SUSE OpenSSH comes with FIPS 140-2 support. There are two levels of FIPS mode that the OpenSSH binaries support - "compatibility" and "full". The "compatibility" mode is triggered when OpenSSL reports to be in its FIPS mode itself. If that is the case non FIPS 140-2 cryptographic algorithms are disabled. No other actions are taken. In the "full" mode the binaries (ssh, sshd, sftp-server) perform FIPS mandatory selfcheck and proceeds only when the checks succeed. The checks require the cryptographic hashes contained in the openssh-fips package. The checks are triggered in two ways - either 1) /proc/sys/crypto/fips_enabled contains a single character '1'; or 2) the environment variable SSH_FORCE_FIPS is set (to any value).