# System Security

## nv show system security

Shows security settings on the switch.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show system security
                               operational  applied
    -------------------------  -----------  -------
    fips
      mode                     enabled      enabled
    password-hardening
      state                    enabled      enabled
      reject-user-passw-match  enabled      enabled
      lower-class              enabled      enabled
      upper-class              enabled      enabled
      digits-class             enabled      enabled
      special-class            enabled      enabled
      expiration-warning       15           15
      expiration               180          180
      history-cnt              10           10
      len-min                  8            8
    encryption
      db
        state                               enabled
    ...

Cumulus Linux 5.16.0 introduce FIPS mode. If you are running Cumulus Linux 5.15 or earlier, the `nv show system security` command output does not show FIPS mode configuration.

## nv show system security ca-certificate

Shows all the CA certificates on the switch.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv show system security ca-certificate

## nv show system security ca-certificate <cert-id>

Shows brief information about a specific CA certificate.

### Command Syntax

Syntax | Description
--- | ---
`<cert-id>` | The CA certificate name.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv show system security ca-certificate cert-1

## nv show system security ca-certificate <cert-id> dump

Shows detailed information about a specific CA certificate.

### Command Syntax

Syntax | Description
--- | ---
`<cert-id>` | The CA certificate name.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv show system security ca-certificate cert-1 dump

## nv show system security certificate

Shows all the entity certificates on the switch.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv show system security certificate

## nv show system security certificate <cert-id>

Shows brief information about a specific entity certificate.

### Command Syntax

Syntax | Description
--- | ---
`<cert-id>` | The certificate name.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv show system security certificate cert-2

## nv show system security certificate <cert-id> dump

Shows detailed information about a specific entity certificate.

### Command Syntax

Syntax | Description
--- | ---
`<cert-id>` | The certificate name.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv show system security certificate cet2 dump

## nv show system security certificate <cert-id> installed

Shows the applications that are using a specific entity certificate.

### Command Syntax

Syntax | Description
--- | ---
`<cert-id>` | The certificate name.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv show system security certificate cert-2 installed

## nv show system security encryption

Shows if NVUE password encryption is enabled, By default, NVUE encrypts passwords, such as the RADIUS secret, TACACS secret, BGP peer password, OSPF MD5 key, and SNMP strings in the startup.yaml file.

### Version History

Introduced in Cumulus Linux 5.10.0

### Example

    cumulus@switch:~$ nv show system security encryption
             operational  applied
    -------  -----------  -------
    db
      state               enabled

## nv show system security encryption db

Shows if NVUE password encryption is enabled, By default, NVUE encrypts passwords, such as the RADIUS secret, TACACS secret, BGP peer password, OSPF MD5 key, and SNMP strings in the startup.yaml file.

### Version History

Introduced in Cumulus Linux 5.10.0

### Example

    cumulus@switch:~$ nv show system security encryption db
           operational  applied
    -----  -----------  -------
    state  enabled      enabled

## nv show system security fips

Shows if FIPS mode is enabled. FIPS are standards for federal computer systems developed by the U.S. government and published by the National Institute of Standards and Technology (NIST).

When you enable FIPS mode, the switch enforces FIPS 140-2 and 140-3 compliant cryptographic operations, making it suitable for high-security and regulated environments.

The default FIPS mode is `disabled`.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show system security fips
                               operational  applied
    -------------------------  -----------  -------
    mode                       enabled      enabled

## nv show system security password-hardening

Shows the currently configured password policies for the switch.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show system security password-hardening
                             operational  applied
    -----------------------  -----------  --------
    state                    enabled      enabled
    reject-user-passw-match  disabled     disabled
    lower-class              enabled      enabled
    upper-class              enabled      enabled
    digits-class             disabled     disabled
    special-class            disabled     disabled
    expiration-warning       15           15
    expiration               180          180
    history-cnt              20           20
    len-min                  8            8