IBM SPSS Data Collection Installation Manual

Also see for SPSS Data Collection Server 6.0.1: Reference manual

Contents

118Chapter 4Configure for FIPS 140-2 Compliance. If your system is already configured to be FIPS 140-2compliant prior to installation, the installation process will not let you deselect the Configure forFIPS 140-2 Compliance option. If you no do not want the installed applications to be FIPS 140-2compliant, you must manually set a Windows System cryptography setting to disabled:1. From the Windows Control panel, select:Administrative Tools > Local Security Policy > Local Policies (located in the left panel) > SecurityOptions (located in the left panel) > System cryptography: Use FIPS compliant algorithms... (locatedin the right panel)2. Double-click the System cryptography: Use FIPS compliant algorithms... policy and select Disabled.For new installations, the SHA-1 hash function algorithm is used regardless of whether or notConfigure for FIPS 140-2 Compliance is enabled; for upgrade installations, the followingrules apply: If FIPS 140-2 is enabled, all existing user information from the previous version is upgradedin the following steps:– The original, encrypted user passwords are archived to a setup log file.– New user passwords are randomly assigned and saved to a setuplog file. The log file is located at: C:\Program Files\CommonFiles\IBM\SPSS\DataCollection\6\\Installer\NewPassword.logInterviewer ServerAdministration administrators can supply users these new, temporary passwords in a mannerthat is in accordance with their business practices.– The MustChangePasswordAtNextLogin setting is enabled, which forces users to changetheir passwords at next login. When upgrading on a server that is currently not configured for FIPS 140-2, you are presentedwith the option to reset user passwords:– If you choose to reset user passwords, the SHA-1 hash function algorithm is employed.– If you choose to not reset user passwords, the server will continue to use the MD5 hashfunction algorithm. Keep the following points in mind when modifying an existing installation:– When changing Configure for FIPS 140-2 Compliance from enabled to disabled, theSHA-1 hash function algorithm will continue to be employed.– When changing Configure for FIPS 140-2 Compliance from disabled to enabled, theparameters outlined in the first bullet point are employed.Refer to the National Institute of Standards and Technology(http://csrc.nist.gov/groups/STM/cmvp/standards.html#02) website for more informationregarding FIPS 140-2.Notes: When FIPS 140-2 is configured for IBM SPSS Data Collection products, the applicationsadhere to the password protection security protocols that are defined on the Interviewer Server.For example, if the Interviewer Server is configured for MD5 security, the client-side applicationswill also use MD5 security for password protection, regardless of whether or not the Configure forFIPS 140-2 Compliance setting was selected during installation.