RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1778224 - ssh client prints "FIPS mode initialized" to stderr
Summary: ssh client prints "FIPS mode initialized" to stderr
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: openssh
Version: 8.2
Hardware: Unspecified
OS: Unspecified
low
unspecified
Target Milestone: rc
: 8.2
Assignee: Jakub Jelen
QA Contact: Ondrej Moriš
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-29 14:14 UTC by Christian Heimes
Modified: 2021-05-03 07:42 UTC (History)
4 users (show)

Fixed In Version: openssh-8.0p1-5.el8
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-04 01:31:59 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:4439 0 None None None 2020-11-04 01:32:19 UTC

Description Christian Heimes 2019-11-29 14:14:12 UTC 
Description of problem:
On a system in FIPS mode the ssh client command always prints "FIPS mode initialized" to stderr. This additional message interferes and breaks automation. For example a bunch of automated tests for IPA are currently broken because there is some extra data in stderr.

I suggest that ssh should only print the message in debug or verbose mode.

Version-Release number of selected component (if applicable):
openssh-clients-8.0p1-3.el8

How reproducible:
always

Steps to Reproduce:
1. boot a machine into FIPS mode
2. ssh localhost
3.

Actual results:
ssh client prints "FIPS mode initialized" to stderr

Expected results:
ssh client should not print any message to stderr by default. Instead the "FIPS mode initialized" message should only be printed in verbose mode.

Additional info:
The message is added by openssh-7.7p1-fips.patch
Comment 1 Christian Heimes 2019-11-29 14:23:17 UTC 
It's an easy fix, just replace

    logit("FIPS mode initialized");

with

    debug("FIPS mode initialized");

near ssh.c:1290
Comment 2 Tomas Mraz 2019-11-29 14:44:09 UTC 
As OpenSSH is no longer a FIPS module it should be no problem to apply this proposed change from comment 1.
Comment 3 Jakub Jelen 2019-11-29 15:01:14 UTC 
This message was there for ages. It just means that you never tried to run IPA in FIPS before.

But I agree with Tomas. As we no longer certify OpenSSH, this message probably does not need to be there at all, isn't it Tomas (less patches always better)?

As we do not have errata in RHEL 8.2 and this does not look like super-high priority, I postponed it to the next release.
Comment 4 Christian Heimes 2019-11-29 15:15:16 UTC 
IPA works fine in FIPS mode. The issue does not break IPA itself but rather automated tests. We are currently in the process to enable all upstream integration tests to verify that all features work in FIPS mode.

The integration test system spams a couple of VMs and then runs test scenarios over SSH. Some of the tests are failing in FIPS mode because they get confused by additional text in stderr.
Comment 5 Tomas Mraz 2019-11-29 16:25:18 UTC 
(In reply to Jakub Jelen from comment #3)
> But I agree with Tomas. As we no longer certify OpenSSH, this message
> probably does not need to be there at all, isn't it Tomas (less patches
> always better)?

I suppose you still need to change behavior of openssh based on whether the FIPS mode is enabled or not, for that reason I would recommend keeping that message in the debug output. Of course if this was the only invocation of FIPS_mode() call in the openssh I would not block removing it altogether.
Comment 6 Jakub Jelen 2019-12-02 08:13:27 UTC 
There are still a few conditions with FIPS_mode() in fips patch so I will change it to debug message in the next release.
Comment 22 Vikram Khatri 2020-07-28 12:16:27 UTC 
The message "FIPS mode initialized" is very annoying. Christian Heimes mentions that it is an easy fix. Can you please make sure that this is available in next release. Also,request to backport to RHEL 7.x versions. This annoying message breaks automation.

Thank YOU,
Comment 25 errata-xmlrpc 2020-11-04 01:31:59 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (openssh bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4439
Note You need to log in before you can comment on or make changes to this bug.