Configure a FIPS-compliant Linux Machine

To configure a Linux virtual machine that meets the requirements of the Federal Information Processing Standard (FIPS) 140-2 or FIPS 140-3 mode, follow the procedure described on this page. You must install Horizon Agent with FIPS mode enabled and then install a CA-signed certificate for the BlastServer daemon.

Prerequisites

Verify that you have completed the following prerequisites:

• Set up the virtual machine with vSphere Virtual Machine Encryption, recommended for increased security and protection. See 'Virtual Machine Encryption' in the vSphere documentation within the Broadcom site at techdocs.broadcom.com.

• Installed RHEL 8.x or RHEL 9.x (minimum 9.6) on the machine. FIPS 140-2 mode is only supported on machines running RHEL 8.x.

  • FIPS 140-2 mode is supported on machines running RHEL 8.x.
  • FIPS 140-3 mode is supported on machines running RHEL 9.x (9.6 and later).

Note: RHEL 8.x uses a mix of FIPS 140-2 and FIPS 140-3 certified cryptographic modules. Per Red Hat, FIPS 140-2 and FIPS 140-3 certificates are considered equivalent until September 21, 2026; after that date, FIPS 140-2 certificates move to the historical list. Organizations subject to compliance frameworks that require full FIPS 140-3 validation (for example, FedRAMP, DoD, or FISMA) should plan to migrate to RHEL 9.x ahead of that date.

• Performed the relevant preparation steps described under Prepare a Linux Machine for Remote Desktop Deployment.

Note: The steps below use the name agent-installer.el8.x86_64.rpm to refer to the RPM installer file.

Procedure

1. On the RHEL 8.x or RHEL 9.x machine, enable FIPS mode at the Linux system level.

   sudo fips-mode-setup --enable
   sudo reboot
   

2. Install Horizon Agent using the RPM installer.

   For example:

   sudo rpm -ivh agent-installer.el8.x86_64.rpm
   

   For detailed instructions, see Install Horizon Agent on a Linux Machine.

3. Enable FIPS mode at the Horizon Agent level.

   sudo /usr/lib/omnissa/viewagent/bin/viewSetup.sh -f yes
   

   For more information, see Command-line Options for Installing Horizon Agent for Linux.

4. Complete the steps described in Install a CA-signed Certificate for BlastServer Daemon on a Linux Machine.

5. Restart the machine.

   sudo reboot
   

Results

You can now use the Linux machine to create desktop or application pools that are FIPS-compliant.