About FIPS support in NetBackup
By default, FIPS mode is disabled in NetBackup.
The following workloads are supported in FIPS-compliant mode:
Oracle, MS-SQL, SAP HANA, DB2, VMware, Hyper-V, RHV, Nutanix, DynamicNAS, MongoDB, Hadoop, HBase, MySQL, PostgreSQL, SQLite, MariaDB, SharePoint
Cassandra, Sybase, Informix, MS-Exchange, Enterprise Vault, BMR, Universal Shares, OpenStack (cloud-based solution)
The following operating system-level support is available in FIPS mode:
Once you enable FIPS mode on RHEL 8, the operating system requires that each RPM package has a SHA-256 digest. RPMs that do not have this digest will fail to install. The RPMs that are built using the native toolchain present on RHEL 6 or RHEL 7 platforms do not include a SHA-256 digest and therefore can fail to install on RHEL 8 when FIPS mode is enabled. This issue affects NetBackup 9.1 and earlier setups as packages for these versions are built using the OS native toolchain on RHEL 7 or earlier.
Starting with NetBackup 10.0, the packages are built using a toolchain that adds the SHA-256 digest and these can be installed on RHEL 8 with FIPS mode enabled.
The following components, configurations, or operations are not supported in FIPS mode:
Client-side encryption
Note:
To perform a backup with client-side encryption, you need to disable FIPS mode on the client host.
NDMP backups
Scripts (Perl, batch, shell, python) that are executed within NetBackup
Binaries or utilities: restore_spec_utility, nbcallhomeproxyconfig, nbbsdtar, nbrepo
NetBackup domain with NBAC enabled
If NBAC is configured in the NetBackup domain, it is recommended that you do not enable FIPS mode.
The MQBROKER processes do not support NetBackup-level FIPS configuration on Windows.
MIT Kerberos used by Hadoop and HBase does not operate with a FIPS-enabled OpenSSL. To perform backup with Kerberos authentication, you need to disable FIPS on the backup host.
NetBackup CloudPoint does not support the CloudPoint host that is configured in FIPS mode.
SharePoint internally uses encryption algorithms that do not comply with FIPS standards. The Windows FIPS policy blocks the MD5 hashing algorithms that SharePoint uses. Therefore, the OS-level FIPS policy should be disabled for the SharePoint restores for successful operation.
Note that NetBackup-FIPS is supported for protecting SharePoint.
See the following articles for more details: