FIPS client drivers

• 1: Installing the FIPS client driver for JDBC
• 2: Installing the FIPS client driver for ODBC and vsql

1 - Installing the FIPS client driver for JDBC

Vertica offers a JDBC client driver that is compliant with the Federal Information Processing Standard (FIPS). Use this JDBC client driver to access systems that are FIPS-compatible. For more information on FIPS, see Federal information processing standard.

Implementing FIPS on a JDBC client requires a third-party JRE extension called BouncyCastle, a collection of APIs used for cryptography. Use BouncyCastle APIs with JDK 1.7 and 1.8, and a supported FIPS-compliant operating system.

The following procedure adds the FIPS BouncyCastle .jar as a JVM JSSE provider:

1. Download the BouncyCastle FIPS .jar file bc-fips-1.0.0.jar.

2. Add bc-fips-1.0.0.jar as a JRE library extension:

   path/to/jre/lib/ext/bc-fips-1.0.0.jar
   

3. Add BouncyCastle as an SSL security provider in <path to jre>/lib/security/java.security:

   security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastle FipsProvider
   security.provider.2=com.sun.net.ssl.internal.ssl.Provider BCFIPS
   security.provider.3=sun.security.provider.Sun
   

4. Use the following JVM java -D system property command arguments to set the KeyStore and TrustStore files to BCFIPS:

   export JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.keyStoreProvider=BCFIPS
   export JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStoreProvider=BCFIPS
   

5. Set the default type for the KeyStore implementation to BCFKS in path/to/jre/lib/security/java.security:

   keystore type=BCFKS
   ssl.keystore.type=BCFKS
   

   Note

   If you are using FIPS with BouncyCastle, you must create all client keys and certificates with the BCFKS store type, including the Vertica-to-Kafka keys and certificates.

6. Create the BCFKS-type keystore and truststore:

   cd path/to/jre
   -storetype BCFKS
   -providername BCFIPS
   -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
   -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
   -providerpath bc-fips-1.0.0.jar
   -alias CARoot
   -import -file path/to/server.crt.der
   

7. When prompted, enter the keystore password. The following message is displayed to confirm that a certificate was added to the keystore:

   "Certificate was added to the keystore"
   

8. Run the Java program with SSL DB:

   1. Copy the vertica.kafka.keystore.bcfks keyStore from path/to/jre/lib/ext/ to the Java program folder.

   2. Convert the Vertica server certificate to a form that Java understands:

      $ path/to/java/bin/keytool -keystore verticastore -keypasswd -storepass password
                              -importkeystore -noprompt -alias verticasql -import -file server.crt.der
      

   3. Install JDBC.

9. Test the implementation:

   $ java -Djavax.net.debug=ssl -Djavax.net.ssl.keyStore='vertica.kafka.keystore.bcfks'
   -Djavax.net.ssl.keyStorePassword='password'
   -Djavax.net.ssl.trustStore='path/to/verticastore'
   -Djavax.net.ssl.trustStorePassword='password'
   -cp .:vertica-jdbc-12.0.0-0.jar FIPSTest
   

2 - Installing the FIPS client driver for ODBC and vsql

Vertica offers a FIPS client for FIPS-compatible systems. A FIPS-compatible system is FIPS-enabled and includes the OpenSSL libraries.

The FIPS client supports ODBC and vsql and is offered in 64-bit only.

Prerequisites

Verify that your host system is running a FIPS-compliant operating system that Vertica supports.

The FIPS client installer checks your host system for the value of the sysctl parameter, crypto.fips_enabled. You must set this parameter to 1 (enabled). If your host is not enabled, the client does not install.

Installing the FIPS client

To install the FIPS client driver package:

1. Download the FIPS client package from the Vertica driver downloads page.

2. Log in to the client system as root.

3. Install the RPM package that you downloaded:

   # rpm -Uvh package_name.rpm
   

For ODBC, after you have installed the client package, create a DSN and set some additional configuration parameters. For more information, see:

• Creating an ODBC DSN for Linux
• ODBC driver settings

You can optionally add the vsql client to your PATH environment variable so that you do not need to enter its full path to run it. To do so, add the following to the .profile file in your home directory or the global /etc/profile file:

export PATH=$PATH:/opt/vertica/bin

How the client searches for OpenSSL libraries

When you launch the client application to connect to the server, the client searches for and loads the OpenSSL libraries libcrypto.so.10 and libssl.so.10 for supported OpenSSL versions:

• The client first checks to see if LD_LIBRARY_PATH is set.

• If the LD_LIBARY_PATH location does not include the libraries, it checks RunPath, either /opt/vertica/lib or within the ODBC or vsql directory structure (../lib).

The following figure depicts the search process for the OpenSSL libraries: