10.6 | Server installation and setup | Perform pre-installation steps | On Linux systems

Pre-installation steps on Linux systems

Configuring SonarQube to run in FIPS mode

SonarQube on RedHat Linux can run in FIPS (Federal Information Processing Standard) mode with some limitations. The FIPS mode may require an update of your webhooks configuration as explained below.

Known limitations of the FIPS mode

A FIPS-enabled SonarQube presents the following known limitations.

Elasticsearch authentication in the Data Center Edition of SonarQube will not work on FIPS because PEM certificates are not supported as of today (but we plan to bring this support in the future).
SAML authentication with signature and encryption of the assertion is not supported yet.

Updating the webhooks configuration

In the FIPS mode, the webhook secrets must be at least 16 characters long; otherwise, the webhook messages will not be sent to the FIPS environment.

Proceed as follows:

Check that the secret of each existing webhook is at least 16 characters long. If it’s not the case, update it. See Webhooks.

If you create a new webhook with a secret, you’ll be forced to enter a secret of at least 16 characters.

Configuring the host to comply with Elasticsearch

Because SonarQube uses an embedded Elasticsearch, make sure that your host configuration complies with the Elasticsearch production mode requirements and File Descriptors configuration.

Configuring the maximum number of open files and other limits

You must ensure that:

The maximum number of memory map areas a process may have (vm.max_map_count) is greater than or equal to 524288.
The maximum number of open file descriptors (fs.file-max) is greater than or equal to 131072.
The user running SonarQube can open at least 131072 file descriptors.
The user running SonarQube can open at least 8192 threads.

You must set these limits on the host system, whatever the installation type:

For a Docker installation: These settings will then apply to the Docker container.
For a Kubernetes deployment: Check also these guidelines.

To check and change these limits, login as the user used to run SonarQube and proceed as described below depending on the type of this user.

For a non-systemd user

1. Verify the values listed above with the following commands:

sysctl vm.max_map_count

sysctl fs.file-max

ulimit -n

ulimit -u

2. To change the max map count and the file-max, insert the following in /etc/sysctl.d/99-sonarqube.conf (or in /etc/sysctl.conf if you use the default file (not recommended)). To apply the changes, run the corresponding Linux command.

 vm.max_map_count=524288
 fs.file-max=131072

3. To change the limits on the user running SonarQube, insert the following in /etc/security/limits.d/99-sonarqube.conf (or in /etc/security/limits.conf if you use the default file (not recommended)) where sonarqube is the user used to run SonarQube. To apply the changes, run the corresponding Linux command.

sonarqube   -   nofile   131072

sonarqube   -   nproc    8192

For a systemd user

Specify those limits inside your unit file in the section [Service] :

[Service]

...

LimitNOFILE=131072

LimitNPROC=8192

...

To change these values dynamically for the current session, run the following commands as root:

sysctl -w vm.max_map_count=524288

sysctl -w fs.file-max=131072

ulimit -n 131072

ulimit -u 8192

Enabling seccomp on the Linux kernel

By default, Elasticsearch uses the seccomp filter. Make sure you use a kernel with seccomp enabled.

To check that seccomp is available on your kernel, use:

$ grep SECCOMP /boot/config-$(uname -r)

If your kernel has seccomp, you'll see the following:

CONFIG_HAVE_ARCH_SECCOMP_FILTER=y

CONFIG_SECCOMP_FILTER=y

CONFIG_SECCOMP=y

Managing SonarQube Server access to fonts

Generating executive reports requires that fonts be installed on the server hosting SonarQube.

If you use a Linux server, you should ensure that Fontconfig is installed on the server host.

A package of FreeType fonts is installed on the SonarQube Server host. The exact packages available will vary by distribution, but a commonly used package is libfreetype6.

If using an Oracle database

In case your SonarQube Server is running on Linux and you are using Oracle, the Oracle JDBC Driver may be blocked due to /dev/random. See this Oracle article for more details about this problem.

To avoid it, you may want to add this JVM parameter to your SonarQube web server (sonar.web.javaOpts) configuration:

-Djava.security.egd=file:///dev/urandom

Was this page helpful?