Uploaded image for project: 'Satellite'
  1. Satellite
  2. SAT-20386

Host is not provisioned with FIPS when setting host parameter fips_enabled to true

XMLWordPrintable

    • 0
    • False
    • Important
    • sat-rocket
    • None
    • None
    • None
    • None

      Description of problem:
      FIPS is disabled by default, after provisioning with host parameter fips_enabled set to true using below document.
      https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html-single/provisioning_hosts/index#Provisioning_FIPS_Compliant_Hosts_provisioning

      Tested this on both EL8 and EL9 content hosts.

      Version-Release number of selected component (if applicable):
      Satellite 6.14.0 Snap 16.0

      How reproducible:
      Always

      Steps to Reproduce:
      1. Prepare provisioning setup on Sat 6.14
      2. Create a host with host parameter set as fips_enabled=true
      3. Verify on host if fips is enabled
      [root@fips-host ~]# fips-mode-setup --check
      Installation of FIPS modules is not completed.
      FIPS mode is disabled.
      [root@fips-host ~]# sysctl crypto.fips_enabled
      crypto.fips_enabled = 0

      Actual results:
      FIPS mode is disabled.

      Expected results:
      FIPS mode is enabled.

      Additional info:
      As we're setting fips=1 option to the kernel command line in below snippet, and it's set correctly on the syetem, but still FIPS is disabled https://github.com/theforeman/foreman/blob/develop/app/views/unattended/provisioning_templates/snippet/kickstart_kernel_options.erb#L151

      # grep -nR fips=1 /etc/kernel/cmdline
      1:root=/dev/mapper/rhel_fips--host-root ro nofb splash=quiet crashkernel=auto resume=/dev/mapper/rhel_fips--host-swap rd.lvm.lv=rhel_fips-host/root rd.lvm.lv=rhel_fips-host/swap rhgb quiet fips=1 boot=UUID=9df97543-f500-4319-9acc-0214c574429f
      

      So for Workaround, we need to explicitly enable it after system boots using
      [root@fips-host-el9 ~]# fips-mode-setup --enable
      Kernel initramdisks are being regenerated. This might take some time.
      Setting system policy to FIPS
      Note: System-wide crypto policies are applied on application start-up.
      It is recommended to restart the system for the change of policies
      to fully take place.
      FIPS mode will be enabled.
      Please reboot the system for the setting to take effect.

      Reboot and check again the fips-mode
      [root@fips-host-el9 ~]# fips-mode-setup --check
      FIPS mode is enabled.

              Unassigned Unassigned
              gtalreja@redhat.com Gaurav Talreja
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: