FIPS error in .Net

This link came in handy when I ran into a domain that had FIPS turned on by default via GPO.  It doesn't matter if it is not a sharepoint app.  If you are using any .Net app in an environment like this, you may get the errors described in the link below.

The key is to edit the machine.config file (probably found in C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG)

and make sure there is a section like this.  *I had to add this section*

<configuration>
    <runtime>
        <enforceFIPSPolicy enabled="false"/>
    </runtime>
</configuration>

Props to the poster of the link below

http://sharepoint4ever.blogspot.com/2011/09/fips-problem-in-sharepoint-2010.html?m=1

Also found this information helpfull

http://support.microsoft.com/kb/811833

I found that even if the global registry key was not set, if you are getting an error like this:

This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. 

Then just try adding that section above to the machine file.  I don't remember if a reboot was necessary but like all things Microsoft, it couldn't hurt...

ESX STIG Script

Just to let everyone know, we posted a new version (1.3) of the ESX_SRRSecure.sh script on the VMTN.
ESX_SRRSecure - Script to allow ESX to pass a DISA Security Readiness Review

For now you still have to edit the file and search for 192.168.10. and replace it with your network id.

Version 1.4 will come soon..

DISA releases official ESX Security Technical Implementation Guide

ESX Server STIG Version 1, Release 1.0

Seems harmless enough on the first pass but if you read carefully you will see the following finding:
(ESX0010: CAT II) The IAO/SA will configure the ESX Server in accordance with the UNIX STIG and Checklist. This is not applicable to ESX Server 3i. The following open findings will NOT be applicable when running the UNIX SRR against the ESX Server service console:

What this means is that on top of all the configuration changes you have to make within VirtualCenter (configuring virtual switches, etc.) you have to make sure the host can pass the UNIX STIG.

UNIX STIG V5R1
Unix has been around a loooooong time and as such the STIG for Unix is freaking HUGE. There is already a Security Readiness Review Evaluation Script for Unix which will have to be run on each ESX host at a DOD facility.

Fortunately, a colleague and I have already been working on a shell script to help lock down ESX so that it can pass the UNIX SRR. While I am sure it is not full proof in protecting agains hackers it will at least bring the host to a level of security to gain approval from the FSO to be allowed to connect to the network.

If you are interested, there is a thread in the VMTN that talks about the script here.
ESX_SRRSecure - Script to allow ESX to pass a DISA Security Readiness Review