0 Replies Latest reply: Mar 11, 2014 12:54 PM by 1122487 RSS

    openssh sshd core in FIPS mode using SSH V1

    1122487

      Hi,

       

      I was recently attempting to determine if sshd was running in FIPS mode by forcing it to use V1 SSH keys in OEL 6.5 with latest errata.  According to the source code , this should print out a message indicating that this is an invalid configuration due to FIPS being enabled.  Instead, sshd cores.

       

      # /usr/sbin/sshd -ddd -o "Protocol 1"

      debug2: load_server_config: filename /etc/ssh/sshd_config

      debug2: load_server_config: done config len = 583

      debug2: parse_server_config: config /etc/ssh/sshd_config len 583

      debug3: /etc/ssh/sshd_config:21 setting Protocol 2

      debug3: /etc/ssh/sshd_config:36 setting SyslogFacility AUTHPRIV

      debug3: /etc/ssh/sshd_config:42 setting PermitRootLogin yes

      debug3: /etc/ssh/sshd_config:66 setting PasswordAuthentication no

      debug3: /etc/ssh/sshd_config:70 setting ChallengeResponseAuthentication yes

      debug3: /etc/ssh/sshd_config:81 setting GSSAPIAuthentication yes

      debug3: /etc/ssh/sshd_config:83 setting GSSAPICleanupCredentials yes

      debug3: /etc/ssh/sshd_config:97 setting UsePAM yes

      debug3: /etc/ssh/sshd_config:100 setting AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES

      debug3: /etc/ssh/sshd_config:101 setting AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT

      debug3: /etc/ssh/sshd_config:102 setting AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE

      debug3: /etc/ssh/sshd_config:103 setting AcceptEnv XMODIFIERS

      debug3: /etc/ssh/sshd_config:109 setting X11Forwarding yes

      debug3: /etc/ssh/sshd_config:132 setting Subsystem sftp /usr/libexec/openssh/sftp-server

      debug1: sshd version OpenSSH_5.3p1

      md5_dgst.c(78): OpenSSL internal error, assertion failed: Digest MD5 forbidden in FIPS mode!

      Aborted (core dumped)

       

      Looking through the code, it appears that the following path is taken right before the check for FIPS + V1 mode:

           main() -> key_load_private() -> key_load_private_rsa1() -> cipher_set_key_string() -> MD5_Init()

       

      It looks like either cipher_set_key_string() should probably be checking FIPS_mode(), or the checks for FIPS + V1 mode should go before loading the private host keys and error gracefully.  Where should I report this?

       

      Thanks