启动mongod或mongos实例。

For example, run this command to start the mongod instance with its configuration file:例如，运行以下命令以启动mongod实例及其配置文件：

mongod.exe --config /etc/mongod.conf

C. Confirm that FIPS mode is running确认FIPS模式正在运行

Check the server log file for a message that FIPS is active:检查服务器日志文件，查看FIPS处于活动状态的消息：

FIPS 140-2 mode activated

Prerequisites先决条件

Supported versions of macOS are FIPS-compliant by default. Check the documentation for your version of macOS to verify its compliance status. For example, Apple provides the following resource for macOS 10.14:默认情况下，支持的macOS版本符合FIPS标准。查看macOS版本的文档，以验证其合规性状态。例如，苹果为macOS 10.14提供了以下资源：

➤ Apple FIPS Cryptographic Modules for 10.14

On compliant versions of macOS, follow the steps below to configure your mongod or mongos instance to operate in FIPS mode.在兼容的macOS版本上，请按照以下步骤配置mongod或mongos实例以在FIPS模式下运行。

Procedure过程

A. Configure MongoDB to use TLS/SSL配置MongoDB以使用TLS/SSL

See Configure mongod and mongos for TLS/SSL on Self-Managed Deployments for details about configuring your deployment to use TLS/SSL. Ensure that your certificate is FIPS-compliant.有关配置部署以使用TLS/SSL的详细信息，请参阅在自我管理部署上配置mongod和mongos的TLS/SSL。确保证书符合FIPS标准。

B. Run MongoDB instance in FIPS mode在FIPS模式下运行MongoDB实例

Perform these steps after you Configure mongod and mongos for TLS/SSL on Self-Managed Deployments.在自我管理部署上配置mongod和mongos的TLS/SSL后执行这些步骤。

1
Change configuration file.更改配置文件。

To configure your mongod or mongos instance to use FIPS mode, shut down the instance and update the configuration file with the net.tls.FIPSMode setting:要将mongod或mongos实例配置为使用FIPS模式，请关闭实例并使用net.tls.FIPSMode设置更新配置文件：

net:
   tls:
      FIPSMode: true
2
Start mongod or mongos instance with configuration file.使用配置文件启动mongod或mongos实例。

For example, run this command to start the mongod instance with its configuration file:例如，运行以下命令以启动mongod实例及其配置文件：

mongod --config /etc/mongod.conf

C. Confirm that FIPS mode is running确认FIPS模式正在运行

Check the server log file for a message that FIPS is active:检查服务器日志文件，查看FIPS处于活动状态的消息：

FIPS 140-2 mode activated

Additional Considerations补充说明

SCRAM SHA and FIPS ModeSCRAM SHA和FIPS模式

Starting in MongoDB 5.1, instances running in FIPS mode have the SCRAM-SHA-1 authentication mechanism disabled by default. 从MongoDB 5.1开始，在FIPS模式下运行的实例默认禁用SCRAM-SHA-1身份验证机制。You can enable the SCRAM-SHA-1 authentication mechanism with the setParameter.authenticationMechanisms command.您可以使用setParameter.authenticationMechanisms命令启用SCRAM-SHA-1身份验证机制。

This change will not affect drivers which target MongoDB setFeatureCompatibilityVersion 4.0+.此更改不会影响以setFeatureCompatibilityVersion为目标的驱动程序。

If you use SCRAM-SHA-1:如果您使用SCRAM-SHA-1：

mongod, mongos, and FIPS Mode

If you configure mongod and mongos to use FIPS mode, mongod and mongos use FIPS-compliant connections.如果将mongod和mongos配置为使用FIPS模式，则mongod与mongos将使用符合FIPS的连接。

Database Tools and FIPS Mode数据库工具和FIPS模式

The following programs no longer support the --sslFIPSMode option:以下程序不再支持--sslFIPSMode选项：

If you configure mongod and mongos to use FIPS mode, the preceding database tools use FIPS-compliant connections automatically.如果将mongod和mongos配置为使用FIPS模式，则前面的数据库工具会自动使用符合FIPS的连接。

MongoDB Shell and FIPS ModeMongoDB外壳和FIPS模式

The default mongosh distribution:默认的mongosh分布：

  • Contains OpenSSL 3.包含OpenSSL 3。
  • Uses FIPS-compliant connections to mongod and mongos if you configure mongod and mongos to use FIPS mode.如果您将mongod和mongos配置为使用FIPS模式，则使用符合FIPS的连接到mongod或mongos。

MongoDB also provides a MongoDB Shell distribution that can use:MongoDB还提供了一个MongoDB Shell发行版，可以使用：

  • OpenSSL 1.1 and OpenSSL 3 installed on your server.服务器上安装了OpenSSL 1.1和OpenSSL 3。
  • --tlsFIPSMode option, which enables the mongosh FIPS mode.选项，启用mongosh FIPS模式。

Tip