Bug 1456853 - ssh -Q and -G list host key types that are not allowed in FIPS mode
Summary: ssh -Q and -G list host key types that are not allowed in FIPS mode
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openssh
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Jakub Jelen
QA Contact: Stefan Dordevic
URL:
Whiteboard:
Keywords:
: 1459249 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-30 13:59 UTC by Hubert Kario
Modified: 2018-04-10 18:20 UTC (History)
2 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2018-04-10 18:19:11 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:0980 None None None 2018-04-10 18:20 UTC

Description Hubert Kario 2017-05-30 13:59:20 UTC
Description of problem:
When the system is put in fips mode, `ssh -Q key` and `ssh -G example.com | grep key` list algorithms that use the DSS authentication method.
Because DSS in SSH can use only 1024 bit keys, that are considered too weak now, and they are not supported, but are still listed by the above commands

Version-Release number of selected component (if applicable):
openssh-7.4p1-11.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. ssh -Q key | grep dss
2. ssh -G example.com | grep dss
3.

Actual results:
ssh-dss
ssh-dss-cert-v01@openssh.com

hostkeyalgorithms (...),ssh-rsa,ssh-dss
hostbasedkeytypes (...),ssh-rsa,ssh-dss
pubkeyacceptedkeytypes (...),ssh-dss


Expected results:
no dss types listed

Additional info:

Comment 1 Jakub Jelen 2017-05-31 11:09:14 UTC
We should not use ed25519 keys either in FIPS, which is also listed there. After applying the patch, the output in FIPS looks this:

# ssh -Q key
ssh-rsa
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
ssh-rsa-cert-v01@openssh.com
ecdsa-sha2-nistp256-cert-v01@openssh.com
ecdsa-sha2-nistp384-cert-v01@openssh.com
ecdsa-sha2-nistp521-cert-v01@openssh.com

# ssh -G example.com | grep dss
(empty)

I have got the patch ready to fix it in 7.4 or later.

Comment 2 Jakub Jelen 2017-06-07 11:13:23 UTC
no ... we can not remove them from the output of the -Q option, because the keys are technically enabled, but just not used by default.

The -G should certainly not list them.

Comment 6 Stefan Dordevic 2017-12-04 10:23:01 UTC
*** Bug 1459249 has been marked as a duplicate of this bug. ***

Comment 9 errata-xmlrpc 2018-04-10 18:19:11 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:0980


Note You need to log in before you can comment on or make changes to this bug.