FIPS for ingest tools #2136

karenzone · 2025-07-15T14:54:28Z

PREVIEWS:
https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/2136/deploy-manage/security/fips-140-2
https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/2136/deploy-manage/security/fips-ingest

Vet approach. Is this content heading in the right direction?
Vet basic structure
- Broke out ES and KIB for scan-ability
- Set up structure for scaling as we add more FIPS-compatible deliverables
- Moved FIPS topic from Deploy and Manage > Security > Secure your cluster or deployment to Deploy and Manage > Security to allow for expansion, SEO, and findability.
Align on terminology
- FIPS compliant?
- FIPS compatible?
- FIPS mode?
Add binary location and explain what they're getting
- User responsibilities
Redirects for FIPS topic and relocated ES and Kibana topics

Note to self @karenzone: Relocating ES and Kib might require redirects

simitt

Thanks @karenzone for the initial architecture; the split into product categories looks good to me.

Left some initial comments, but I will need to spend more time on finding some more user friendly wording for the removed/changed functionality.

As a general guideline, I would suggest we list the removed functionality as limititation, but do not list configuration options that themselves are just not FIPS compliant. We can do an overall callout on these but would keep this separated from functional limitations. I'll provide more thorough suggestions for this.

deploy-manage/security/fips-ingest.md

simitt · 2025-07-15T15:12:02Z

deploy-manage/security/fips-ingest.md

+
+FIPS mode binaries are available for {{agent}}, {{fleet}}, {{filebeat}}, {{metricbeat}}, {{agentbeat}}, and {{apm-server}}.
+
+The requirements and scope for the listed beats, Elastic Agent, Fleet Server and APM Server are based on FIPS 140 compliance for Elastic Go applications and can be summarized as:


Suggested change

The requirements and scope for the listed beats, Elastic Agent, Fleet Server and APM Server are based on FIPS 140 compliance for Elastic Go applications and can be summarized as:

Compliance with FIPS 140-2 requires using only FIPS approved / NIST recommended cryptographic algorithms. For the listed beats, Elastic Agent, Fleet Server and APM Server this can be summarized as:

simitt · 2025-07-15T15:12:31Z

deploy-manage/security/fips-ingest.md

+
+The requirements and scope for the listed beats, Elastic Agent, Fleet Server and APM Server are based on FIPS 140 compliance for Elastic Go applications and can be summarized as:
+
+Linking against a FIPS certified cryptographic library at compile time


Suggested change

Linking against a FIPS certified cryptographic library at compile time

- Linking against a FIPS certified cryptographic library

simitt · 2025-07-15T15:12:42Z

deploy-manage/security/fips-ingest.md

+The requirements and scope for the listed beats, Elastic Agent, Fleet Server and APM Server are based on FIPS 140 compliance for Elastic Go applications and can be summarized as:
+
+Linking against a FIPS certified cryptographic library at compile time
+Only using FIPS approved cryptographic functions at runtime


Suggested change

Only using FIPS approved cryptographic functions at runtime

- Only using FIPS approved cryptographic functions

deploy-manage/security/fips-ingest.md

simitt · 2025-07-15T15:19:16Z

deploy-manage/security/fips-ingest.md

+
+
+
+### APM Server [fips-apm-server]


Remove this as there is nothing APM Server specific listed?

simitt · 2025-07-15T15:20:09Z

deploy-manage/security/fips-ingest.md

+- Only fips compliant TLS options are accepted
+- TLSv1.2 is the minimum supported version and validation fails otherwise
+- Only compliant ciphers are allowed
+- Only compliant curve types are allowed


Remove these

- TLSv1.2 is the minimum supported version and validation fails otherwise - Only compliant ciphers are allowed - Only compliant curve types are allowed

simitt · 2025-07-15T15:20:24Z

deploy-manage/security/fips-ingest.md

+- Only compliant curve types are allowed
+- TranslateLDAPAttribute Processor is disabled
+- For Kafka output, SCRAM SASL is disabled as it was using a custom pbkdf2 functionality
+- Non compliant crypto in fingerprint processor is disabled: md5 and sha1 disabled


Suggested change

- Non compliant crypto in fingerprint processor is disabled: md5 and sha1 disabled

simitt · 2025-07-15T15:21:23Z

deploy-manage/security/fips-ingest.md

+github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata
+github.com/elastic/beats/v7/x-pack/filebeat/input/azureeventhub
+
+We need to let our users know that they need to deploy their agent/beats in a fips environment if they were to use service providers like gcp/azure/mongo in order to be compliant.


This section needs to be rephrased, I'll set some time aside to make suggestions.

simitt · 2025-07-15T15:21:37Z

deploy-manage/security/fips-ingest.md

+
+We need to let our users know that they need to deploy their agent/beats in a fips environment if they were to use service providers like gcp/azure/mongo in order to be compliant.
+
+More detailed discussion on this issue can be found here elastic/ingest-dev#5039


Suggested change

More detailed discussion on this issue can be found here elastic/ingest-dev#5039

simitt · 2025-07-17T09:21:33Z

@karenzone as discussed, here a more detailed proposal for describing the Limitations (to replace how the limitations are currently listed):

Limitations

TLS

Only FIPS 140-2 compliant TLS protocols, ciphers and curve types can be used.

The supported TLS versions are TLS v1.2 and TLS v1.3.
The supported cipher suites are:
- TLS v1.2: ECDHE-RSA-AES-128-GCM-SHA256, ECDHE-RSA-AES-256-GCM-SHA384, ECDHE-ECDSA-AES-128-GCM-SHA256, ECDHE-ECDSA-AES-256-GCM-SHA384
- TLS v1.3: TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384
The supported curve types are P-256, P-384 and P-521.

Support for encrypted private keys is not available, as the cryptographic modules used for decrypting password protected keys are not FIPS validated. If an output or any other component with an SSL key that is password protected is configured, the components will fail to load the key. When running in FIPS mode, non-encrypted keys must be provided.
Ensure to enforce security in your FIPS environments through other means, such as for example strict file permissions and access controls on the key file itself.

These TLS related restrictions apply to all components listed.

General Output & Input Limitations

The Kerberos protocol is not supported for any output or input, which also impacts the available sasl.mechanism for the Kafka output where only PLAIN is supported.

This impacts Filebeat, Metricbeat and APM server, as well as output configurations for Elastic Agent with Fleet Server.

APM Server

The Secrets Keystore is not supported.

Filebeat

The Secrets Keystore is not supported.
The Translate GUID Processor is not supported.
The Fingerprint Processor does not support the md5 and sha1 method.
The Community ID Network Flowhash Processor is not supported.
The Azure Module including the Azure eventhub Input and the Office 365 Module (Beta) is currently not supported. The Add Cloud Metadata Processor does currently not support the Azure Virtual Machine provider.
The GCP Pub/Sub Input is not supported for now.

Metricbeat

The Secrets Keystore is not supported.
The Translate GUID Processor is not supported.
The Fingerprint Processor does not support the md5 and sha1 method.
The Community ID Network Flowhash Processor is not supported.
The Azure Module is currently not supported. The Add Cloud Metadata Processor does currently not support the Azure Virtual Machine provider.
The Beta KVM Module is not yet supported.
The Mongo DB Module is not supported.
The MySQL, PostgreSQL, MSSQL and SQL Modules are not supported.
The Oracle Module is not supported.

Elastic Agent & Fleet Server

When using Elastic Agent and Fleet Server, the same restrictions as listed above for metricbeat and filebeat modules, inputs and processors apply to the respective Integrations.
Additionally, following limitations apply:

The Prometheus Receiver is not supported.
Running the Elastic Agent in OpenTelemetry mode is not yet supported.

Co-authored by: Silvia Mitter <silvia.mitter@elastic.co>

simitt · 2025-07-17T13:52:31Z

deploy-manage/security/fips-ingest.md

+  - id: elastic-agent
+  - id: fleet
+applies_to:
+  stack: ga 9.1


Not sure what these GA labels mean; generally we want to have these docs in place for

8.19.0: functionality is in Tech Preview

9.1.0: functionality is in Tech Preview

Here's how we're handing this for 9.1.0:

We'll handle messaging and content for 8.19.0 in a separate PR. I'll add it to our punch list.

simitt · 2025-07-17T14:00:11Z

deploy-manage/security/fips-ingest.md

+FIPS mode binaries are available for {{agent}}, {{fleet}}, {{filebeat}}, {{metricbeat}}, and {{apm-server}}.
+
+Compliance with FIPS 140-2 requires using only FIPS approved/NIST recommended cryptographic algorithms. For {{agent}}, Fleet Server, the listed {{Beats}}, and APM Server, this can be summarized as:


@karenzone WDYT about replacing with this:

The {{agent}}, {{fleet}}, {{filebeat}}, {{metricbeat}}, and {{apm-server}} binaries are built and can be configured to use FIPS 140-2 compliant cryptography.

Generally speaking FIPS 140-2 requirements can be summarized at:

tommyers-elastic · 2025-07-18T16:31:38Z

i think it might be good to add a section to the 'FIPS for ingest tools' page for "Integrations".

we have several integrations which are currently not FIPS compatible. calling these out here would avoid suprises for customers who don't learn they're unsupported until they try to install them. we list the equivalent metricbeat modules, so it makes sense to also list the Integrations that depend on them.

you can see which packages are currently not FIPS compatible by checking the for fips_compatible: false in the package manifest file - https://github.com/search?q=repo%3Aelastic%2Fintegrations%20%22fips_compatible%3A%20false%22&type=code

cc @shmsr

karenzone · 2025-07-19T01:44:21Z

i think it might be good to add a section to the 'FIPS for ingest tools' page for "Integrations".

we have several integrations which are currently not FIPS compatible. calling these out here would avoid suprises for customers who don't learn they're unsupported until they try to install them. we list the equivalent metricbeat modules, so it makes sense to also list the Integrations that depend on them.

@tommyers-elastic @shmsr (and others who are interested):
Does the treatment of the new content make it obvious that we're not guaranteeing that other integrations are compliant--only that we can guarantee that these seven are not?

tommyers-elastic · 2025-07-19T21:24:48Z

@karenzone by default we are saying that intergrations are compatible. but the boolean flag itself doesn't really make any promises about compliance - this is handled at the beats level (hence 'compatible', not 'compliant'). the flag is really like a hint for fleet so we can say to the customer "hey this integration isn't gonna work because it depends on modules that are not in the FIPS version of agent".

hope that makes sense.

karenzone self-assigned this Jul 15, 2025

github-actions bot deployed to docs-preview July 15, 2025 14:55 View deployment

simitt reviewed Jul 15, 2025

View reviewed changes

FIPS for ingest tools

5ddd6d5

karenzone force-pushed the 1735-fips branch from f02dbf9 to 5ddd6d5 Compare July 15, 2025 23:23

github-actions bot deployed to docs-preview July 15, 2025 23:23 View deployment

Restructuring a new content

4357c21

Co-authored by: Silvia Mitter <silvia.mitter@elastic.co>

github-actions bot deployed to docs-preview July 17, 2025 12:58 View deployment

simitt reviewed Jul 17, 2025

View reviewed changes

karenzone and others added 2 commits July 17, 2025 19:13

Incorporate review comments

4c67eb8

Merge branch 'main' into 1735-fips

3122289

github-actions bot deployed to docs-preview July 17, 2025 23:15 View deployment

Update links, apply standards, smooth text

0305d27

github-actions bot had a problem deploying to docs-preview July 18, 2025 22:44 Failure

List integrations that are not FIPS compatible

81339ca

github-actions bot had a problem deploying to docs-preview July 19, 2025 01:38 Failure

karenzone marked this pull request as ready for review July 19, 2025 01:49

karenzone requested review from a team as code owners July 19, 2025 01:49


		FIPS mode binaries are available for {{agent}}, {{fleet}}, {{filebeat}}, {{metricbeat}}, {{agentbeat}}, and {{apm-server}}.

		The requirements and scope for the listed beats, Elastic Agent, Fleet Server and APM Server are based on FIPS 140 compliance for Elastic Go applications and can be summarized as:

	The requirements and scope for the listed beats, Elastic Agent, Fleet Server and APM Server are based on FIPS 140 compliance for Elastic Go applications and can be summarized as:
	Compliance with FIPS 140-2 requires using only FIPS approved / NIST recommended cryptographic algorithms. For the listed beats, Elastic Agent, Fleet Server and APM Server this can be summarized as:


		The requirements and scope for the listed beats, Elastic Agent, Fleet Server and APM Server are based on FIPS 140 compliance for Elastic Go applications and can be summarized as:

		Linking against a FIPS certified cryptographic library at compile time

	Linking against a FIPS certified cryptographic library at compile time
	- Linking against a FIPS certified cryptographic library

	Only using FIPS approved cryptographic functions at runtime
	- Only using FIPS approved cryptographic functions


		We need to let our users know that they need to deploy their agent/beats in a fips environment if they were to use service providers like gcp/azure/mongo in order to be compliant.

		More detailed discussion on this issue can be found here elastic/ingest-dev#5039

FIPS for ingest tools #2136

Are you sure you want to change the base?

FIPS for ingest tools #2136

Conversation

karenzone commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

simitt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

simitt commented Jul 17, 2025

Limitations

TLS

General Output & Input Limitations

APM Server

Filebeat

Metricbeat

Elastic Agent & Fleet Server

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tommyers-elastic commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

karenzone commented Jul 19, 2025

Uh oh!

tommyers-elastic commented Jul 19, 2025

Uh oh!

Uh oh!

karenzone commented Jul 15, 2025 •

edited

Loading

tommyers-elastic commented Jul 18, 2025 •

edited

Loading