Documentation forSecurity Event Manager

Install the SEM Manager FIPS edition on Red Hat Enterprise Linux

Starting with SEM 2026.4, a FIPS edition of the SEM Manager is available. The FIPS edition is delivered as a single RPM package .zip file that you install on a customer-managed Red Hat Enterprise Linux (RHEL) host with OS 9.8 in FIPS mode. The FIPS edition uses FIPS 140-3 validated cryptography (BouncyCastle FIPS provider).

The SEM virtual appliance for Hyper-V, VMware vSphere, cloud platforms, and Nutanix remains a non-FIPS deployment.

Before you begin

Review the following limitations before you plan a FIPS edition deployment:

  • Fresh installation only. You cannot upgrade or convert an existing SEM virtual appliance (Debian) to the FIPS edition in place. Events, rules, licenses, and other data from an existing SEM deployment are not migrated to the FIPS edition.

  • FIPS is always on. FIPS mode cannot be turned off in the FIPS edition, and you cannot switch an installation between FIPS and non-FIPS modes.

  • You manage the operating system. SEM does not install or manage operating system updates on the RHEL host, and it never sets or changes the RHEL root password. You are responsible for RHEL administration, hardening, patching, and compliance controls.

  • No CMC console. The FIPS edition does not include the CMC console. Use the semcli command-line tool for administrative tasks on the RHEL host.

  • FIPS agents only. Non-FIPS SEM agents are not supported with a FIPS edition Manager. Use the FIPS agent installers.

Some features work differently or are not available in the FIPS edition. See Features and limitations of the SEM FIPS edition and Use semcli on the SEM FIPS edition (RHEL).

Prerequisites

Prepare a RHEL host that meets the following requirements:

Requirement Details
Operating system

Red Hat Enterprise Linux 9.8, x86_64, with FIPS mode enabled.
Registration and repositories

The host must be registered with Red Hat and have the following repositories enabled so that RPM dependencies can be resolved:

  • rhel-9-for-x86_64-baseos-rpms
  • rhel-9-for-x86_64-appstream-rpms
Hardware and storage

CPU, memory, and disk capacity must meet the system requirements for your deployment size.

For production deployments, use dedicated file systems (for example, separate partitions or LVM logical volumes) for /var and /usr/local so that SEM event data, databases, and logs cannot fill the root file system.
Hostname and DNS

hostname returns the intended host name, and hostname -f returns a valid fully qualified domain name (FQDN).

The FQDN resolves from client and administration networks. Configure forward and reverse DNS according to your standards.
Network

IPv4-only or dual-stack (IPv4 and IPv6). Configure networking with RHEL tools such as nmcli or nmtui.
Time synchronization

An approved NTP source is configured, and chronyd is installed, enabled, running, and synchronized.
Ports

  • 443, 8443, 80, and 8080 TCP: SEM web console and API

  • 37890–37892 TCP: agent and connector communication

  • Optional: 514 TCP/UDP (syslog), 161 and 162 UDP (SNMP)

You also need the following files from SolarWinds:

  • The pre-installation check script, SolarWinds-SEM-2026.4.0-FIPS-Preinstallation-Check.sh

  • The SEM Manager FIPS edition RPM, SolarWinds-SEM-2026.4.0-FIPS-Redhat-Manager.rpm

Enable FIPS mode on the RHEL host

Enable and validate FIPS mode before you install SEM.

  1. Check the current FIPS status:

    fips-mode-setup --check

  2. Update the operating system packages:

    sudo dnf update -y

  3. Enable FIPS mode:

    sudo fips-mode-setup --enable

  4. Restart the host:

    sudo reboot

  5. After the host restarts, verify that FIPS mode is enabled:

    fips-mode-setup --check
openssl list -providers
update-crypto-policies --show

    The output confirms that FIPS mode is enabled, the OpenSSL FIPS provider is listed, and the crypto policy is FIPS.

Configure the firewall

The following steps use firewalld. If you use a different firewall, allow the same ports and redirects.

