freeipa

#9407 FIPs no PKCS12KDF support
Closed: worksforme by cheimes. Opened by entrepreneuraj.

Closed: worksforme
Reopen Issue

Issue

Setting up a fresh install of FreeIPA on Fedora 38 VPS with FIPs enabled after task 17 fails with the following message

[17/30]: requesting RA certificate from CA

[error] CalledProcessError: CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nokeys', '-clcerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmpfufotvvx', '-passin', 'file:/tmp/tmpwdlfgkkt'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n')
CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nokeys', '-clcerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmpfufotvvx', '-passin', 'file:/tmp/tmpwdlfgkkt'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n')

The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Steps to Reproduce

  1. Install Fedora 38
  2. Enable fips with fips-mode-setup
  3. add fips=1 to grub and recreate bootloader
  4. Run freeipa-server-install

Actual behavior

The installer fails to create and RA certificate from Dogtag due to fips blocking PKCS12KDF support

Expected behavior

Server install should complete and be running FIPs compliantly.

Version/Release/Distribution

VPS Since destroyed was using latest dnf version on the 2nd of July 2023

Additional info:

Been advised in FreeIPA-Users mailing list that FreeIPA is not truly fips compliant.
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/W2RGIXMEMT3SRAAUXDEQTKAGKH33QPHF/#W2RGIXMEMT3SRAAUXDEQTKAGKH33QPHF

Did you reboot the system between step 3 and 4? If you forgot to reboot, then the system is in a bad limbo-state. Some parts of the system enforce FIPS' crypto policy, but other parts do not enforce FIPS or cannot detect FIPS mode properly.

PS: I wrote that Fedora is not FIPS compliant. FreeIPA on Fedora isn't FIPS compliant because the OS isn't FIPS compliant.

Hi, yes I had to reboot prior to install to confirm fips was active and then proceeded to use dnf to install FreeIPA server rebooted again as I ran system updates the ran freeipa-server-install

3 Jul 2023 12:28:53 Christian Heimes pagure@pagure.io:

cheimes added a new comment to an issue you are following:
``
Did you reboot the system between step 3 and 4? If you forgot to reboot, then the system is in a bad limbo-state. Some parts of the system enforce FIPS' crypto policy, but other parts do not enforce FIPS or cannot detect FIPS mode properly.

PS: I wrote that Fedora is not FIPS compliant. FreeIPA on Fedora isn't FIPS compliant because the OS isn't FIPS compliant.
``

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/9407

The issue should have been fixed in the main branch in commit 6bd9d156e05c6dd0d4f9ece2aa3df34e77c58749 and in 4.10 branch in commit c853cfde56fb56798424bd402012d78ed47647c0. Either the fix is incomplete or it's missing.

We are going to need the exact version information and the install log file to investigate further.

I will try again fresh tonight and report back

3 Jul 2023 13:42:54 Christian Heimes pagure@pagure.io:

cheimes added a new comment to an issue you are following:
``
The issue should have been fixed in the main branch in commit 6bd9d156e05c6dd0d4f9ece2aa3df34e77c58749 and in 4.10 branch in commit c853cfde56fb56798424bd402012d78ed47647c0. Either the fix is incomplete or it's missing.

We are going to need the exact version information and the install log file to investigate further.
``

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/9407

No response from the original poster. I'm closing the issue since I believe that the bug is fixed already.

Metadata Update from @cheimes:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.