Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2050138

Summary:	ipa-server-install command is failing in FIPS mode
Product:	Red Hat Enterprise Linux 9	Reporter:	Mohammad Rizwan <myusuf>
Component:	krb5	Assignee:	Julien Rische <jrische>
Status:	CLOSED DUPLICATE	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	dpal, fdvorak, frenaud, jrische, rcritten, tapazogl, tscherf
Target Milestone:	rc	Flags:	pm-rhel: mirror+
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-02-03 14:17:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2039684
Bug Blocks:

Description Mohammad Rizwan 2022-02-03 10:46:55 UTC

Description of problem:
ipa-server-install command is failing in FIPS mode

Version-Release number of selected component (if applicable):
ipa-server-4.9.8-1.el9.x86_64
ipa-server-dns-4.9.8-1.el9.noarch
python3-3.9.10-1.el9.x86_64

How reproducible:
always

Steps to Reproduce:
1. Enable fips mode
2. ipa-server-install ...
3.

Actual results:
ipa-server-install command is failing

https://ci-jenkins-csb-idmops.apps.ocp-c1.prod.psi.redhat.com/job/ipa-RHEL9.0/job/Nightly-FIPS/job/tier-1-RHEL9.0-Nightly-FIPS-bash-ipa-ctl/15/

http://idm-artifacts.usersys.redhat.com/freeipa/Nightly-FIPS/RHEL9.0/2022-02-02/tier-1/bash-ipa-ctl/15/logs/ipaserver-install.log.gz

Expected results:
ipa-server-install command success

Additional info:
[..]
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc)
  [1/10]: adding kerberos container to the directory
  [2/10]: configuring KDC
  [3/10]: initialize kerberos container
  [error] RuntimeError: Failed to initialize kerberos container
Failed to initialize kerberos container
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Comment 1 Florence Blanc-Renaud 2022-02-03 11:28:17 UTC

From the install log, the issue looks very similar to Bug 2039684 - FIPS: kdb5_utils failed to create KDC db with default master_key_type (aes256-cts-hmac-sha1-96):

2022-02-03T10:13:44Z DEBUG args=['kdb5_util', 'create', '-s', '-r', 'TESTREALM.TEST', '-x', 'ipa-setup-override-restrictions']
2022-02-03T10:13:44Z DEBUG Process finished, return code=1
2022-02-03T10:13:44Z DEBUG stdout=Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'TESTREALM.TEST',
master key name 'K/M'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: 
Re-enter KDC database master key to verify: 

2022-02-03T10:13:44Z DEBUG stderr=kdb5_util: Cryptosystem internal error while transforming master key from password

2022-02-03T10:13:44Z DEBUG kdb5_util failed with CalledProcessError(Command ['kdb5_util', 'create', '-s', '-r', 'TESTREALM.TEST', '-x', 'ipa-setup-override-restrictions'] returned non-zero exit status 1: 'kdb5_util: Cryptosystem internal error while transforming master key from password\n')


Moving to krb5 for further investigation.

@myusuf can you add the krb5-related info (which version is installed)? Thx

Comment 2 Mohammad Rizwan 2022-02-03 11:35:59 UTC

[root@master ~]# rpm -qa | grep krb5
krb5-libs-1.19.1-13.el9.x86_64
krb5-pkinit-1.19.1-13.el9.x86_64
krb5-workstation-1.19.1-13.el9.x86_64
sssd-krb5-common-2.6.2-2.el9.x86_64
krb5-server-1.19.1-13.el9.x86_64

Comment 4 Julien Rische 2022-02-03 14:17:24 UTC

Due to bug 2039684, KDC DB initialization will fail for these encryption types:

  * des-hmac-sha1
  * aes128-cts (alias of aes128-cts-hmac-sha1-96)
  * aes256-cts (alias of aes256-cts-hmac-sha1-96)

aes256-cts being the enctype used for KDC master key[1]. So this will definitely not work until bug 2039684 is fixed.


[1] https://pagure.io/freeipa/blob/ipa-4-9/f/install/share/kdc.conf.template#_9

*** This bug has been marked as a duplicate of bug 2039684 ***