Puppet cannot build module on RHEL 7 in FIPS mode (Puppet Guide)
From the Puppet Guide last step, 2.10 - Finalizing the Module one cannot build the puppet module named "mymodule" into a package on a current RHEL 7 system running in FIPS mode (i.e. DISA STIG for RHEL 7 security profile selected during installation):
# cd /etc/puppet/modules # puppet module build mymodule md5_dgst.c(82): OpenSSL internal error, assertion failed: Digest MD5 forbidden in FIPS mode! Aborted (core dumped)
Even with "sha256" designated within puppet.conf:
# cat /etc/puppet/puppet.conf | grep -v ^$ | grep -v '#' [main] logdir = /var/log/puppet rundir = /var/run/puppet ssldir = $vardir/ssl digest_algorithm = sha256 disable_warnings = deprecations [agent] classfile = $vardir/classes.txt localconfig = $vardir/localconfig
This does not work on a current RHEL 7.4 system with FIPS (FIPS-140-2) enabled and puppet 3.8.6, because even if "digest_algorithm = sha256" is set within the "[main]" section of puppet.conf, the puppet build/install/uninstall/upgrade actions currently require using an MD5 digest. Note that PUP-4963 "puppet module build" fails on FIPS-enabled system issue was resolved (on 2018-02-15) in Puppet 5.4.0+ by simply failing gracefully to not build or uninstall puppet modules when FIPS is enabled. The process to disable FIPS on RHEL6 or RHEL7 is quite involved.
Responses