Managing NoMachine SSH connections in FIPS 140-2 mode
In order to enable NoMachine SSH connections in FIPS 140-2 mode, it's necessary to accomplish the following requirements:
1) Users have to connect by SSH protocol.
This authentication method relies on a SSH server on the remote host for authenticating the user on the system. In such context, also a FIPS SSH server can be used.
2) NoMachine on the user's device must be configured to use the system SSH client.
NoMachine client uses by default libssh2 for SSH connections, but this library, provided with the NoMachine package, is not compiled in FIPS mode.
To switch to use a system SSH FIPS compliant client, edit the client configuration file (player.cfg) in the .nx/config directory under the user's home and modify the value of the following key from:
<option key="SSH client mode" value="library" />
to:
<option key="SSH client mode" value="native" />
For more details about using libssh2 or the system SSH client, see also: https://www.nomachine.com/AR09L00813
3) The system SSH client needs to support FIPS mode and have it enabled.
4) The SSH server (SSHD) on the remote machine must be running in FIPS mode.
We grant full compatibility with an OpenSSH server, but we know that NoMachine can work also with commercial versions of the SSH server.
We tested NoMachine with OpenSSH server in FIPS mode on RHEL/CentOS 6 and 7, configured according these instructions: https://access.redhat.com/solutions/137833
