MongoDB Documentation, Release 3.0.4 Considerations Procedure Only the MongoDB Enterprise 51 version supports FIPS mode. See Install MongoDB Enterprise (page 33) to download and install MongoDB Enterprise 52 to use FIPS mode. Your system must have an OpenSSL library configured with the FIPS 140-2 module. At the command line, type openssl version to confirm your OpenSSL software includes FIPS support. For Red Hat Enterprise Linux 6.x (RHEL 6.x) or its derivatives such as CentOS 6.x, the OpenSSL toolkit must be at least openssl-1.0.1e-16.el6_5 to use FIPS mode. To upgrade the toolkit for these platforms, issue the following command: sudo yum update openssl Some versions of Linux periodically execute a process to prelink dynamic libraries with pre-assigned addresses. This process modifies the OpenSSL libraries, specifically libcrypto . The OpenSSL FIPS mode will subsequently fail the signature check performed upon startup to ensure libcrypto has not been modified since compilation. To configure the Linux prelink process to not prelink libcrypto : sudo bash -c "echo '-b /usr/lib64/libcrypto.so. * ' >>/etc/prelink.conf.d/openssl-prelink.conf" FIPS is property of the encryption system and not the access control system. However, if your environment re- quires FIPS compliant encryption and access control, you must ensure that the access control system uses only FIPS- compliant encryption. MongoDB’s FIPS support covers the way that MongoDB uses OpenSSL for network encryption and X509 authen- tication. If you use Kerberos or LDAP Proxy authentication, you muse ensure that these external mechanisms are FIPS-compliant. MONGODB-CR authentication is not FIPS compliant. Configure MongoDB to use TLS/SSL See Configure mongod and mongos for TLS/SSL (page 342) for details about configuring OpenSSL. Run mongod or mongos instance in FIPS mode Perform these steps after you Configure mongod and mongos for TLS/SSL (page 342). Step 1: Change configuration file. To configure your mongod or mongos instance to use FIPS mode, shut down the instance and update the configuration file with the following setting: net: ssl: FIPSMode: true Step 2: Start mongod or mongos instance with configuration file. For example, run this command to start the mongod instance with its configuration file: mongod --config /etc/mongod.conf $^{51}$http://www.mongodb.com/products/mongodb-enterprise?jmp=docs $^{52}$http://www.mongodb.com/products/mongodb-enterprise?jmp=docs Chapter 6. Security 352