About FIPS support in NetBackup
By default, the FIPS mode is disabled in NetBackup.
The following workloads are supported in FIPS-compliant mode:
Oracle, MS-SQL, SAP HANA, DB2, VMware, Hyper-V, RHV, Nutanix, DynamicNAS, MongoDB, Hadoop, HBase, MySQL, PostgreSQL, SQLite, MariaDB, SharePoint
The following operating system-level support is available in the FIPS mode:
Once you enable the FIPS mode on RHEL 8, the operating system requires that each RPM package has a SHA-256 digest. RPMs that do not have this digest will fail to install. The RPMs that are built using the native toolchain present on RHEL 6 or RHEL 7 platforms do not include a SHA-256 digest and therefore can fail to install on RHEL 8 when the FIPS mode is enabled. This issue affects NetBackup 9.1 and earlier setups as packages for these versions are built using the OS native toolchain on RHEL 7 or earlier.
Starting with NetBackup 10.0, the packages are built using a toolchain that adds the SHA-256 digest and these can be installed on RHEL 8 with the FIPS mode enabled.
The following components, configurations, or operations are not supported in the FIPS mode:
Client-side encryption
Note:
To perform a backup with client-side encryption, you need to disable the FIPS mode on the client host.
NDMP backups
Sybase database used by NetBackup
NetBackup installation and upgrade
nbcheck and nbtelemetry operations
Disaster recovery
Scripts (Perl, batch, shell, python) that are executed within NetBackup
OpsCenter
Binaries or utilities: restore_spec_utility, rbac_user_migration, nbcloudrestore, nbcallhomeproxyconfig, nbdeployutil, vwcp_manage, nbfcv, nbbsdtar, bpkeyutil, nbrepo
NetBackup domain with NBAC enabled
If NBAC is configured in the NetBackup domain, it is recommended that you do not enable the FIPS mode.
The MQBROKER processes do not support NetBackup-level FIPS configuration on Windows.
MIT Kerberos used by Hadoop and HBase does not operate with a FIPS-enabled OpenSSL. To perform backup with Kerberos authentication, you need to disable FIPS on the backup host.
NetBackup CloudPoint does not support the CloudPoint host that is configured in the FIPS mode.
SharePoint internally uses encryption algorithms that do not comply with FIPS standards. The Windows FIPS policy blocks the MD5 hashing algorithms that SharePoint uses. Therefore, the OS-level FIPS policy should be disabled for the SharePoint restores for successful operation.
Note that NetBackup-FIPS is supported for protecting SharePoint.
See the following articles for more details: