samba - Oct 2018 - Is samba FIPS compliant ? Can it be build with openssl ?

I'm checking back in to see if samba is FIPS compliant, as in using FIPS
compliant algorithms ? Can it be built with openssl, which is FIPS compliant ? 
We're currently running 4.7.5. Please let me know.

Regards,
Mike

On Tue, Oct 02, 2018 at 05:50:35PM +0000, Tompkins, Michael via samba
wrote:
> I'm checking back in to see if samba is FIPS compliant, as in using
FIPS compliant algorithms ? Can it be built with openssl, which is FIPS
compliant ?  We're currently running 4.7.5. Please let me know.
FIPS certification is expensive and time-consuming,
and no Open Source project that I know of has ever
complied.

Having said that, individual vendors have gotten
FIPS certification for specific versions of their
product, Red Hat being one. As Red Hat ships by
default with Samba, I think we're probably *able*
to be FIPS certifiable, but you're going to have
to do the actual FIPS certification work yourself :-).

Cheers,

	Jeremy.

Thanks for the quick reply Jeremy. 

We have other FIPS compliant libraries, which check for, and ensure the proper
FIPS compliant algorithms are used. Is  there a link option to specify this kind
of library ?

~ Mike

-----Original Message-----
From: Jeremy Allison <jra at samba.org> 
Sent: Tuesday, October 2, 2018 2:08 PM
To: Tompkins, Michael <Michael.Tompkins at xerox.com>
Cc: samba at lists.samba.org; USA Xerox Samba <USA.Xerox.Samba at
xerox.com>
Subject: Re: [Samba] Is samba FIPS compliant ? Can it be build with openssl ?

On Tue, Oct 02, 2018 at 05:50:35PM +0000, Tompkins, Michael via samba
wrote:
> I'm checking back in to see if samba is FIPS compliant, as in using
FIPS compliant algorithms ? Can it be built with openssl, which is FIPS
compliant ?  We're currently running 4.7.5. Please let me know.
FIPS certification is expensive and time-consuming, and no Open Source project
that I know of has ever complied.

Having said that, individual vendors have gotten FIPS certification for specific
versions of their product, Red Hat being one. As Red Hat ships by default with
Samba, I think we're probably *able* to be FIPS certifiable, but you're
going to have to do the actual FIPS certification work yourself :-).

Cheers,

	Jeremy.