• A non-containerized Linux host.
• Your Linux OS must be in FIPS-compliant mode. See your OS vendor’s documentation on what steps are required to meet this requirement.
• FIPS-compliant storage backing the host file system.

• A non-containerized Windows host.
• Windows must be in FIPS-compliant mode.
• FIPS-compliant storage backing the host file system.

1. Remove any fips-proxy installations on the host by uninstalling the datadog-fips-proxy package with your OS package manager. For example:

   Red Hat

   sudo yum remove datadog-fips-proxy
   

   Ubuntu/Debian

   sudo apt-get remove datadog-fips-proxy
   

2. Ensure that the Agent’s configuration file does not contain any FIPS proxy settings. FIPS proxy settings use the fips.* prefix.

3. Use the instructions for your OS to uninstall the Datadog Agent.

4. Install the Agent with FIPS support.

   Note: FIPS support is only available on Agent versions 7.65.0 and above:

   1. If you’re using the Agent install script, specify the DD_AGENT_FLAVOR="datadog-fips-agent" environment variable in your installation command. For example:

      DD_SITE="ddog-gov.com" DD_API_KEY="MY_API_KEY" DD_AGENT_FLAVOR="datadog-fips-agent" … bash -c "$(curl -L https://s3.amazonaws.com/dd-agent/scripts/install_script_agent7.sh)"
      

   2. If you’re installing with a package, follow the instructions to install the latest datadog-fips-agent package available for your platform.

   3. Add GOFIPS=1 to your Datadog environment variables, reload all service units, and restart the Datadog Agent service (datadog-agent.service). For example, if your host is using systemd:

      echo "GOFIPS=1" | sudo tee -a /etc/datadog-agent/environment
      systemctl daemon-reload
      systemctl restart 'datadog-agent*'
      

   4. Run the datadog-agent status command and make sure you see FIPS Mode: enabled in the status output.

1. Follow the Windows instructions to uninstall the Datadog Agent.

2. Run the command below to install the FIPS Agent, replacing DATADOG_API_KEY with your API key:

   Note: FIPS support is only available on Agent versions 7.65.0 and above:

$p = Start-Process -Wait -PassThru msiexec -ArgumentList '/qn /i https://windows-agent.datadoghq.com/datadog-fips-agent-7.65.0.msi /log C:\Windows\SystemTemp\install-datadog.log APIKEY="<DATADOG_API_KEY>" SITE="ddog-gov.com"'
if ($p.ExitCode -ne 0) {
   Write-Host "msiexec failed with exit code $($p.ExitCode) please check the logs at C:\Windows\SystemTemp\install-datadog.log" -ForegroundColor Red
}

1. Run the Agent status command and make sure you see FIPS Mode: enabled in the status output.

   & "$env:ProgramFiles\Datadog\Datadog Agent\bin\agent.exe" status
   

Note: The program name for the FIPS Agent in Add or Remove Programs is “Datadog FIPS Agent.”