[IBM] "fips=1": Prompt "An exception during the transaction: Command '['service', 'sshd', 'restart']' returned non-zero exit status 1" when configuring ssh
Created attachment 940258[details]
ovirt-node.log
Description of problem:
Auto install RHEV-H with fips=1, it will prompt "An exception during the
transaction: Command '['service', 'sshd', 'restart']' returned non-zero
exit status 1" when configuring ssh.
Version-Release number of selected component (if applicable):
rhev-hypervisor6-6.5-20140915.0.iso
ovirt-node-3.0.1-18.el6_5.16.noarch
vdsm-4.14.13-2.el6ev.x86_64
How reproducible:
100%
Steps to Reproduce:
1. Auto install RHEV-H with below parameters:
BOOTIF=eth0 storage_init=/dev/sda adminpw=xxxxxx fips=1 firstboot
2. Login RHEV-H.
3. Configuring SSH.
Actual results:
Prompt "An exception during the transaction: Command '['service',
'sshd', 'restart']' returned non-zero exit status 1" when configuring ssh.
Expected results:
No such issue if without "fips=1"
(In reply to Ryan Barry from comment #4)
> I'm not able to reproduce this in KVM. Does it require specific hardware?
>
Just VM (with fips=1)is enough.
> Can you grab the output of "/usr/sbin/sshd -D", please?
#/usr/sbin/sshd -D
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_dsa_key
Note: this doesn't seem to affect EL7.
Trying fips=1 on my workstation segfaults the VM (probably because FIPS isn't available on the host). I'm going to try setting up another machine tomorrow to look at this.
I'm not able to get this working on any systems I have for a variety of reasons (LUKS, kernel panic on F20, FIPS won't load with binary drivers available). I'm going to try to work around this.
If there's test hardware you can make available wtih FIPS enabled, I would appreciate it.
Created attachment 940258 [details] ovirt-node.log Description of problem: Auto install RHEV-H with fips=1, it will prompt "An exception during the transaction: Command '['service', 'sshd', 'restart']' returned non-zero exit status 1" when configuring ssh. Version-Release number of selected component (if applicable): rhev-hypervisor6-6.5-20140915.0.iso ovirt-node-3.0.1-18.el6_5.16.noarch vdsm-4.14.13-2.el6ev.x86_64 How reproducible: 100% Steps to Reproduce: 1. Auto install RHEV-H with below parameters: BOOTIF=eth0 storage_init=/dev/sda adminpw=xxxxxx fips=1 firstboot 2. Login RHEV-H. 3. Configuring SSH. Actual results: Prompt "An exception during the transaction: Command '['service', 'sshd', 'restart']' returned non-zero exit status 1" when configuring ssh. Expected results: No such issue if without "fips=1"