Re: [HTCondor-users] condor and FIPS issue

[ade kc <kcbobo@xxxxxxxxxxx>]

The only thing vaguely interesting in the system log in an sshd error of the following nature.

Jul  6 14:45:36  sshd[14537]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key

In condor MasterLog, here's what the stack dump log looks like

Stack dump for process 14412 at timestamp 1467830633 (17 frames)
/usr/lib64/condor/libcondor_utils_8_2_9.so(dprintf_dump_stack+0x12d)[0x7f6970aad4dd]
/usr/lib64/condor/libcondor_utils_8_2_9.so(_Z18linux_sig_coredumpi+0x40)[0x7f6970c10a10]
/lib64/libpthread.so.0(+0xf710)[0x7f696c7c2710]
/lib64/libc.so.6(gsignal+0x35)[0x7f696c451625]
/lib64/libc.so.6(abort+0x175)[0x7f696c452e05]
/usr/lib64/libcrypto.so.10(+0x69f7f)[0x7f696dd3ef7f]
/usr/lib64/libcrypto.so.10(MD5_Init+0x49)[0x7f696dd456e9]
/usr/lib64/libcrypto.so.10(MD5+0x3a)[0x7f696dd45aba]
/usr/lib64/condor/libcondor_utils_8_2_9.so(_ZN6SecMan34CreateNonNegotiatedSecuritySessionE12DCpermissionPKcS2_S2_S2_S2_i+0x319)[0x7f6970b8bcd9]
/usr/lib64/condor/libcondor_utils_8_2_9.so(_ZN10DaemonCore14Create_ProcessEPKcRK7ArgList10priv_stateiiPK3EnvS1_P10FamilyInfoPP6StreamPiSE_iP10__sigset_tiPmSE_S1_P8MyStringP15FilesystemRemapl+0x1e08)[0x7f6970c00938]
/usr/sbin/condor_master(_ZN6daemon9RealStartEv+0x812)[0x40d1e2]
/usr/sbin/condor_master(_ZN7Daemons15StartDaemonHereEP6daemon+0x2e)[0x40d68e]
/usr/sbin/condor_master(_ZN7Daemons15StartAllDaemonsEv+0x67)[0x40d707]
/usr/sbin/condor_master(_Z9main_initiPPc+0x598)[0x4112e8]
/usr/lib64/condor/libcondor_utils_8_2_9.so(_Z7dc_mainiPPc+0x1790)[0x7f6970c12b90]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x7f696c43dd5d]
/usr/sbin/condor_master[0x408369]

Regarding the preliminary steps for FIPS and the prelink stuff you mentioned I have to ask the guy who installed it originally about what he did there.

There is no openssl-fips installed, only regular openssl.

Sure I plan to upgrade to 8.4 at some point, not sure that solves this immediate problem though. Also does one reap all the benefits of 8.4 if the condor central manager machine is also on 8.2?

Yes we test on various OS versions, this is RHEL6.6 because we have some customers using this, so need to test for their benefit also.

I will try your suggestion about with fips mode off to see if logging gives me anything useful.

---

From: HTCondor-users <htcondor-users-bounces@xxxxxxxxxxx> on behalf of Michael V Pelletier <Michael.V.Pelletier@xxxxxxxxxxxx>
Sent: Wednesday, July 6, 2016 1:05 PM
To: HTCondor-Users Mail List
Subject: Re: [HTCondor-users] condor and FIPS issue

 

From: ade kc <kcbobo@xxxxxxxxxxx>
Date: 07/06/2016 01:33 PM

> My team is currently doing some "FIPS" testing. king group to ...
>
> This effectively requires installation of the "dracut-fips" package. I
> installed condor 8.2.8 on an execute node and the condor_master daemon
> would immediately do a crash dump.
>
> I removed the "dracut-fips" package and all is well again with the world.
>
> This is a redhat 6.6 machine, seems there's a conflict between this
> package and condor. Anyone aware of this? I can try another condor version
> to see what happens, but wanted to check in here first.

Does anything show up in the system log about the HTCondor startup regarding
the FIPS status of the system? Perhaps the unprelink of the HTCondor
binaries wasn't successful or something like that, and maybe that would
be reflected in FIPS-related logging.

For instance, perhaps the prelink -u -a you ran before installing
dracut-fips overlooked the /usr/libexec/condor directory.

Also, do you have openssl-fips installed as well? That's going to be the
FIPS nexus for HTCondor, rather than Dracut. Maybe try running with
the FIPS mode turned off (fips=0 in the kernel args) and see if there's
any useful logging activity in "non-enforcing mode," as it were.

I'm surprised you've got RHEL 6.6 - the security standards I'm
conversant with require regular operating system security patches,
and there's been four moderate and two important kernel security errata
since the release of 6.7 about a year ago, among about 128 in total
over 6.6.

Also I highly recommend 8.4 over 8.2. The transition is easy as
long as you're mindful of the new packaging divisions (i.e., if you need
kbdd you have to install it separately, or install condor-all), and
there's a lot of good improvements. And thanks to the virtues of the
ClassAd system, 8.4 and 8.2 can coexist in the same pool, so an
incremental upgrade is feasible.

        -Michael Pelletier.
_