The Datadog FIPS Agent is in Preview and has not been fully audited. Install and test the Agent only on hosts that are not critical to production workloads.

1. Remove any fips-proxy installations on the host by uninstalling the datadog-fips-proxy package with your OS package manager. For example:

   Red Hat

   sudo yum remove datadog-fips-proxy
   

   Ubuntu/Debian

   sudo apt-get remove datadog-fips-proxy
   

2. Ensure that the Agent’s configuration file does not contain any FIPS proxy settings. FIPS proxy settings use the fips.* prefix.

3. Use the instructions for your OS to uninstall the Datadog Agent.

4. Install the Agent with FIPS support.

   Note: FIPS support is only available on Agent versions 7.63.0 and above:

   1. If you’re using the Agent install script, specify the DD_AGENT_FLAVOR="datadog-fips-agent" environment variable in your installation command. For example:

      DD_SITE="ddog-gov.com" DD_API_KEY="MY_API_KEY" DD_AGENT_FLAVOR="datadog-fips-agent" … bash -c "$(curl -L https://s3.amazonaws.com/dd-agent/scripts/install_script_agent7.sh)"
      

   2. If you’re installing with a package, follow the instructions to install the latest datadog-fips-agent package available for your platform.

   3. Add GOFIPS=1 to your Datadog environment variables, reload all service units, and restart the Datadog Agent service (datadog-agent.service). For example, if your host is using systemd:

      echo "GOFIPS=1" | sudo tee -a /etc/datadog-agent/environment
      systemctl daemon-reload
      systemctl restart 'datadog-agent*'
      

   4. Run the datadog-agent status command and make sure you see FIPS Mode: enabled in the status output.

The Datadog FIPS Agent is in preview and has not been fully audited. Install and test the Agent only on hosts that are not critical to production workloads.

1. Follow the Windows instructions to uninstall the Datadog Agent.

2. Run the command below to install the FIPS Agent, replacing DATADOG_API_KEY with your API key:

   Note: FIPS support is only available on Agent versions 7.63.0 and above:

$p = Start-Process -Wait -PassThru msiexec -ArgumentList '/qn /i https://windows-agent.datadoghq.com/datadog-fips-agent-7.64.3.msi /log C:\Windows\SystemTemp\install-datadog.log APIKEY="<DATADOG_API_KEY>" SITE="ddog-gov.com"'
if ($p.ExitCode -ne 0) {
   Write-Host "msiexec failed with exit code $($p.ExitCode) please check the logs at C:\Windows\SystemTemp\install-datadog.log" -ForegroundColor Red
}

To install a different preview version of the FIPS Agent, search the list of stable Agent versions for datadog-fips-agent and replace the MSI in the command above with your desired version.

1. Run the Agent status command and make sure you see FIPS Mode: enabled in the status output.

   & "$env:ProgramFiles\Datadog\Datadog Agent\bin\agent.exe" status
   

Note: The program name for the FIPS Agent in Add or Remove Programs is “Datadog FIPS Agent.”