Azure / Azure/WALinuxAgent

OS.EnableFIPS=y raise errors in RHEL-8.2

Open
#1,788 3 comments 0 reactions 0 assignees View on GitHub
triaged V3
Dominant language
Python
Stars
581
Forks
397
Avg merge
2d 15h
Merged PRs (30d)
9

Description

**Describe the bug: A clear and concise description of what the bug is.**
If enable FIPS in RHEL-8.2 and set OS.EnableFIPS=y in waagent.conf, waagent raises many error logs and cannot work well.
If set OS.EnableFIPS=n, seems it can work well even if fips is enabled in system.
* I noticed this warning in readme:
_If no FIPS-compliant certificates are installed, then enabling this option will cause all OpenSSL commands to fail._
I'm not quite understand about that. In what situation the FIPS-compliant certificates will be installed? I only enable the fips in OS. Thanks!

**Distro and WALinuxAgent details (please complete the following information):**
- Distro and Version: RHEL-8.2
- WALinuxAgent version:
WALinuxAgent-2.2.38 running on redhat 8.2
Python: 3.6.8
Goal state agent: 2.2.46

**Steps**
1. Create an RHEL-8.2 in Azure.
2. Enable FIPS:
fips-mode-setup --enable
Set OS.EnableFIPS=y in waagent.conf
waagent -deprovision+user -force
3. Create a new VM and check FIPS status:
Create a new VM, but provision failed.
fips-mode-setup --check
FIPS mode is enabled.
4. Check waagent.log
```
2020/02/21 23:26:37.602290 ERROR Daemon Command: [/usr/bin/openssl req -x509 -nodes -subj /CN=LinuxTransport -days 730 -newkey rsa:2048 -keyout /var/lib/waagent/TransportPrivate.pem -out /var/lib/waagent/TransportCert.pem], return code: [1], result: [FIPS mode not supported.
]
2020/02/21 23:26:37.704304 ERROR Daemon Failed to create /var/lib/waagent/TransportPrivate.pem and /var/lib/waagent/TransportCert.pem certificates
2020/02/21 23:26:38.045960 ERROR Daemon ProtocolError processing goal state, giving up [[ProtocolError] /var/lib/waagent/TransportCert.pem is missing.]
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the RHEL-8.2 setup with FIPS enabled and OS.EnableFIPS=y, then inspect waagent.conf, waagent.log, and the reported OpenSSL certificate-generation command. Done means provisioning completes without the certificate and ProtocolError failures shown in the log, while preserving the documented FIPS behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
cloud, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.