Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation

  • Comments
  • Puppet cannot build module on RHEL 7 in FIPS mode (Puppet Guide)

    Posted on

    From the Puppet Guide last step, 2.10 - Finalizing the Module one cannot build the puppet module named "mymodule" into a package on a current RHEL 7 system running in FIPS mode (i.e. DISA STIG for RHEL 7 security profile selected during installation):

    # cd /etc/puppet/modules
    # puppet module build mymodule
    md5_dgst.c(82): OpenSSL internal error, assertion failed: Digest MD5 forbidden in FIPS mode!
    Aborted (core dumped)
    

    Even with "sha256" designated within puppet.conf:

    # cat /etc/puppet/puppet.conf | grep -v ^$ | grep -v '#'
    [main]
        logdir = /var/log/puppet
        rundir = /var/run/puppet
        ssldir = $vardir/ssl
        digest_algorithm = sha256
        disable_warnings = deprecations
    [agent]
        classfile = $vardir/classes.txt
        localconfig = $vardir/localconfig
    

    This does not work on a current RHEL 7.4 system with FIPS (FIPS-140-2) enabled and puppet 3.8.6, because even if "digest_algorithm = sha256" is set within the "[main]" section of puppet.conf, the puppet build/install/uninstall/upgrade actions currently require using an MD5 digest. Note that PUP-4963 "puppet module build" fails on FIPS-enabled system issue was resolved (on 2018-02-15) in Puppet 5.4.0+ by simply failing gracefully to not build or uninstall puppet modules when FIPS is enabled. The process to disable FIPS on RHEL6 or RHEL7 is quite involved.

    by

    points

    Responses

    Red Hat LinkedIn YouTube Facebook X, formerly Twitter

    Quick Links

    Help

    Site Info

    Related Sites

    © 2026 Red Hat