[WIP]: Enable FIPs mode with a script

[Amrita42]

PR creator: Description

The scope of this PR is to:

1. Document the script/tool that enables FIPs mode.

PR creator: Are there any relevant issues/feature requests?

• PED-6440

PR creator: Which product versions do the changes apply to?

When opening a PR, check all versions of the documentation that your PR applies to.

• SLE 15/openSUSE Leap 15.x
  • SLE 15 next/openSUSE Leap next (current main, no backport necessary)
  • SLE 15 SP5/openSUSE Leap 15.5
  • SLE 15 SP4/openSUSE Leap 15.4
  • SLE 15 SP3/openSUSE Leap 15.3
  • SLE 15 SP2/openSUSE Leap 15.2
  • SLE 15 SP1
• SLE 12
  • SLE 12 SP5
  • SLE 12 SP4

PR reviewer only: Have all backports been applied?

The doc team member merging your PR will take care of backporting to older documents.
When opening a PR, do not set the following check box.

• all necessary backports are done

[Amrita42]

Please not that a ref will be added for crypto policies once this PR is merged >>#1545

[Amrita42]

Pdf version attached
Uploading book-security_en.pdf…

[Amrita42]

Uploading book-security_en.pdf…

[pmgdeb]

Thanks! All the documentation related to fips-mode-setup looks correct to me.

[Amrita42]

book-security_en.pdf

[denknorr]

I am confused about this:

so, NIST is currently reviewing all the modules for SLES 15 SP4 and we hope to have it in the next months soon as certified. You can run the same binaries on SLES 15 SP5 and this will be compliant when the certification for sp6 is public. And for SLES 15 SP6 we will re-certify this, but atm neither compliance nor certification can be claimed for SP6. At least it is not planned (we will discuss this internally)

This has to be rewritten therefore, i am sorry :(

[Amrita42]

@denknorr Can you please clarify what we need to add in the note for SP6 or how it should be phrased , wrt to the mail chain :

[denknorr]

The idea would be that SP5 can be run in compliant mode with the fips binaries from SP4 (with installing the fips pattern) and for SP6 that we will recertify the binaries and that currently there are no fips binaries for sp6.

[Amrita42]

So for SP6, can we add this note:
The relevant binaries are currently undergoing FIPS 140-3 certification. Until the certification has been achieved, full FIPS 140-3 compliance cannot be guaranteed.
(Sales rep to be replaced as per https://bugzilla.suse.com/show_bug.cgi?id=1219488)

[Amrita42]

Closing this PR due to merge conflicts and created a new PR with all tech feedback implemented.
#1659