Project

Profile

Help

Task #3650

closed

Story #3637: As a user, I can run pulp in a FIPS-enabled environment

Create a FIPS-enabled devel environment

Added by daviddavis over 6 years ago. Updated over 5 years ago.

Status:
CLOSED - COMPLETE
Priority:
Normal
Assignee:
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Platform Release:
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Sprint 36
Quarter:
Actions #1

Updated by daviddavis over 6 years ago

  • Sprint set to Sprint 36
Actions #2

Updated by daviddavis over 6 years ago

I found some FIPS-enabled boxes for Vagrant[0] but they only support VirtualBox. I think we'll have to roll our own libvirt FIPS boxes.

[0] https://app.vagrantup.com/boxes/search?utf8=%E2%9C%93&sort=downloads&provider=&q=fips

Actions #3

Updated by daviddavis over 6 years ago

Instructions to enable FIPS are here:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations

It basically requires setting a kernel parameter.

Actions #4

Updated by daviddavis over 6 years ago

dalley, good find. I pinged ehelms because Katello supports multiple OSes for the dev environment. He recommended either using the generic Ansible package module[0] or add checks to see what family of OS you're on.

[0] I think it's this http://docs.ansible.com/ansible/latest/modules/package_module.html

Actions #5

Updated by dalley over 6 years ago

  • Status changed from NEW to ASSIGNED
  • Assignee set to dalley

I got it working (the development environment, not Pulp)

Use this branch: https://github.com/pulp/devel/tree/fips

I grafted the FIPS enablement steps from katello/forklift. During the FIPS enablement process the VM restarts, and when it comes back up Vagrant doesn't re-mount the shared folders (which, the ansible scripts need in order to create the editable installs.

So, the one little pinprick when using this environment is that you need to keep an eye on the ansible progress, and once it finishes rebooting for FIPS enablement and begins the normal Pulp provisioning steps, in another terminal you need to run the command "vagrant sshfs --mount".

That will re-mount the shared folders if you are using SSHFS. I don't use NFS anymore so I don't know the process, there.

Near the end of provisioning, it does throw some FIPS related errors, but that is where our real work will need to begin and not part of this task


 pulp2_dev: creating link: /etc/yum/pluginconf.d/pulp-profile-update.conf pointing to /home/vagrant/devel/pulp_rpm/handlers/etc/yum/pluginconf.d/pulp-profile-update.conf
    pulp2_dev: creating link: /usr/share/pulp-rpm pointing to /home/vagrant/devel/pulp_rpm/plugins/usr/share/pulp-rpm
    pulp2_dev: creating link: /usr/lib/yum-plugins/pulp-profile-update.py pointing to /home/vagrant/devel/pulp_rpm/handlers/usr/lib/yum-plugins/pulp-profile-update.py
    pulp2_dev: ~/devel ~
    pulp2_dev: Adjusting facls for apache
    pulp2_dev: Starting more services
    pulp2_dev: Created symlink from /etc/systemd/system/multi-user.target.wants/goferd.service to /usr/lib/systemd/system/goferd.service.
    pulp2_dev: Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
    pulp2_dev: Failed to execute operation: Too many levels of symbolic links
    pulp2_dev: Failed to execute operation: Too many levels of symbolic links
    pulp2_dev: Failed to execute operation: Too many levels of symbolic links
    pulp2_dev: Traceback (most recent call last):
    pulp2_dev:   File "/bin/pulp-manage-db", line 9, in <module>
    pulp2_dev:     load_entry_point('pulp-server==2.17a1', 'console_scripts', 'pulp-manage-db')()
    pulp2_dev:   File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 378, in load_entry_point
    pulp2_dev:     return get_distribution(dist).load_entry_point(group, name)
    pulp2_dev:   File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 2566, in load_entry_point
    pulp2_dev:     return ep.load()
    pulp2_dev:   File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 2260, in load
    pulp2_dev:     entry = __import__(self.module_name, globals(),globals(), ['__name__'])
    pulp2_dev:   File "/home/vagrant/devel/pulp/server/pulp/server/db/manage.py", line 14, in <module>
    pulp2_dev:     from pulp.plugins.loader.api import load_content_types
    pulp2_dev:   File "/home/vagrant/devel/pulp/server/pulp/plugins/loader/api.py", line 7, in <module>
    pulp2_dev:     from pulp.plugins.loader.manager import PluginManager
    pulp2_dev:   File "/home/vagrant/devel/pulp/server/pulp/plugins/loader/manager.py", line 9, in <module>
    pulp2_dev:     from pulp.server.db.model import ContentUnit
    pulp2_dev:   File "/home/vagrant/devel/pulp/server/pulp/server/db/model/__init__.py", line 13, in <module>
    pulp2_dev:     from mongoengine import (BooleanField, DictField, Document, DynamicField, IntField,
    pulp2_dev:   File "/usr/lib/python2.7/site-packages/mongoengine/__init__.py", line 1, in <module>
    pulp2_dev:     import document
    pulp2_dev:   File "/usr/lib/python2.7/site-packages/mongoengine/document.py", line 2, in <module>
    pulp2_dev:     import pymongo
    pulp2_dev:   File "/usr/lib64/python2.7/site-packages/pymongo/__init__.py", line 83, in <module>
    pulp2_dev:     from pymongo.collection import ReturnDocument
    pulp2_dev:   File "/usr/lib64/python2.7/site-packages/pymongo/collection.py", line 21, in <module>
    pulp2_dev:     from bson.code import Code
    pulp2_dev:   File "/usr/lib64/python2.7/site-packages/bson/__init__.py", line 43, in <module>
    pulp2_dev:     from bson.objectid import ObjectId
    pulp2_dev:   File "/usr/lib64/python2.7/site-packages/bson/objectid.py", line 55, in <module>
    pulp2_dev:     class ObjectId(object):
    pulp2_dev:   File "/usr/lib64/python2.7/site-packages/bson/objectid.py", line 62, in ObjectId
    pulp2_dev:     _machine_bytes = _machine_bytes()
    pulp2_dev:   File "/usr/lib64/python2.7/site-packages/bson/objectid.py", line 38, in _machine_bytes
    pulp2_dev:     machine_hash = hashlib.md5()
    pulp2_dev: ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
    pulp2_dev: There was an internal server error while trying to access the Pulp application.
    pulp2_dev: One possible cause is that the database needs to be migrated to the latest
    pulp2_dev: version. If this is the case, run pulp-manage-db and restart the services. More
    pulp2_dev: information may be found in Apache's log.
Actions #6

Updated by rchan over 6 years ago

  • Sprint changed from Sprint 36 to Sprint 37
Actions #7

Updated by dalley over 6 years ago

  • Status changed from ASSIGNED to CLOSED - COMPLETE
Actions #8

Updated by rchan over 6 years ago

  • Sprint changed from Sprint 37 to Sprint 36

Moving back to Sprint 36 since this got finished.

Actions #9

Updated by bmbouter over 5 years ago

  • Tags Pulp 2 added

Also available in: Atom PDF