(PUP-3114) Added an enforcement for FIPS

FIPS mode requires that the keylength be restricted to 2048 bits instead
of the new standard 4096.

This patch provides that proper enforcement.
The issue here is that Puppet will fail with a mysterious error (which I
can't remember off the top of my head) if FIPS is enabled.

Without the keylength downgraded Puppet *will not* generate certs on a FIPS
enabled system.

I would rather have a working system out of the box.


On Wed, Sep 3, 2014 at 2:12 PM, Josh Cooper <notifications@github.com>
wrote:

> In lib/puppet/ssl/key.rb:
>
> > @@ -22,7 +22,14 @@ def self.supported_formats
> >    # Knows how to create keys with our system defaults.
> >    def generate
> >      Puppet.info "Creating a new SSL key for #{name}"
> > -    @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
> > +    keylength = Puppet[:keylength].to_i
> > +    if Facter.value('fips_enabled') == 'true'
> > +      if keylength > 2048
> > +        Puppet.info "Forcing keylength to 2048 due to FIPS being enabled."
> > +        keylength = 2048
> > +      end
> > +    end
> > +    @content = OpenSSL::PKey::RSA.new(keylength)
>
> I don't think we want to automatically downgrade keylengths based on a
> fact value. Can't this be accomplished by setting the keylength property?
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/puppetlabs/puppet/pull/3044/files#r17068585>.
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information --