CFEngine running under FIPS

------=_Part_46178_1895708447.1737734416471
Content-Type: multipart/alternative; 
	boundary="----=_Part_46179_267566009.1737734416471"

------=_Part_46179_267566009.1737734416471
Content-Type: text/plain; charset="UTF-8"

Hi,

We're running into a problem running CFEngine on Red Hat linux under FIPS, 
using the rpm packages downloaded from 
https://cfengine.com/downloads/cfengine-community/

The same problem doesn't appear to be present in the rpm packages as 
downloaded from the yum repo described there.

Tested with redhat and rocky linux, versions 8, 9 and with 
cfengine-community versions 3.18.x, 3.21.6, 3.24.1


## baseline test

When the OS is booted without FIPS enabled there is no problem.

```
$ sysctl crypto.fips_enabled
crypto.fips_enabled = 0
$ /var/cfengine/bin/cf-promises -df 
/var/cfengine/share/CoreBase/masterfiles/update.cf | grep -i hash
debug: Hashed policy file 
/var/cfengine/share/CoreBase/masterfiles/update.cf to 
MD5=f917539c79f1d88570fc95c37656d9bb
debug: Hashed policy file 
/var/cfengine/share/CoreBase/masterfiles/cfe_internal/update/lib.cf to 
MD5=e1fb6c176ffcfce0b9bda14f95d2c683
```

## failure under FIPS

When the OS is booted with FIPS enabled, all hashes return 
00000000000000000000000000000000

```
$ sysctl crypto.fips_enabled
crypto.fips_enabled = 1
$ /var/cfengine/bin/cf-promises -df 
/var/cfengine/share/CoreBase/masterfiles/update.cf | grep -i hash
debug: Hashed policy file 
/var/cfengine/share/CoreBase/masterfiles/update.cf to 
MD5=00000000000000000000000000000000
debug: Hashed policy file 
/var/cfengine/share/CoreBase/masterfiles/cfe_internal/update/lib.cf to 
MD5=00000000000000000000000000000000
verbose: Skipping loading of duplicate (detected by hash) policy file 
/var/cfengine/share/CoreBase/masterfiles/cfe_internal/update/lib.cf
```


I would guess this is due to the MD5 hashing function being disabled under 
FIPS. But when the same test is run using the same version installed from 
the yum repo, the problem is not seen.

Is it possible for us to override the default digest used? Or is there 
something else we can do to fix the default behaviour?

Any help would be appreciated.

Thank you,
----------
Alex Malowany
Computer Systems Administrator
Scientific Computing
Diamond Light Source Ltd.

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/help-cfengine/b54d7abd-bcfd-4fe2-89fa-ef49816f5e18n%40googlegroups.com.

------=_Part_46179_267566009.1737734416471
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,<br /><br />We're running into a problem running CFEngine on Red Hat lin=
ux under FIPS, using the rpm packages downloaded from https://cfengine.com/=
downloads/cfengine-community/<br /><br />The same problem doesn't appear to=
 be present in the rpm packages as downloaded from the yum repo described t=
here.<br /><br />Tested with redhat and rocky linux, versions 8, 9 and with=
 cfengine-community versions 3.18.x, 3.21.6, 3.24.1<br /><div><br /></div><=
div><br /></div>## baseline test<br /><br />When the OS is booted without F=
IPS enabled there is no problem.<br /><br />```<br />$ sysctl crypto.fips_e=
nabled<br />crypto.fips_enabled =3D 0<br />$ /var/cfengine/bin/cf-promises =
-df /var/cfengine/share/CoreBase/masterfiles/update.cf | grep -i hash<br />=
   debug: Hashed policy file /var/cfengine/share/CoreBase/masterfiles/updat=
e.cf to MD5=3Df917539c79f1d88570fc95c37656d9bb<br />   debug: Hashed policy=
 file /var/cfengine/share/CoreBase/masterfiles/cfe_internal/update/lib.cf t=
o MD5=3De1fb6c176ffcfce0b9bda14f95d2c683<br />```<br /><br />## failure und=
er FIPS<br /><br />When the OS is booted with FIPS enabled, all hashes retu=
rn 00000000000000000000000000000000<br /><br />```<br />$ sysctl crypto.fip=
s_enabled<br />crypto.fips_enabled =3D 1<br />$ /var/cfengine/bin/cf-promis=
es -df /var/cfengine/share/CoreBase/masterfiles/update.cf | grep -i hash<br=
 />   debug: Hashed policy file /var/cfengine/share/CoreBase/masterfiles/up=
date.cf to MD5=3D00000000000000000000000000000000<br />   debug: Hashed pol=
icy file /var/cfengine/share/CoreBase/masterfiles/cfe_internal/update/lib.c=
f to MD5=3D00000000000000000000000000000000<br /> verbose: Skipping loading=
 of duplicate (detected by hash) policy file /var/cfengine/share/CoreBase/m=
asterfiles/cfe_internal/update/lib.cf<br />```<br /><br /><br />I would gue=
ss this is due to the MD5 hashing function being disabled under FIPS. But w=
hen the same test is run using the same version installed from the yum repo=
, the problem is not seen.<br /><br />Is it possible for us to override the=
 default digest used? Or is there something else we can do to fix the defau=
lt behaviour?<br /><br />Any help would be appreciated.<br /><br />Thank yo=
u,<br />----------<br />Alex Malowany<br />Computer Systems Administrator<b=
r />Scientific Computing<br />Diamond Light Source Ltd.<br />

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;help-cfengine&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">help-=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
help-cfengine/b54d7abd-bcfd-4fe2-89fa-ef49816f5e18n%40googlegroups.com?utm_=
medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/help-=
cfengine/b54d7abd-bcfd-4fe2-89fa-ef49816f5e18n%40googlegroups.com</a>.<br /=
>

------=_Part_46179_267566009.1737734416471--

------=_Part_46178_1895708447.1737734416471--