Bug 1330013

Description of problem:
Unable to get NTP working on servers that have been modified per RedHat site instructions to be FIPS 140-2 compliant.
When starting ntpd, segfault occurs.



Version-Release number of selected component (if applicable)::
Red Hat Enterprise Linux Server release 6.7 (Santiago)
dracut-fips-004-400.el6.noarch
dracut-004-400.el6.noarch
fipscheck-lib-1.2.0-7.el6.x86_64
ntp-4.2.6p5-5.el6_7.4.x86_64
kernel-2.6.32-573.18.1.el6.x86_64
fipscheck-1.2.0-7.el6.x86_64




How reproducible:
Two servers, both with FIPS enabled per  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-Federal_Standards_And_Regulations-Federal_Information_Processing_Standard.html#enabling-fips-mode .


Summarizing steps for FIPS:
# vi /etc/sysconfig/prelink
...
PRELINKING=no 
...

# prelink -u -a  <<-- It takes lot of time.
# yum install dracut-fips
# dracut -f	
# df /boot
# vi /boot/grub/grub.conf
...
kernel <line>.... fips=1 boot=/dev/vda1
....

# reboot
# cat /proc/sys/crypto/fips_enabled 
1



Server 1: 
/etc/ntp.conf:
server 0.rhel.pool.ntp.org
crypto
includefile /etc/ntp/crypto/pw

# ntp-keygen -T -C aes-256-cbc -c DSA-SHA1 -m 1024 -b 1024 -S DSA -p apassword



Server 2 /etc/ntp.conf:
server <IP address of server 1> autokey
crypto
includefile /etc/ntp/crypto/pw

# ntp-keygen -C aes-256-cbc -c DSA-SHA1 -m 1024 -b 1024 -S DSA -p apassword

On both servers, /etc/ntp/crypto/pw:
crypto pw apassword


Start NTP on both servers.  See segfault on server 2 as soon as it queries server 1.


Actual results at my TEST machine:
[root@dhcp223-194 crypto]# tail /var/log/messages
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: Listen and drop on 1 v6wildcard :: UDP 123
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: Listen normally on 2 lo 127.0.0.1 UDP 123
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: Listen normally on 3 eth1 10.76.1.107 UDP 123
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: Listen normally on 4 lo ::1 UDP 123
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: Listen normally on 5 eth1 fe80::5054:ff:fe07:613b UDP 123
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: Listening on routing socket on fd #22 for interface updates
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: 0.0.0.0 c016 06 restart
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: 0.0.0.0 c012 02 freq_set kernel 0.000 PPM
Apr 25 15:02:13 dhcp223-194 ntpd[3546]: 0.0.0.0 c011 01 freq_not_set
Apr 25 15:02:14 dhcp223-194 kernel: ntpd[3546]: segfault at 0 ip (null) sp 00007ffe335da7e8 error 14 in libnss_files-2.12.so[7f400f51a000+c000]



Actual results at customer TEST machine:
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: proto: precision = 0.170 usec
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: 0.0.0.0 c01d 0d kern kernel time sync enabled
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: Listen and drop on 1 v6wildcard :: UDP 123
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: Listen normally on 2 lo 127.0.0.1 UDP 123
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: Listen normally on 3 eth0 192.168.1.169 UDP 123
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: Listen normally on 4 eth1 192.168.56.109 UDP 123
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: Listen normally on 5 lo ::1 UDP 123
Apr 12 15:36:01 RHEL6_7_test ntpd[1818]: Listening on routing socket on fd #22 for interface updates
Apr 12 15:36:21 RHEL6_7_test ntpd[1818]: Deferring DNS for 0.centos.pool.ntp.org 1
Apr 12 15:36:21 RHEL6_7_test ntpd[1818]: 0.0.0.0 c016 06 restart
Apr 12 15:36:21 RHEL6_7_test ntpd[1818]: 0.0.0.0 c012 02 freq_set kernel 0.000 PPM
Apr 12 15:36:21 RHEL6_7_test ntpd[1818]: 0.0.0.0 c011 01 freq_not_set
Apr 12 15:36:23 RHEL6_7_test ntpd[1818]: 0.0.0.0 c61c 0c clock_step +0.619749 s
Apr 12 15:36:23 RHEL6_7_test ntpd[1818]: 0.0.0.0 c614 04 freq_mode
Apr 12 15:36:24 RHEL6_7_test ntpd[1818]: 0.0.0.0 c618 08 no_sys_peer
Apr 12 15:36:24 RHEL6_7_test ntpd_intres[1822]: DNS 0.centos.pool.ntp.org -> 108.61.194.85
Apr 12 15:36:24 RHEL6_7_test ntpd_intres[1822]: MAC encrypt: digest init failed
Apr 12 15:36:24 RHEL6_7_test ntpd_intres[1822]: intres maclen 0 expected 20
Apr 12 15:38:25 RHEL6_7_test kernel: ntpd[1818]: segfault at 0 ip (null) sp 00007ffd482e5e28 error 14 in libresolv-2.12.so[7f8fb0d53000+16000]




Expected results:
It should not segfault and NTPD should work fine.