weizhouapache
commented
2 years ago @rwdj
is this a update of #6232 ?
it looks the db configuration file /etc/cloudstack/management/db.properties is missing.
Open rwdj opened 2 years ago
weizhouapache
commented
2 years ago @rwdj
is this a update of #6232 ?
it looks the db configuration file /etc/cloudstack/management/db.properties is missing.
rwdj
commented
2 years ago @weizhouapache, no, #6232 is mostly unrelated.
/etc/cloudstack/management/db.properties isn't missing. Although I noticed those lines in the error as well. But it also doesn't compile.
[root@rwdj ~]# su - cloud -c 'ls -l /etc/cloudstack/management/db.properties'
-rw-r-----. 1 root cloud 3248 Apr 12 09:53 /etc/cloudstack/management/db.propertiesIt was generated appropriately from:
[root@rwdj ~]# cloudstack-setup-databases cloud:<omitted> --deploy-as=root:<omitted> -i 127.0.0.1
Mysql user name:cloud [ OK ]
Mysql user password:****** [ OK ]
Mysql server ip:localhost [ OK ]
Mysql server port:3306 [ OK ]
Mysql root user name:root [ OK ]
Mysql root user password:****** [ OK ]
Using specified cluster management server node IP 127.0.0.1 [ OK ]
Checking Cloud database files ... [ OK ]
Checking local machine hostname ... [ OK ]
Checking SELinux setup ... [ OK ]
Preparing /etc/cloudstack/management/db.properties [ OK ]
Applying /usr/share/cloudstack-management/setup/create-database.sql [ OK ]
Applying /usr/share/cloudstack-management/setup/create-schema.sql [ OK ]
Applying /usr/share/cloudstack-management/setup/create-database-premium.sql [ OK ]
Applying /usr/share/cloudstack-management/setup/create-schema-premium.sql [ OK ]
Applying /usr/share/cloudstack-management/setup/server-setup.sql [ OK ]
Applying /usr/share/cloudstack-management/setup/templates.sql [ OK ]
Processing encryption ... [ OK ]
Finalizing setup ... [ OK ]A general rule of thumb: if the word "MD5" is ever mentioned at any point, then you'll run into a FIPS issue. FIPS machines aren't able to use MD5 at all. Based on the stacktrace, Java looks to me like it's trying to find files relating to MD5 and they aren't found because Java is running in FIPS-mode. The missing file NONE should be the mentioned "SecretKeyFactory" for PBEWithMD5AndDES, but I'm unaware of the technical details of Java's cipher algorithms.
[rwdj@rwdj ~]$ openssl md5
Error setting digest
140235974117184:error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS:crypto/evp/digest.c:135:And then there's the issue where it won't compile, flat out refusing on the tests due to FIPS being enabled.
FIPS is a Category 1 (almost no exceptions given) specification of DISA's Security Technical Implementation Guides: https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/2021-12-03/finding/V-230223 or https://stigviewer.com/stig/canonical_ubuntu_20.04_lts/2021-11-19/finding/V-238363
rohityadavcloud
commented
2 years ago Thanks for reporting @rwdj, can you advise how to setup a FIPS complaint EL8 mgmt/KVM host? That is what additional steps were taken before you deployed CloudStack on it, maybe there's a common document that describe this process?
rwdj
commented
2 years ago Regarding additional steps, it would be most of the Red Hat Enterprise Linux 8 Security Technical Implementation Guide, but that's probably too much. Checking full STIG compliance for a system takes way too long for this purpose.
The document https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_installing-a-rhel-8-system-with-fips-mode-enabled_security-hardening describes enabling FIPS. In general, it's just making sure the system has fips=1 in the kernel parameters during installation/initialization. And then you can use fips-mode-setup --check to verify it worked (which is not the same way it was done in RHEL7, by the way).
Alternatively, an existing system can be made FIPS compliant with as described here, but it's not recommended by Red Hat. I believe there are a number of things done during initialization that are less complex to do during initialization, but that's only my guess.
rwdj
commented
2 years ago Alternatively, here's documentation for an Ubuntu FIPS environment: https://ubuntu.com/security/certifications/docs/fips-enablement
rwdj
commented
2 years ago Found a page on automated DISA STIG full compliance for Ubuntu Pro (including FIPS): https://ubuntu.com/security/disa-stig
sonipl
commented
10 months ago @rohityadavcloud , do you know when FIPS changes are coming ?
weizhouapache
commented
10 months ago @rohityadavcloud , do you know when FIPS changes are coming ?
@sonipl in the past releases, we have implemented a lot of security improvements. For backwards compatibility, some insecure algorithms are still supported (but not default). if possible, can you check and share a list of non-FIPS-compliant code/features in CloudStack ? cc @rwdj @sonipl
weizhouapache
commented
9 months ago New encryptor based on AesGcmJce, which replaced PBEWithMD5AndDes (which is not FIPS-compliant)
use ed25519 instead of rsa when generate public/private keys
rwdj
commented
7 months ago I'll setup a couple of fresh FIPS-compliant RHEL machines and see what shakes out. Thanks for the hard work!
ISSUE TYPE
COMPONENT NAME
CLOUDSTACK VERSION
CONFIGURATION
OS / ENVIRONMENT
RHEL 8 FIPS compliant system
SUMMARY
Cloudstack uses multiple instances of non-FIPS-compliant features. This makes it impossible to work with in a FIPS compliant environment.
STEPS TO REPRODUCE
On a FIPS compliant system, build as instructed in https://docs.cloudstack.apache.org/en/latest/installguide/building_from_source.html:
On a FIPS compliant RHEL8 system, install and run cloudstack-management.service from https://download.cloudstack.org/centos/8/4.16/ as instructed in https://docs.cloudstack.apache.org/en/latest/installguide/overview/index.html. See #6232 for why I do the chown and chmod steps.
EXPECTED RESULTS
ACTUAL RESULTS
Build
Run.
Upon checking, I found utils/src/main/java/com/cloud/utils/crypt/DBEncryptionUtil.java#L81, where PBEWithMD5AndDES is not FIPS compliant. I'm concerned there are also other spots to check that I can't check because it doesn't build which brings me to the extent of my knowledge.
FIPS compliance can be a stickler, because the core documentation isn't very clear from what I can find. Regarding PBEWithMD5AndDES, after a few searches, the most clear documentation on approved algorithms I could find was this (which is out of date with FIPS 140-3 existing, but probably still correct enough): https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2261.pdf And additional resources that may prove useful: https://github.com/jasypt/jasypt/blob/master/jasypt/src/main/java/org/jasypt/util/text/AES256TextEncryptor.java https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#cipher-algorithm-names https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_installing-a-rhel-8-system-with-fips-mode-enabled_security-hardening