Enabling or disabling FIPS

IBM Storage Scale System 7.0.1.x supports Federal Information Processing Standards (FIPS)-compliant operations on IBM Storage Scale System nodes. You can enable or disable FIPS on all nodes in cluster by using the essrun command.

Ensure that the following conditions are met to avoid certain errors:
- Ensure that all nodes are updated with IBM Storage Scale System 7.0.1.x.
- Manually shut down IBM Storage Scale.
Enable or disable FIPS.
Attention: When you enable or disable the FIPS, the nodes are rebooted automatically. Enter accept to enable or no to not enable the FIPS on the nodes.
```
essrun fips [-h] {enable | disable}
```
Where:

enable

Enables FIPS on cluster nodes. To enable the FIPS, set the 1 value.

Note: When you want to enable FIPS in the management server, enable FIPS on the management server node and reboot after the management server node. After the management sever becomes available, enable FIPS on the remaining nodes. Do not enable FIPS on the management server and all nodes at the same time. If you enable FIPS on all nodes, the management server node reboots immediately and the FIPS is not enabled on the remaining nodes.

disable

Disables FIPS on cluster nodes. To disable the FIPS, set the 0 value.
The following example shows how to enable FIPS:
```
essrun -N essio1 fips enable
```
The following system output is displayed:
```
[INFO]	2025-12-08T20:02:23.836099	Going to check if can resolve this node: essio1
Enter 'accept' indicating that you want to enable FIPS in the following list of nodes: essio1 or enter 'no' if you don't want to proceed. Note that the nodes will be rebooted during the process.
>>> accept

PLAY [Enable FIPS ESS]
```
Check whether FIPS is enabled or disabled on all cluster nodes. If FIPS is not consistently enabled or disabled, a warning message is displayed when you run the essinstallcheck command only if the node belongs to a cluster.
```
[WARN]	FIPS check:		FAILED - FIPS is not consistent in all cluster nodes.
```
Check whether the FIPS enabled or disabled on each nodes by checking the content of the /proc/sys/crypto/fips_enabled file.
```
cat /proc/sys/crypto/fips_enabled 
1
```
Where:

1

Shows nodes where the FIPS is enabled.

0

Shows nodes where the FIPS disabled.