Project

General

Profile

FIPS complient mode ruby md5 forbidden error

Added by Josh K about 10 years ago

I'm running RHEL 6.5 with redmine 2.5.1 installed. Whenever I boot without fips=1 on the kernel command line, Redmine loads through apache normally.

Whenever I boot with fips=1 in the kernel command line, I see this in the Apache error logs:
md5_dgst.c(78): OpenSSL internal error, assertion failed: Digest MD5 forbidden in FIPS mode! [Tue Jul 08 11:18:01 2014] [error] [client 192.168.101.100] Premature end of script headers: public [ pid=40839 thr=140105076352992 file=ext/apache2/Hooks.cpp:841 time=2014-07-08 11:18:01.382 ]: The backend application (process 41121) did not send a valid HTTP response; instead, it sent nothing at all. It is possible that it has crashed; please check whether there are crashing bugs in this application.

I see this in Redmine's production.log:
Started GET "/redmine" for 192.168.101.100 at Fri Jul 18 10:26:36 -0400 2014
Processing by WelcomeController#index as HTML
Current user: anonymous
Rendered welcome/index.html.erb within layouts/base (44.8ms)
Completed 200 OK in 438.8ms (Views: 189.7ms | ActiveRecord: 13.7ms)

So it looks as if the call is getting to redmine and it is responding, but the response never gets to Apache.

The condition is similar to this https://bugzilla.redhat.com/show_bug.cgi?id=1079042 In Puppet's 3.6.0 release logs I see a feature which provides a configurable hashing algorithm for FIPS compliance. Is there anything available in Redmine or some configuration settings that would allow calls to SHA1 instead of MD5?