Red Hat Bugzilla – Bug 1018459
Failed reboot the system with FIPS enabled.
Last modified: 2016-09-19 22:28:08 EDT
Description of problem:
Failed reboot the system with FIPS enabled, I use RHEL6.5-Snapshot-3 server64 system.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Enable FIPS mode
1.1 Install dracut-fips and hamccalc
1.2 modify the /boot/grub/grub.conf to enable FIPS mode
2. reboot machine
Reboot failed.System boot stoped at the service certmonger. To check the details please see the attachment
system booted to FIPS mode
After I set prelink to NO and run "prelink -ua" reboot succeed but can't log in to the system "Authentication failed".
Created attachment 811525 [details]
the reboot screen shot.
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.
Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
I installed the newest RHEL6.5 build RHEL6.5-Snapshot-4.0-server-x86_64,
after I enable the fips mod and run cmd "prelink -ua", I reboot the system, and I login the system successfully. When I didn't run "prelink -ua" I meet this bug again, just like the attachment shows.
If you disable the certmonger service so that it doesn't attempt to start, how does that affect things?
In RHEL6.5-Snapshot-4, I disabled the certmonger service, and the boot stoped on starting rhsmcertd service; but if I run "prelink -ua" then I can reboot the system successfully, and I'm not disable the certmonger service.
This suggests that while certmonger needs fixes to work properly in FIPS mode, that alone won't be enough to solve the doesn't-finish-booting problem that you're seeing. There are additional problems elsewhere which will also need to be solved.
Are you still seeing these errors on 6.5 with the latest certmonger build (as of this writing, certmonger-0.75.2-1.el6)?
I use another method to enable FIPS in RHEL6.x and it works fine.
Can you elaborate on that? I'm trying to figure out if there's something else here that needs fixing, or if I need to close this as works-for-me.
I use RHEL6.5GA server64 to check it bug and without use "prelink -ua" it still works fine, so I think you can close it. BTW I want to ask about how do I know the FIPS mode it running in my system, is there some method to check it?
Thanks! FWIW, I tend to run 'sysctl crypto.fips_enabled' to check whether or not a system is in FIPS mode. It consults /proc/sys/crypto/fips_enabled.