Agent continuously logs error on FIPS compliant server #668

Activity

1. Rakesh Ginjupalli (linuxelf001)

   changed the title [-]Agent continously logs error on FIPS compliant server[/-] [+]Agent continuously logs error on FIPS compliant server[/+] on Apr 14, 2017
2. Rakesh Ginjupalli (linuxelf001)

   changed the title [-]Agent continuously logs error on FIPS compliant server[/-] [+]Agent continuously logs error on RHEL 6.x FIPS compliant server[/+] on Apr 14, 2017
3. Rakesh Ginjupalli (linuxelf001)

   changed the title [-]Agent continuously logs error on RHEL 6.x FIPS compliant server[/-] [+]Agent continuously logs error on FIPS compliant server[/+] on Apr 14, 2017
4. hglkrijger commented on Apr 17, 2017

   

   Hans Krijger (hglkrijger)

   on Apr 17, 2017

   Member

   More actions

   Rakesh Ginjupalli (@linuxelf001) this is expected since the agent does not support FIPS today.
5. Hans Krijger (hglkrijger)

   closed this as completedon Apr 17, 2017
6. brendandixon commented on Apr 21, 2017

   

   brendandixon

   on Apr 21, 2017

   Contributor

   More actions

   Reopening to trace investigation / implementation.
7. brendandixon

   reopened this on Apr 21, 2017
8. brendandixon

   added this to the v2.2.11 milestone on Apr 21, 2017
9. brendandixon

   added a commit that references this issue on May 1, 2017

   Merge pull request #690 from brendandixon/master

   ...

   955b532
10. brendandixon commented on May 1, 2017

    

    brendandixon

    on May 1, 2017

    Contributor

    More actions

    Addressed by #690
11. brendandixon

    closed this as completedon May 1, 2017
12. johanburati commented on Sep 21, 2017

    

    Johan Burati (johanburati)

    on Sep 21, 2017

    Last edited by johanburati

    Contributor

    More actions

    I have enabled FIPS on the Marketplace RHEL 7.4 image (kernel 3.10.0-693.el7.x86_64) and I can see the same error messages in waagent.log

    version

    waagent -version
    WALinuxAgent-2.2.14 running on redhat 7.4
    Python: 2.7.5
    Goal state agent: 2.2.17
    

    log

    2017/09/21 04:29:49.386418 ERROR Command: '/usr/bin/openssl cms -decrypt -in /var/lib/waagent/Certificates.p7m -inkey /var/lib/waagent/TransportPrivate.pem -recip /var/lib/waagent/TransportCert.pem | /usr/bin/openssl pkcs12 -nodes -passw
    ord pass: -out /var/lib/waagent/Certificates.pem'
    2017/09/21 04:29:49.413085 ERROR Return code: 1
    2017/09/21 04:29:49.418465 ERROR Result: MAC verified OK
    Error outputting keys and certificates
    140528231827360:error:060740A0:digital envelope routines:EVP_PBE_CipherInit:unknown cipher:evp_pbe.c:181:
    140528231827360:error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error:p12_decr.c:87:
    140528231827360:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:139: