Bug 1018459 - Failed reboot the system with FIPS enabled.
Failed reboot the system with FIPS enabled.
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: certmonger (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Nalin Dahyabhai
Depends On:
Blocks: 1061410
  Show dependency treegraph
Reported: 2013-10-12 04:45 EDT by xingge
Modified: 2016-09-19 22:28 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-06-19 06:10:12 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
the reboot screen shot. (62.15 KB, image/png)
2013-10-12 04:47 EDT, xingge
no flags Details

  None (edit)
Description xingge 2013-10-12 04:45:42 EDT
Description of problem:
Failed reboot the system with FIPS enabled, I use RHEL6.5-Snapshot-3 server64 system.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Enable FIPS mode
 1.1 Install dracut-fips and hamccalc 
 1.2 modify the /boot/grub/grub.conf to enable FIPS mode
2. reboot machine

Actual results:
Reboot failed.System boot stoped at the service certmonger. To check the details please see the attachment

Expected results:
system booted to FIPS mode

Additional info:
After I set prelink to NO and run "prelink -ua" reboot succeed but can't log in to the system "Authentication failed".
Comment 1 xingge 2013-10-12 04:47:36 EDT
Created attachment 811525 [details]
the reboot screen shot.
Comment 2 RHEL Product and Program Management 2013-10-13 19:00:06 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 4 xingge 2013-10-18 05:52:34 EDT
I installed the newest RHEL6.5 build RHEL6.5-Snapshot-4.0-server-x86_64, 
after I enable the fips mod and run cmd "prelink -ua", I reboot the system, and I login the system successfully. When I didn't run "prelink -ua" I meet this bug again, just like the attachment shows.
Comment 5 Nalin Dahyabhai 2013-10-18 10:04:04 EDT
If you disable the certmonger service so that it doesn't attempt to start, how does that affect things?
Comment 6 xingge 2013-10-23 05:28:16 EDT
In RHEL6.5-Snapshot-4, I disabled the certmonger service, and the boot stoped on starting rhsmcertd service; but if I run "prelink -ua" then I can reboot the system successfully, and I'm not disable the certmonger service.
Comment 7 Nalin Dahyabhai 2013-10-23 11:16:20 EDT
This suggests that while certmonger needs fixes to work properly in FIPS mode, that alone won't be enough to solve the doesn't-finish-booting problem that you're seeing.  There are additional problems elsewhere which will also need to be solved.
Comment 8 Nalin Dahyabhai 2014-06-17 18:10:47 EDT
Are you still seeing these errors on 6.5 with the latest certmonger build (as of this writing, certmonger-0.75.2-1.el6)?
Comment 9 xingge 2014-06-17 22:53:29 EDT
hi Nalin
I use another method to enable FIPS in RHEL6.x and it works fine.
Comment 10 Nalin Dahyabhai 2014-06-18 11:26:17 EDT
Can you elaborate on that?  I'm trying to figure out if there's something else here that needs fixing, or if I need to close this as works-for-me.
Comment 11 xingge 2014-06-19 06:10:12 EDT
I use RHEL6.5GA server64 to check it bug and without use "prelink -ua" it still works fine, so I think you can close it. BTW I want to ask about how do I know the FIPS mode it running in my system, is there some method to check it?
Comment 12 Nalin Dahyabhai 2014-06-19 08:37:15 EDT
Thanks!  FWIW, I tend to run 'sysctl crypto.fips_enabled' to check whether or not a system is in FIPS mode.  It consults /proc/sys/crypto/fips_enabled.

Note You need to log in before you can comment on or make changes to this bug.