Red Hat Bugzilla – Bug 1442083
Delayed name resolving fails when fips is enabled
Last modified: 2018-04-10 11:26:24 EDT
Description of problem: When the FIPS mode was enabled and hostnames specified in ntp.conf couldn't be resolved on start, the resolving process of ntpd is not be able to configure the main process later and it won't be using the servers for synchronization. The problem is that ntpd uses a random MD5 key when no request key was specified in the config and MD5 is not allowed in the FIPS mode. Version-Release number of selected component (if applicable): ntp-4.2.6p5-25.el7_3.1.x86_64 How reproducible: Most of the time Steps to Reproduce: 1. enable FIPS mode 2. disable chronyd service, enable ntpd service 3. reboot Actual results: The "ntpq -pn" command reports that no NTP servers are used and the system log contains an "ntpd_intres[729]: MAC encrypt: digest init failed" error message. Expected results: ntpq -pn lists all servers specified in ntp.conf. Additional info:
Created attachment 1271436 [details] Use SHA1 request key by default to fix delayed name resolving in FIPS mode With this patch ntpd will use by default a random SHA1 key instead of an MD5 key, which is still allowed in the FIPS mode.
Verified. Fixed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:0855