示例：配置 FIPS 自检
此示例说明如何将 FIPS 自检配置为定期运行。
硬件和软件要求
您必须具有管理 权限才能配置 FIPS 自检。
设备必须在 FIPS 模式软件中运行评估版本的 Junos OS。
概述
FIPS 自检由以下已知答案测试 （KAT） 套件组成：
-
kernel_kats- KAT 表示内核加密例程 -
md_kats- KAT 代表 libmd 和 libc -
openssl_kats—用于 OpenSSL 加密实现的 KAT -
quicksec_kats- 用于 QuickSec 工具包加密实现的 KAT -
macsec_kats—用于 MACsec 加密实现的 KAT
在此示例中，FIPS 自检于每周三上午 9：00 在美国纽约市执行。
注意：
您可以通过包含 month 和 day-of-month 语句来配置每月测试，而不是每周测试。
当 KAT 自检失败时，会将日志消息写入系统日志消息文件，其中包含测试失败的详细信息。然后系统死机并重新启动。
配置
CLI 快速配置
要快速配置此示例，请将以下命令复制到文本文件中，删除所有换行符，然后将命令粘贴到层次结构级别的 CLI [edit] 中。
set system fips self-test periodic start-time 09:00 set system fips self-test periodic day-of-week 3
程序
分步过程
要配置 FIPS 自检：
将 FIPS 自检配置为每周三上午 9：00 执行。
[edit system fips self-test] user@host# set periodic start-time 09:00 user@host# set periodic day-of-week 3
如果完成设备配置，请提交配置。
[edit system fips self-test] user@host# commit
结果
在配置模式下，通过发出 show system 命令来确认您的配置。如果输出未显示预期的配置，请重复此示例中的说明以更正配置。
user@host# show system
fips {
self-test {
periodic {
start-time "09:00";
day-of-week 3;
}
}
}
验证
确认配置工作正常。
目的
验证是否已启用 FIPS 自检。
行动
通过发出 request system fips self-test 命令手动运行 FIPS 自检。
发出 request system fips self-test 命令后，系统日志文件将更新以显示执行的 KAT。要查看系统日志文件，请发出 file show /var/log/messages 命令。
user@host> file show /var/log/messages
mgd: Running FIPS Self-tests mgd: Testing kernel KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: SHA-2-384 Known Answer Test: Passed mgd: SHA-2-512 Known Answer Test: Passed mgd: AES128-CMAC Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: Testing MACSec KATS: mgd: AES128-CMAC Known Answer Test: Passed mgd: AES256-CMAC Known Answer Test: Passed mgd: AES-ECB Known Answer Test: Passed mgd: AES-KEYWRAP Known Answer Test: Passed mgd: Testing libmd KATS: mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: SHA-2-512 Known Answer Test: Passed mgd: Testing OpenSSL KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: FIPS ECDSA Known Answer Test: Passed mgd: FIPS ECDH Known Answer Test: Passed mgd: FIPS RSA Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: ECDSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-SSH-SHA256 Known Answer Test: Passed mgd: KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed mgd: KAS-FFC-EPHEM-NOKC Known Answer Test: Passed mgd: Testing QuickSec 7.0 KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: SSH-ECDSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-IKE-V2 Known Answer Test: Passed mgd: Testing QuickSec KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-IKE-V2 Known Answer Test: Passed mgd: Testing SSH IPsec KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: Testing file integrity: mgd: File integrity Known Answer Test: Passed mgd: Testing crypto integrity: mgd: Crypto integrity Known Answer Test: Passed mgd: Expect an everiexec: no fingerprint for file='/sbin/kats/cannot-exec' fsid=215 fileid=49356 gen=1 uid=0 pid=6039 xec Authentication error... mgd: /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error mgd: FIPS Self-tests Passed