** Description changed:
+ [ Impact ]
+
+ Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default
+ the DSA key, disallowed in FIPS. This makes regression testing fail.
+
+ [ Test Plan ]
+
+ Test on both Focal and Bionic the results of the ubuntu_kvm_smoke_test
+ from autotest and observe the DSA key is discarded, but the RSA or
+ ellyptic curve key is used for the VM key.
+
+ [ Where problem could occur ]
+
+ No impact is expected, as the fix only increases the number of
+ algorithms to be used before failing.
+
+ [ Original report ]
+
After enabling the fips-dev ppa and using user-space tool there. The
ubuntu_kvm_smoke_test starts failing with:
- + uvt-kvm create bjf-test release=bionic arch=s390x
- DSA keys are not allowed in FIPS mode
+ + uvt-kvm create bjf-test release=bionic arch=s390x
+ DSA keys are not allowed in FIPS mode
Take a closer look inside /usr/lib/python2.7/dist-
packages/uvtool/libvirt/kvm.py, which calls
uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist-
packages/uvtool/ssh.py
From ssh.py, you will find it will try to generate 4 different key
types, includes "dsa":
KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519']
...
def generate_ssh_host_keys():
- cloud_init_result = {}
- known_hosts_result = []
- tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp')
- try:
- for key_type in KEY_TYPES:
- private_path = os.path.join(tmp_dir, key_type)
- _keygen(key_type, private_path)
+ cloud_init_result = {}
+ known_hosts_result = []
+ tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp')
+ try:
+ for key_type in KEY_TYPES:
+ private_path = os.path.join(tmp_dir, key_type)
+ _keygen(key_type, private_path)
** Description changed:
[ Impact ]
Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default
the DSA key, disallowed in FIPS. This makes regression testing fail.
[ Test Plan ]
Test on both Focal and Bionic the results of the ubuntu_kvm_smoke_test
from autotest and observe the DSA key is discarded, but the RSA or
ellyptic curve key is used for the VM key.
+
+ [ Fix ]
+
+ The fix consists in backporting the commit
+
https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd
+ already present in newer packages. The fix has been already approved in the
past in this merge request
+ https://code.launchpad.net/~paelzer/uvtool/+git/uvtool/+merge/405796
[ Where problem could occur ]
No impact is expected, as the fix only increases the number of
algorithms to be used before failing.
[ Original report ]
After enabling the fips-dev ppa and using user-space tool there. The
ubuntu_kvm_smoke_test starts failing with:
+ uvt-kvm create bjf-test release=bionic arch=s390x
DSA keys are not allowed in FIPS mode
Take a closer look inside /usr/lib/python2.7/dist-
packages/uvtool/libvirt/kvm.py, which calls
uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist-
packages/uvtool/ssh.py
From ssh.py, you will find it will try to generate 4 different key
types, includes "dsa":
KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519']
...
def generate_ssh_host_keys():
cloud_init_result = {}
known_hosts_result = []
tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp')
try:
for key_type in KEY_TYPES:
private_path = os.path.join(tmp_dir, key_type)
_keygen(key_type, private_path)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2057867
Title:
ubuntu_kvm_smoke_test fail with FIPS kernel (dsa keys not allowed)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2057867/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
