OS.EnableFIPS=y raise errors in RHEL-8.2
- Dominant language
- Python
- Stars
- 581
- Forks
- 397
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 9
Description
**Describe the bug: A clear and concise description of what the bug is.**
If enable FIPS in RHEL-8.2 and set OS.EnableFIPS=y in waagent.conf, waagent raises many error logs and cannot work well.
If set OS.EnableFIPS=n, seems it can work well even if fips is enabled in system.
* I noticed this warning in readme:
_If no FIPS-compliant certificates are installed, then enabling this option will cause all OpenSSL commands to fail._
I'm not quite understand about that. In what situation the FIPS-compliant certificates will be installed? I only enable the fips in OS. Thanks!
**Distro and WALinuxAgent details (please complete the following information):**
- Distro and Version: RHEL-8.2
- WALinuxAgent version:
WALinuxAgent-2.2.38 running on redhat 8.2
Python: 3.6.8
Goal state agent: 2.2.46
**Steps**
1. Create an RHEL-8.2 in Azure.
2. Enable FIPS:
fips-mode-setup --enable
Set OS.EnableFIPS=y in waagent.conf
waagent -deprovision+user -force
3. Create a new VM and check FIPS status:
Create a new VM, but provision failed.
fips-mode-setup --check
FIPS mode is enabled.
4. Check waagent.log
```
2020/02/21 23:26:37.602290 ERROR Daemon Command: [/usr/bin/openssl req -x509 -nodes -subj /CN=LinuxTransport -days 730 -newkey rsa:2048 -keyout /var/lib/waagent/TransportPrivate.pem -out /var/lib/waagent/TransportCert.pem], return code: [1], result: [FIPS mode not supported.
]
2020/02/21 23:26:37.704304 ERROR Daemon Failed to create /var/lib/waagent/TransportPrivate.pem and /var/lib/waagent/TransportCert.pem certificates
2020/02/21 23:26:38.045960 ERROR Daemon ProtocolError processing goal state, giving up [[ProtocolError] /var/lib/waagent/TransportCert.pem is missing.]
```
Contributor guide
Research direction
Start by reproducing the RHEL-8.2 setup with FIPS enabled and OS.EnableFIPS=y, then inspect waagent.conf, waagent.log, and the reported OpenSSL certificate-generation command. Done means provisioning completes without the certificate and ProtocolError failures shown in the log, while preserving the documented FIPS behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- cloud, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100