Feature #21756
closed
Update bind puppet module to use FIPS-approved hash function for dhcpd shared secret
Added by Anonymous over 6 years ago.
Updated over 6 years ago.
- Related to Feature #3511: As a security person, I would like Foreman to run in FIPS mode added
- Status changed from New to Need more information
I'd argue this is currently a CANTFIX. According to rdnc.conf (https://linux.die.net/man/5/rndc.conf):
The key statement begins with an identifying string, the name of the key. The statement has two clauses. algorithm identifies the encryption algorithm for rndc to use; currently only HMAC-MD5 is supported. This is followed by a secret clause which contains the base-64 encoding of the algorithm's encryption key. The base-64 string is enclosed in double quotes.
Oh, looks like you can also use dnssec-keygen rather than rndc-confgen so maybe it's possible.
- Status changed from Need more information to Ready For Testing
- Assignee set to Anonymous
- Pull request https://github.com/theforeman/puppet-dns/pull/103 added
Both bind and dhcpd use isc's implementations of crypto hash functions (including MD5) and appear to be unaffected by openssl operating in FIPS mode. I don't think any actions are required.
- Status changed from Ready For Testing to Resolved
- Status changed from Resolved to Rejected
Also available in: Atom
PDF
Updated by 
Updated by