Fips compliance

[Amndeep7]

Resolves #4145

• OS is FIPS compliant: RHEL's UBI8 docker container satisfies this and is accredited
• Node is FIPS compliant: The UBI8 container variant that we're using built node with the options required to be fips compliant
• Run Node in FIPS compliant mode: You can pass in the flag to enable or force FIPS compliance. Using force to avoid the possibility of FIPS mode being disabled
• Connect to the Postgres DB using a FIPS compliant algorithm: Postgres v<=13 by default uses a password authentication method (https://www.postgresql.org/docs/13/auth-password.html ; https://hub.docker.com/_/postgres then look for POSTGRES_HOST_AUTH_METHOD) that uses md5. MD5 is not a FIPS compliant algorithm. Force Postgres to start up in and use SHA256 instead.
• (Optional) Swap out the Postgres in the docker-compose to be a variant that is FIPS compliant: Marked as optional since the user ought to supply a FIPS compliant Postgres, but would be useful for testing.

Research if this image needs to be changed to be FIPs compliant

  database:
    image: postgres:13
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 30s
      timeout: 60s
      retries: 5
      start_period: 80s
    volumes:
      - ./data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=heimdall-server-production
      - POSTGRES_PASSWORD=${DATABASE_PASSWORD}
      - PGDATA=/var/lib/postgresql/data/pgdata
    expose:
      - "5432"

• Replace usages of the bcrypt algorithm (i.e. what is used by bcryptjs, which is the cryptography library we're currently using) or any other non-FIPS approved algorithm with FIPS approved algorithms via a wrapper library around approved sources like the built-in crypto library and WebCryptoAPI. This allows for access system cryptography modules through an interface. The higher numbered SHA family is usually recommended (https://csrc.nist.gov/projects/cryptographic-module-validation-program/sp-800-140-series-supplemental-information/sp800-140c); WebCryptoAPI may only be able to be used on TLS connections so that might impact ex. the fingerprinted autoconvert functionality
  • base converter is using crypto lib to hash the file, can use webcryptoapi to hash it instead (https://nodejs.org/docs/latest-v18.x/api/crypto.html#cryptocreatehashalgorithm-options -> https://nodejs.org/docs/latest-v18.x/api/webcrypto.html#subtledigestalgorithm-data)
  • jfrog mapper is using md5 as a hash to derive an id for findings that don't have them
  • passwords are hashed via bcrypt
  • apikeys are hashed via bcrypt
  • admin password in the createadmin seeder sequelize script uses bcrypt
  • asff reverse mapper uses crypto lib to sha256 hash findings but in hex or something
  • checklist reverse mapper (implementation might be changed out with David's work but it's the toHDF func in the mapper class) uses baseconverter's genhash func which by default does sha256
  • double check api integrations - some of them provide fips-enabled endpoints: https://aws.amazon.com/compliance/fips/ | check out the 'usefipsendpoint' flag: https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/
• (Optional) Swap out the NGINX in the docker-compose to be a variant that is FIPS compliant: Marked as optional since the user ought to supply a FIPS compliant reverse proxy, but would be useful for testing. This is a research task similar to looking into the postgres image.
• Exhaustively test to make sure that we don't run into any issues: there doesn't seem to be a way to statically check that we're FIPS compliant, so need to address runtime issues as they show up.
  • Test components as per Utilize FIPS-validated cryptographic modules #4145 (comment) - probably will break this subtask out into more subtasks
  • Set up FIPS compliant testing VM (so that the host, applications, and browser are all running in FIPS compliant mode)
  • Automate testing: Cypress sucks, let's do the swap to Playwright
• Update docs
• Create transition process for moving passwords hashed with bcrypt to passwords hashed with sha256 (and also salted with something? https://stackoverflow.com/questions/59777670/how-can-i-hash-a-string-with-sha256-in-js) (or just make the admin do some db fun to update the admin's password and then force reset everyone's passwords): https://stackoverflow.com/questions/1533744/how-to-upgrade-a-password-storage-scheme-change-hashing-algorithm
• Create transition process for moving apikeys hashed with bcrypt to apikeys hashed with sha256 (and also salted with something?) (or just cull them all and force the users to regen all of them)
• Validate that JWS is using SHA256 underneath the hood

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[sonarqubecloud]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
2 Code Smells

No Coverage information
0.0% Duplication

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

[mergify]

This pull request has a conflict. Could you fix it @Amndeep7?

[sonarqubecloud]

Quality Gate failed

Failed conditions

8 New Code Smells (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

[mergify]

This pull request has a conflict. Could you fix it @Amndeep7?

[mergify]

This pull request has a conflict. Could you fix it @Amndeep7?

[sonarqubecloud]

Quality Gate failed

Failed conditions
9 New Code Smells (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

[mergify]

This pull request has a conflict. Could you fix it @Amndeep7?

[sonarqubecloud]

Quality Gate failed

Failed conditions
8 New Code Smells (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

[mergify]

This pull request has a conflict. Could you fix it @Amndeep7?

[em-c-rod]

Is this sufficient for having "FIPS enabled Postgres"?
Communicate this in the helm chart and the docs.
Action item here:

• Add an issue to Heimdall-helm to make sure these variable is passed through as options for the helm chart
• Add some documentation for Heimdall users about needing to use a FIPs enabled database.

[em-c-rod]

Forcing node to use fips compliant algorithms will cause nodejs to use the system provided cryptography module, in this case openssl because that is the fips approved module on the image used to build Heimdall, in this case ubi8. This requires the use of native api

[em-c-rod]

USE_NEW_ENCRYPTION_STRATEGY can be renamed, but is the concept of setting Heimdall to be FIPS enabled

[em-c-rod]

Can rename this file for the appropriate date