  1. Open the SEM web console and agent ports:

    sudo firewall-cmd --permanent --add-port=8443/tcp
sudo firewall-cmd --permanent --add-port=37890/tcp
sudo firewall-cmd --permanent --add-port=37891/tcp
sudo firewall-cmd --permanent --add-port=37892/tcp

  2. Redirect port 80 to 8080 and port 443 to 8443 for IPv4 and IPv6:

    sudo firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 0 -p tcp --dport 80 -j REDIRECT --to-ports 8080
sudo firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 0 -p tcp --dport 443 -j REDIRECT --to-ports 8443
sudo firewall-cmd --permanent --direct --add-rule ipv6 nat PREROUTING 0 -p tcp --dport 80 -j REDIRECT --to-ports 8080
sudo firewall-cmd --permanent --direct --add-rule ipv6 nat PREROUTING 0 -p tcp --dport 443 -j REDIRECT --to-ports 8443

  3. If you plan to receive syslog or SNMP traffic directly on the host, open ports 514 TCP/UDP and 161/162 UDP as needed.

  4. Reload the firewall:

    sudo firewall-cmd --reload

  5. Verify the open ports and redirect rules:

    sudo firewall-cmd --list-ports
sudo firewall-cmd --direct --get-all-rules

Run the pre-installation check

The pre-installation check script verifies that the host is ready for SEM. It checks subscription status, operating system, hostname and FQDN, network connectivity, DNS (including resolution of api.solarwinds.com), firewall, FIPS configuration, and time synchronization.

  1. Copy the script to the RHEL host and open a terminal in the directory that contains the script.

  2. Make the script executable and run it:

    chmod +x SolarWinds-SEM-2026.4.0-FIPS-Redhat-Preinstallation-Script.sh
sudo ./SolarWinds-SEM-2026.4.0-FIPS-Redhat-Preinstallation-Script.sh

    The script displays the banner SEM Pre-Installation Checks (v1.0.0) and prints a [PASS], [INFO], or [WARN] result for each check. [INFO] results for optional items, such as closed syslog or SNMP ports, do not block the installation.

  3. Review the result.

    • If the script displays RESULT: All Pre-checks PASSED and System is ready for SEM Installation., continue with the installation.

    • If any check fails or reports a warning, correct the issue and run the script again. The script writes details to /var/log/sem_prereq_check_YYYYMMDD_HHMMSS.log.

Install the SEM Manager RPM

  1. Copy the RPM to the RHEL host and open a terminal in the directory that contains the RPM.

  2. Install the RPM:

    sudo yum install -y ./SolarWinds-SEM-2026.4.0-FIPS-Redhat-Manager.rpm

    Installing with yum and a local path lets RHEL resolve the required dependencies from the BaseOS and AppStream repositories.

    If the installation reports dependency or repository errors, confirm that the host is registered with Red Hat, that the required repositories are enabled, and that the pre-installation check passes. Then run the installation again.

Validate the installation

  1. Verify that the SEM Manager service is running:

    sudo systemctl status sem-manager --no-pager

  2. Verify that the required ports are listening:

    sudo ss -lntp | grep -E ":8443|:37890|:37891|:37892"

  3. In a supported web browser, go to https://<server-ip-or-fqdn> and verify that the SEM login screen opens.

Log in for the first time

  1. Go to https://<server-ip-or-fqdn>.

  2. On the login screen, click Log in. The Username and Password fields are auto-filled for you the first time you log in.

    In the FIPS edition, the default administrator username is admin and the default password is defaultPassword, because FIPS requires passwords of at least 14 characters.

  3. Complete the setup wizard. When you are prompted, create a new administrator password with at least 14 characters.

    Unlike the virtual appliance, the FIPS edition does not prompt you to change a CMC password.

For more information about the setup wizard, see Run the setup wizard.

Offline Connector Update

For FIPS environments, upload the latest connectors ZIP file to /var/sem/connectors-update/offline/. Once the connector update is complete, confirm that the ZIP file has been automatically removed from that location.

Kerberos SSO

RHEL system-wide crypto policies (DEFAULT, FIPS, FUTURE, etc.) restrict the Kerberos enctypes allowed at the OS level. This restriction is enforced through the generated back-end file: /etc/crypto-policies/back-ends/krb5.config

Add aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 in permitted_enctypes list in the /etc/crypto-policies/back-ends/krb5.configfile and restart the SEM services.

Next steps: