freeipa

#8082 Default client configuration breaks ssh in FIPS mode.
Opened by cheimes. Modified

Open
Close Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1756432

Description of problem:
Apparently by default (ssh_trust_dns option true) we set the HostKeyAlgorithms
options for ssh in clients to a very restrictive set "ssh-rsa,ssh-dss".
this was done in 2012 to deal with an older version of ssh which did not
properly support ecdsa keyex in the SSHFP checking case.
However this option ends up disabling all modern key exchanges (SHA-2/EC) and
re-enables a key excahnge that is explicitly disabled in FIPS mode (DSA based).
The main issue though is that because of these options a RHEL-8 client (also
RHEL-7) enrolled in IPA is unable to successfully SSH into a RHEL-8 server in
FIPS mode, as there is no common set of algorithms left.
This is a high profile issue for any customers that want to use IDm client in a
FIPS environment.
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:

Metadata Update from @cheimes:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1756432

 
sed -i 's/^\(HostKeyAlgorithms ssh-rsa,ssh-dss\)$/# disabled by ipa-client update\n# \1/' /etc/ssh/ssh_config

Metadata Update from @cheimes:
- Issue assigned to cheimes

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/3887

master:

  • 97a31e69e8399933d45006c744ddafcf036eca5f Use default ssh host key algorithms

ipa-4-8:

  • 2422970c34849192b15d1798eae9b11a400e7119 Use default ssh host key algorithms

ipa-4-6:

  • 7cd1d565ac2b240eda697dbebb043a1a2885d23a Use default ssh host key algorithms

ipa-4-7:

  • fb313d83adf04bc52f047c9167ade9be4c28e946 Use default ssh host key algorithms

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • bba41dc85c8427992b5626b5a9daaf86c3b2a812 Test for check of HostKeyAlgorithms option in ssh_config

ipa-4-8:

  • ac67dc9d385e622750c0e205e7848cf2fde88387 Test for check of HostKeyAlgorithms option in ssh_config

ipa-4-6:

  • 482bf8a53e64bb115f2a37a2973875937abbd7d4 Test for check of HostKeyAlgorithms option in ssh_config

Metadata Update from @fcami:
- Custom field affects_doc adjusted to on
- Custom field knownissue adjusted to on
- Issue set to the milestone: None (was: FreeIPA 4.6.7)
- Issue status updated to: Open (was: Closed)

Reopening as CI templates were not edited.

master:

  • 82e45d1f1234c472f235d9ca8922387fff3bb2e0 PR-CI templates: add test_integration/test_installation_client.py

Metadata Update from @frenaud:
- Issue tagged with: fips
Metadata

fips

None
None
None
https://github.com/freeipa/freeipa/pull/3887
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.