Globus Connect Personal FIPS Cryptography Support

High Assurance Collections

Globus Connect Personal (GCP) supports High Assurance (HA) collections. In version 3.3.0 and higher, GCP will use FIPS-compliant ciphers for all data and metadata in HA collections.

FIPS Cryptography Mode

What Is FIPS?

Information on the Federal Information Processing Standard (FIPS) can be found here. GCP is built with support for FIPS 140-3.

GCP FIPS Mode

Important

Enabling FIPS cryptography mode in Globus Connect Personal does not make the host system FIPS 140 compliant. GCP is bundled with its own FIPS-compliant version of OpenSSL which is used exclusively by GCP. All GridFTP network traffic will use this packaging of OpenSSL.

The main OpenSSL build is a recent LTS release, with the FIPS module from compliant version 3.1.2 (NIST CMVP certificate #4985, FIPS 140-3) installed into it.

Enabling FIPS Mode

FIPS mode is activated automatically whenever a GCP endpoint is set up as a high assurance collection. You do not need to enable it separately.

New Installation

When installing a new GCP collection as a high assurance collection, the setup tool runs the OpenSSL FIPS self-test (openssl fipsinstall) and writes the resulting fipsmodule.cnf configuration file to the user’s GCP configuration directory. If the self-test fails, setup reports an error, FIPS mode is not activated, and the high assurance collection does not allow data access.

Upgrading an Existing Installation

There are two types of HA collection upgrades to consider. In both cases, the upgrade is transparent; GCP manages FIPS module upgrade at startup without user action.

  1. Upgrading from a version prior to 3.3.0 — If you are upgrading from a version prior to 3.3.0, GCP will automatically enable FIPS cryptography mode. During the upgrade process, GCP will run the FIPS self-test, disconnect from Globus services, and then reconnect using the FIPS ciphers. On this first startup you may see a brief window of time where the connection shows an error.

  2. Upgrading from 3.3.0 or later — Whenever a new version of the FIPS module is deployed with GCP, a new self-test will automatically be run by GCP. At startup GCP will compare the existing fipsmodule.cnf HMAC against the current module, and if they no longer match it re-runs openssl fipsinstall before connecting.

Checking FIPS Status

Every platform’s GCP program supports a --fips-status command (/fips_status on Windows) that reports whether FIPS mode is active and shows the exact OpenSSL configuration and provider that will be used by the GCP services.

Running --fips-status

Windows

Open a Command Prompt and run:

> "C:\Program Files (x86)\Globus Connect Personal\bin\globus_connect_personal.exe" /fips_status

If you didn’t install GCP to the default location, edit the path above to point to your install directory.

macOS

Open a terminal window and run:

$ "/Applications/Globus Connect Personal.app/Contents/MacOS/Globus Connect Personal" --fips-status

If you didn’t install GCP to your /Applications directory, edit the path above to point to your install location.

Linux

Open a terminal window, cd into your GCP install directory, and run:

$ ./globusconnectpersonal --fips-status

Understanding the Output

The command prints a short report and then runs the bundled openssl binary to show which providers actually load, similar to the following:

Globus Connect Personal - FIPS status
=====================================

FIPS mode: ENABLED
  (determined by presence of /home/user/.globusonline/lta/fipsmodule.cnf)

Environment passed to child processes (relaytool/gridftp):
  OPENSSL_CONF    = /path/to/openssl-fips.cnf
  OPENSSL_MODULES = /path/to/ossl-modules
  GCP_FIPS_ETC    = /home/user/.globusonline/lta
  GCP_FIPS        = 1

Live provider check (/path/to/openssl list -providers):
Providers:
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active
  base
    name: OpenSSL Base Provider
    version: 3.5.7
    status: active

  • FIPS mode reflects whether fipsmodule.cnf currently exists for this user.

  • OPENSSL_CONF and OPENSSL_MODULES are the exact paths that will be inherited by the GridFTP server and SSH relay connection processes.

  • Live provider check actually invokes openssl list -providers with that configuration. When FIPS mode is enabled and working correctly, the fips provider will be listed with status: active. If only the default (or base) provider appears while FIPS mode reports as ENABLED, this indicates the FIPS provider failed to load — most commonly because fipsmodule.cnf is stale or missing at the reported GCP_FIPS_ETC path.

Appendix A: Configuration and File Locations

FIPS Specific Configuration

On a shared machine each user has their own fipsmodule.cnf, so each user’s FIPS state is managed independently. This file is created by the FIPS self-test. Its location varies by platform:

Platform Path

Windows

%LOCALAPPDATA%\Globus Connect\fipsmodule.cnf

macOS

~/.globusonline/lta/fipsmodule.cnf

Linux

~/.globusonline/lta/fipsmodule.cnf
Note
Modifying these configuration files in GCP could cause it to stop working properly. Some of these files are generated and tested by the FIPS module validation process. Altering these file will result in undefined behavior and likely invalidate FIPS compliance.

GCP ships two OpenSSL configuration files in its installation directory: a file used when FIPS mode is active and a file used when FIPS mode is not active.

openssl-fips.cnf

Used when FIPS mode is active. Loads the validated FIPS provider and the supplementary base provider (needed for non-cryptographic operations) The default_properties = fips=yes setting causes OpenSSL to reject any algorithm not approved by the FIPS provider.

openssl-default.cnf

Used when FIPS mode is not active.

These files live in the GCP installation directory and are not intended for routine editing.