-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
6.14.0, 6.15.z, 6.16.z, 6.17.z, 6.18.0
Description of problem:
FIPS is disabled by default, after provisioning with host parameter fips_enabled set to true using below document.
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html-single/provisioning_hosts/index#Provisioning_FIPS_Compliant_Hosts_provisioning
Tested this on both EL8 and EL9 content hosts.
Version-Release number of selected component (if applicable):
Satellite 6.14.0 Snap 16.0
How reproducible:
Always
Steps to Reproduce:
1. Prepare provisioning setup on Sat 6.14
2. Create a host with host parameter set as fips_enabled=true
3. Verify on host if fips is enabled
[root@fips-host ~]# fips-mode-setup --check
Installation of FIPS modules is not completed.
FIPS mode is disabled.
[root@fips-host ~]# sysctl crypto.fips_enabled
crypto.fips_enabled = 0
Actual results:
FIPS mode is disabled.
Expected results:
FIPS mode is enabled.
Additional info:
As we're setting fips=1 option to the kernel command line in below snippet, and it's set correctly on the syetem, but still FIPS is disabled https://github.com/theforeman/foreman/blob/develop/app/views/unattended/provisioning_templates/snippet/kickstart_kernel_options.erb#L151
# grep -nR fips=1 /etc/kernel/cmdline 1:root=/dev/mapper/rhel_fips--host-root ro nofb splash=quiet crashkernel=auto resume=/dev/mapper/rhel_fips--host-swap rd.lvm.lv=rhel_fips-host/root rd.lvm.lv=rhel_fips-host/swap rhgb quiet fips=1 boot=UUID=9df97543-f500-4319-9acc-0214c574429f
So for Workaround, we need to explicitly enable it after system boots using
[root@fips-host-el9 ~]# fips-mode-setup --enable
Kernel initramdisks are being regenerated. This might take some time.
Setting system policy to FIPS
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies
to fully take place.
FIPS mode will be enabled.
Please reboot the system for the setting to take effect.
Reboot and check again the fips-mode
[root@fips-host-el9 ~]# fips-mode-setup --check
FIPS mode is enabled.