Bug 1778224 - ssh client prints "FIPS mode initialized" to stderr
Summary: ssh client prints "FIPS mode initialized" to stderr
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: openssh
Version: 8.2
Hardware: Unspecified
OS: Unspecified
low
unspecified
Target Milestone: rc
: 8.2
Assignee: Jakub Jelen
QA Contact: Ondrej Moriš
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-29 14:14 UTC by Christian Heimes
Modified: 2021-05-03 07:42 UTC (History)
4 users (show)

Fixed In Version: openssh-8.0p1-5.el8
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-04 01:31:59 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:4439 0 None None None 2020-11-04 01:32:19 UTC

Description Christian Heimes 2019-11-29 14:14:12 UTC
Description of problem:
On a system in FIPS mode the ssh client command always prints "FIPS mode initialized" to stderr. This additional message interferes and breaks automation. For example a bunch of automated tests for IPA are currently broken because there is some extra data in stderr.

I suggest that ssh should only print the message in debug or verbose mode.

Version-Release number of selected component (if applicable):
openssh-clients-8.0p1-3.el8

How reproducible:
always

Steps to Reproduce:
1. boot a machine into FIPS mode
2. ssh localhost
3.

Actual results:
ssh client prints "FIPS mode initialized" to stderr

Expected results:
ssh client should not print any message to stderr by default. Instead the "FIPS mode initialized" message should only be printed in verbose mode.

Additional info:
The message is added by openssh-7.7p1-fips.patch

Comment 1 Christian Heimes 2019-11-29 14:23:17 UTC
It's an easy fix, just replace

    logit("FIPS mode initialized");

with

    debug("FIPS mode initialized");

near ssh.c:1290

Comment 2 Tomas Mraz 2019-11-29 14:44:09 UTC
As OpenSSH is no longer a FIPS module it should be no problem to apply this proposed change from comment 1.

Comment 3 Jakub Jelen 2019-11-29 15:01:14 UTC
This message was there for ages. It just means that you never tried to run IPA in FIPS before.

But I agree with Tomas. As we no longer certify OpenSSH, this message probably does not need to be there at all, isn't it Tomas (less patches always better)?

As we do not have errata in RHEL 8.2 and this does not look like super-high priority, I postponed it to the next release.

Comment 4 Christian Heimes 2019-11-29 15:15:16 UTC
IPA works fine in FIPS mode. The issue does not break IPA itself but rather automated tests. We are currently in the process to enable all upstream integration tests to verify that all features work in FIPS mode.

The integration test system spams a couple of VMs and then runs test scenarios over SSH. Some of the tests are failing in FIPS mode because they get confused by additional text in stderr.

Comment 5 Tomas Mraz 2019-11-29 16:25:18 UTC
(In reply to Jakub Jelen from comment #3)
> But I agree with Tomas. As we no longer certify OpenSSH, this message
> probably does not need to be there at all, isn't it Tomas (less patches
> always better)?

I suppose you still need to change behavior of openssh based on whether the FIPS mode is enabled or not, for that reason I would recommend keeping that message in the debug output. Of course if this was the only invocation of FIPS_mode() call in the openssh I would not block removing it altogether.

Comment 6 Jakub Jelen 2019-12-02 08:13:27 UTC
There are still a few conditions with FIPS_mode() in fips patch so I will change it to debug message in the next release.

Comment 22 Vikram Khatri 2020-07-28 12:16:27 UTC
The message "FIPS mode initialized" is very annoying. Christian Heimes mentions that it is an easy fix. Can you please make sure that this is available in next release. Also,request to backport to RHEL 7.x versions. This annoying message breaks automation.

Thank YOU,

Comment 25 errata-xmlrpc 2020-11-04 01:31:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (openssh bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4439


Note You need to log in before you can comment on or make changes to this bug.