RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2050138 - ipa-server-install command is failing in FIPS mode
Summary: ipa-server-install command is failing in FIPS mode
Keywords:
Status: CLOSED DUPLICATE of bug 2039684
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: krb5
Version: 9.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Julien Rische
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On: 2039684
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-02-03 10:46 UTC by Mohammad Rizwan
Modified: 2022-02-03 14:17 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-02-03 14:17:24 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FREEIPA-7786 0 None None None 2022-02-03 10:56:38 UTC
Red Hat Issue Tracker RHELPLAN-110938 0 None None None 2022-02-03 10:56:42 UTC

Description Mohammad Rizwan 2022-02-03 10:46:55 UTC 
Description of problem:
ipa-server-install command is failing in FIPS mode

Version-Release number of selected component (if applicable):
ipa-server-4.9.8-1.el9.x86_64
ipa-server-dns-4.9.8-1.el9.noarch
python3-3.9.10-1.el9.x86_64

How reproducible:
always

Steps to Reproduce:
1. Enable fips mode
2. ipa-server-install ...
3.

Actual results:
ipa-server-install command is failing

https://ci-jenkins-csb-idmops.apps.ocp-c1.prod.psi.redhat.com/job/ipa-RHEL9.0/job/Nightly-FIPS/job/tier-1-RHEL9.0-Nightly-FIPS-bash-ipa-ctl/15/

http://idm-artifacts.usersys.redhat.com/freeipa/Nightly-FIPS/RHEL9.0/2022-02-02/tier-1/bash-ipa-ctl/15/logs/ipaserver-install.log.gz

Expected results:
ipa-server-install command success

Additional info:
[..]
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc)
  [1/10]: adding kerberos container to the directory
  [2/10]: configuring KDC
  [3/10]: initialize kerberos container
  [error] RuntimeError: Failed to initialize kerberos container
Failed to initialize kerberos container
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
Comment 1 Florence Blanc-Renaud 2022-02-03 11:28:17 UTC 
From the install log, the issue looks very similar to Bug 2039684 - FIPS: kdb5_utils failed to create KDC db with default master_key_type (aes256-cts-hmac-sha1-96):

2022-02-03T10:13:44Z DEBUG args=['kdb5_util', 'create', '-s', '-r', 'TESTREALM.TEST', '-x', 'ipa-setup-override-restrictions']
2022-02-03T10:13:44Z DEBUG Process finished, return code=1
2022-02-03T10:13:44Z DEBUG stdout=Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'TESTREALM.TEST',
master key name 'K/M'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: 
Re-enter KDC database master key to verify: 

2022-02-03T10:13:44Z DEBUG stderr=kdb5_util: Cryptosystem internal error while transforming master key from password

2022-02-03T10:13:44Z DEBUG kdb5_util failed with CalledProcessError(Command ['kdb5_util', 'create', '-s', '-r', 'TESTREALM.TEST', '-x', 'ipa-setup-override-restrictions'] returned non-zero exit status 1: 'kdb5_util: Cryptosystem internal error while transforming master key from password\n')


Moving to krb5 for further investigation.

@myusuf can you add the krb5-related info (which version is installed)? Thx
Comment 2 Mohammad Rizwan 2022-02-03 11:35:59 UTC 
[root@master ~]# rpm -qa | grep krb5
krb5-libs-1.19.1-13.el9.x86_64
krb5-pkinit-1.19.1-13.el9.x86_64
krb5-workstation-1.19.1-13.el9.x86_64
sssd-krb5-common-2.6.2-2.el9.x86_64
krb5-server-1.19.1-13.el9.x86_64
Comment 4 Julien Rische 2022-02-03 14:17:24 UTC 
Due to bug 2039684, KDC DB initialization will fail for these encryption types:

  * des-hmac-sha1
  * aes128-cts (alias of aes128-cts-hmac-sha1-96)
  * aes256-cts (alias of aes256-cts-hmac-sha1-96)

aes256-cts being the enctype used for KDC master key[1]. So this will definitely not work until bug 2039684 is fixed.


[1] https://pagure.io/freeipa/blob/ipa-4-9/f/install/share/kdc.conf.template#_9

*** This bug has been marked as a duplicate of bug 2039684 ***
Note You need to log in before you can comment on or make changes to this bug.