Jeffrey van Pelt wrote:
>
> On Mon, Oct 18, 2021 at 12:49:35PM -0400, Rob Crittenden wrote:
>> Jeffrey van Pelt via FreeIPA-users wrote:
>>> Hi all,
>>>
>>> Currently I'm setting up a FreeIPA instance on EL8 with the
>>> crypto-policy set to FUTURE.
>>>
>>> When running the ipa-server-install program, it errors out when setting
>>> up the PKI infrastructure.
>>>
>>> Below is the command I ran:
>>>
>>> ```
>>> ipa-server-install --pki-config-override /root/freeipa_pki_override.cfg
>>> --setup-adtrust -p Banana123! -a Banana123! -r
EXAMPLE.COM -U
>>> ```
>>>
>>> As this command already shows, I already have some PKI override settings
>>> to ensure all created keys are 4096 bits long:
>>>
>>> ```
>>> [CA]
>>> pki_ca_signing_key_size=4096
>>> [DEFAULT]
>>> pki_admin_key_size=4096
>>> pki_audit_signing_key_size=4096
>>> pki_sslserver_key_size=4096
>>> pki_subsystem_key_size=4096
>>> ```
>>>
>>> And even despite these settings, the command errors out giving me the
>>> message as below:
>>>
>>> ```
>>> ..truncated..
>>> [22/28]: enabling CA instance
>>> [23/28]: migrating certificate profiles to LDAP
>>> [24/28]: importing IPA certificate profiles
>>> [error] NetworkError: cannot connect to
'https://ipa.lbhr.htm.lan:8443/ca/rest/account/login': [SSL: EE_KEY_TOO_SMALL] ee
key too small (_ssl.c:3542)
>>> cannot connect to
'https://ipa.lbhr.htm.lan:8443/ca/rest/account/login': [SSL: EE_KEY_TOO_SMALL] ee
key too small (_ssl.c:3542)
>>> The ipa-server-install command failed. See /var/log/ipaserver-install.log
for more information
>>> ```
>>>
>>> So _some_ certificate _somewhere_ is not strong enough, but I can't
find
>>> which one it is and how to ensure it's strengthened sufficiently.
>>>
>>> When I check the log file it shows basically the same message (except
>>> with a lot of Python stacktraces with 'NetworkError')
>>>
>>> When I revert the crypto-policy back to DEFAULT the command as shown
>>> above will succeed.
>>>
>>> Anyone have a clue? :)
>>>
>>
>> The RA agent certificate used by IPA is requested from certmonger
>> without specifying key size so it defaults to 2048 (hardcoded).
>>
>> I added a setting in upstream certmonger to be able to modify this
>> default but it is not released yet.
>>
>> On the IPA side, ipalib/install/certmonger.py::request_cert needs to be
>> able to take a key size argument and pass in KEY_SIZE in the certmonger
>> request. How that would tie into the rest of IPA is TBD as some default
>> would need to be set somewhere.
>>
>> What problem are you trying to solve using FUTURE policy? 4k keys are
>> going to be quite slow.
>>
>> rob
>>
>
> Gotcha, is there any way I can add in that patch now?
>
> I need to build an infrastructure based on EL8 which must be
> CIS-compliant. In the most recent version of the requirements they state
> the following:
>
> - 1.10 Ensure system-wide crypto policy is not legacy (Scored)
> - 1.11 Ensure system-wide crypto policy is FUTURE or FIPS (Scored)
>
> We opted for FUTURE in our environment, but enabling this breaks the
> setup :-)
>
> (full document:
https://paper.bobylive.com/Security/CIS/CIS_Red_Hat_Enterprise_Linux_8_Be...)
I'd suggest using FIPS for a more supported installation.
rob