389-ds-base

#50100 Ticket 50099 - In FIPS mode, the server can select an unsupported password storage scheme
Closed by spichugi. Opened by tbordaz.
tbordaz/389-ds-base ticket_50099  into  master

Download 50100.patch

Bug Description:
When running in FIPS mode, DS selects SSHA512 as password storage schema else it selects PBKDF2_SHA256.
The problem is that in FIPS mode it selects PBKDF2_SHA256 that is currently not supported by NSS.
So DS fails to hash password
The scheme selection is done in the early phase of DS startup (slapd_bootstrap_config).
To determine it is in FIPS mode, DS calls PK11_IsFIPS that requires that NSS has been initialized.
The problem is that during slapd_bootstrap_config, NSS is not yet initialized and PK11_IsFIPS returns
PR_FALSE even in FIPS mode

Fix Description:
The fix consists to check if NSS is initialized. If it is initialize, then rely on PK11_IsFIPS.
If it is not initialized then retrieve the FIPS mode from the system, assuming that if system
is in FIPS mode, then NSS will be in FIPS mode as well

https://pagure.io/389-ds-base/issue/50099

Reviewed by: ?

Platforms tested:

Flag Day: no

Doc impact: no

Can you change this:
slapi_log_err(SLAPI_LOG_INFO, "slapd_system_isFIPS", "system in FIPS mode\n");

rebased onto c393b284a79d0a003eb4a8a992d006ad48f76bd2

ack

rebased onto 76847e82a4f70af90b88f2bf5023e8e70be178b4

Pull-Request has been merged by tbordaz

sorry I am late with my comment, but I have a question.

In slapd_system_isFIPS() you have a sequence of access,open, read checks on FIPS_ENABLED and if any fails returns false. But if eg access and open succeeds and read fails, does this indicate false or an incorrect fips configuration or another problem ?

If it fails to read it is certainly an indication of an other problem external to DS. Except logging the failure I do not know if we can do more (like testing in an other way if we are in FIPS or not).

I had the impression that in the case we are in a third mode, "PR_UNDEFINED" and unsure if it makes sense to continue at all

offline discussions. It is enough to change the error messages. In case of failure (access/open/read) DS logs it assumes the system is not in FIPS mode

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3159

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.