Bug 1778224

Summary:	ssh client prints "FIPS mode initialized" to stderr
Product:	Red Hat Enterprise Linux 8	Reporter:	Christian Heimes <cheimes>
Component:	openssh	Assignee:	Jakub Jelen <jjelen>
Status:	CLOSED ERRATA	QA Contact:	Ondrej Moriš <omoris>
Severity:	unspecified	Docs Contact:
Priority:	low
Version:	8.2	CC:	omoris, tcrider, tmraz, vikram.khatri
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.2	Flags:	jjelen: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssh-8.0p1-5.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 01:31:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Christian Heimes 2019-11-29 14:14:12 UTC

Description of problem:
On a system in FIPS mode the ssh client command always prints "FIPS mode initialized" to stderr. This additional message interferes and breaks automation. For example a bunch of automated tests for IPA are currently broken because there is some extra data in stderr.

I suggest that ssh should only print the message in debug or verbose mode.

Version-Release number of selected component (if applicable):
openssh-clients-8.0p1-3.el8

How reproducible:
always

Steps to Reproduce:
1. boot a machine into FIPS mode
2. ssh localhost
3.

Actual results:
ssh client prints "FIPS mode initialized" to stderr

Expected results:
ssh client should not print any message to stderr by default. Instead the "FIPS mode initialized" message should only be printed in verbose mode.

Additional info:
The message is added by openssh-7.7p1-fips.patch

Comment 1 Christian Heimes 2019-11-29 14:23:17 UTC

It's an easy fix, just replace

    logit("FIPS mode initialized");

with

    debug("FIPS mode initialized");

near ssh.c:1290

Comment 2 Tomas Mraz 2019-11-29 14:44:09 UTC

As OpenSSH is no longer a FIPS module it should be no problem to apply this proposed change from comment 1.

Comment 3 Jakub Jelen 2019-11-29 15:01:14 UTC

This message was there for ages. It just means that you never tried to run IPA in FIPS before.

But I agree with Tomas. As we no longer certify OpenSSH, this message probably does not need to be there at all, isn't it Tomas (less patches always better)?

As we do not have errata in RHEL 8.2 and this does not look like super-high priority, I postponed it to the next release.

Comment 4 Christian Heimes 2019-11-29 15:15:16 UTC

IPA works fine in FIPS mode. The issue does not break IPA itself but rather automated tests. We are currently in the process to enable all upstream integration tests to verify that all features work in FIPS mode.

The integration test system spams a couple of VMs and then runs test scenarios over SSH. Some of the tests are failing in FIPS mode because they get confused by additional text in stderr.

Comment 5 Tomas Mraz 2019-11-29 16:25:18 UTC

(In reply to Jakub Jelen from comment #3)
> But I agree with Tomas. As we no longer certify OpenSSH, this message
> probably does not need to be there at all, isn't it Tomas (less patches
> always better)?

I suppose you still need to change behavior of openssh based on whether the FIPS mode is enabled or not, for that reason I would recommend keeping that message in the debug output. Of course if this was the only invocation of FIPS_mode() call in the openssh I would not block removing it altogether.

Comment 6 Jakub Jelen 2019-12-02 08:13:27 UTC

There are still a few conditions with FIPS_mode() in fips patch so I will change it to debug message in the next release.

Comment 22 Vikram Khatri 2020-07-28 12:16:27 UTC

The message "FIPS mode initialized" is very annoying. Christian Heimes mentions that it is an easy fix. Can you please make sure that this is available in next release. Also,request to backport to RHEL 7.x versions. This annoying message breaks automation.

Thank YOU,

Comment 25 errata-xmlrpc 2020-11-04 01:31:59 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (openssh bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4439