System Security

The nv unset commands remove the configuration you set with the equivalent nv set commands. This guide only describes an nv unset command if it differs from the nv set command.

nv set system security encryption db state

Enables and disables password encryption in the NVUE startup.yaml file. By default, NVUE encrypts passwords, such as the RADIUS secret, TACACS secret, BGP peer password, OSPF MD5 key, and SNMP strings in the startup.yaml file.

Version History

Introduced in Cumulus Linux 5.10.0

Example

cumulus@switch:~$ nv set system security encryption db state disabled

nv set system security encryption folder-encrypt encrypted-folder

Configures the absolute path to other directories you want to encrypt when you enable secure mount directory encryption. by default the switch encrypts the /var/log, /var/home, and /var/lib directories.

You enable secure mount directory encryption with the nv action enable system security encryption folder-encrypt password <password> command.

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set system security encryption folder-encrypt encrypted-folder /my_user/my_data

nv set system security encryption folder-encrypt storage

Configures the storage type for the folder encryption key. To protect sensitive data at rest, you can configure secure mount directory encryption on the switch with a USB device.

You enable secure mount directory encryption with the nv action enable system security encryption folder-encrypt password <password> command.

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set system security encryption folder-encrypt storage usb

nv set system security fips mode

Configures FIPS mode.

FIPS are standards for federal computer systems developed by the U.S. government and published by the National Institute of Standards and Technology (NIST).

When you enable FIPS mode, the switch enforces FIPS 140-2 and 140-3 compliant cryptographic operations, making it suitable for high-security and regulated environments.

Enabling or disabling FIPS mode takes approximately one to two minutes and requires a switch reboot to take full effect. NVUE prevents you from enabling FIPS if non-compliant configuration exists on the switch and provides details of the violations.
When FIPS mode is enabled and you apply LDAP, TACACS, RADIUS, or authentication order configuration, all logged-in user sessions terminate and users must re-authenticate (except for root user).
Factory reset returns FIPS mode to disabled mode (except when you use the factory reset keep all-config option).
If FIPS is enabled when you upgrade the switch with onie-install -t, an additional reboot is required after the upgrade for FIPS mode to take full effect.

Version History

Introduced in Cumulus Linux 5.16.0

Example

cumulus@switch:~$ nv set system security fips mode enabled

nv set system security password-hardening digits-class

Configures the password policy so that passwords must include at least one digit. You can specify enabled or disabled. The default setting is enabled when password security is enabled.