Actions
Bug #23054
closed
Oracle Linux 8 agent segfaults on FIPS system
Pull Request:
Severity:
Critical - prevents main use of Rudder | no workaround | data loss | security
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No
Description
On Oracle Linux 8 on a FIPS system (STIG installation or something like that), the rudder agent fails with segfault during policy update
The same rules on an Oracle Linux 9 does not break the rudder agent
Update:
- the problem is that FIPS forbids MD5 and that CFEngine uses MD5 to create the node identifier (by key pinning)
- in Oracle 8 we use the system openssl while in Oracle 9 we embed one, so that's why there's a difference in observed behavior
- the workaround would be to also embed openssl in Oracle 8
- the correction is to make CFEngine able to use both MD5 (for compat and migration) and SHA2.
Updated by 
Updated by 
Updated by 
Updated by
Actions