|
 |
561fa3 |
From 3a1439a74eb64b3473cb5ce84914cdd533563573 Mon Sep 17 00:00:00 2001
|
|
|
561fa3 |
From: Tomas Jelinek <tojeline@redhat.com>
|
|
|
561fa3 |
Date: Tue, 13 Aug 2019 10:06:29 +0200
|
|
|
561fa3 |
Subject: [PATCH] set authkey length to 256 bytes
|
|
|
561fa3 |
|
|
|
561fa3 |
---
|
|
|
561fa3 |
pcs/lib/commands/test/remote_node/test_node_add_guest.py | 4 ++--
|
|
|
561fa3 |
pcs/lib/commands/test/remote_node/test_node_add_remote.py | 4 ++--
|
|
|
561fa3 |
pcs/settings_default.py | 7 +++++--
|
|
|
561fa3 |
3 files changed, 9 insertions(+), 6 deletions(-)
|
|
|
561fa3 |
|
|
|
561fa3 |
diff --git a/pcs/lib/commands/test/remote_node/test_node_add_guest.py b/pcs/lib/commands/test/remote_node/test_node_add_guest.py
|
|
|
561fa3 |
index cb385150..d013b255 100644
|
|
|
561fa3 |
--- a/pcs/lib/commands/test/remote_node/test_node_add_guest.py
|
|
|
561fa3 |
+++ b/pcs/lib/commands/test/remote_node/test_node_add_guest.py
|
|
|
561fa3 |
@@ -154,7 +154,7 @@ class AddGuest(TestCase):
|
|
|
561fa3 |
.local.push_cib()
|
|
|
561fa3 |
)
|
|
|
561fa3 |
node_add_guest(self.env_assist.get_env())
|
|
|
561fa3 |
- generate_binary_key.assert_called_once_with(random_bytes_count=384)
|
|
|
561fa3 |
+ generate_binary_key.assert_called_once_with(random_bytes_count=256)
|
|
|
561fa3 |
self.env_assist.assert_reports(
|
|
|
561fa3 |
REPORTS
|
|
|
561fa3 |
.adapt(
|
|
|
561fa3 |
@@ -523,7 +523,7 @@ class AddGuest(TestCase):
|
|
|
561fa3 |
.local.push_cib()
|
|
|
561fa3 |
)
|
|
|
561fa3 |
node_add_guest(self.env_assist.get_env(), skip_offline_nodes=True)
|
|
|
561fa3 |
- generate_binary_key.assert_called_once_with(random_bytes_count=384)
|
|
|
561fa3 |
+ generate_binary_key.assert_called_once_with(random_bytes_count=256)
|
|
|
561fa3 |
self.env_assist.assert_reports(
|
|
|
561fa3 |
fixture_reports_new_node_unreachable(NODE_NAME)
|
|
|
561fa3 |
+ [
|
|
|
561fa3 |
diff --git a/pcs/lib/commands/test/remote_node/test_node_add_remote.py b/pcs/lib/commands/test/remote_node/test_node_add_remote.py
|
|
|
561fa3 |
index 46f82587..b0b3d6d3 100644
|
|
|
561fa3 |
--- a/pcs/lib/commands/test/remote_node/test_node_add_remote.py
|
|
|
561fa3 |
+++ b/pcs/lib/commands/test/remote_node/test_node_add_remote.py
|
|
|
561fa3 |
@@ -212,7 +212,7 @@ class AddRemote(TestCase):
|
|
|
561fa3 |
.env.push_cib(resources=FIXTURE_RESOURCES)
|
|
|
561fa3 |
)
|
|
|
561fa3 |
node_add_remote(self.env_assist.get_env())
|
|
|
561fa3 |
- generate_binary_key.assert_called_once_with(random_bytes_count=384)
|
|
|
561fa3 |
+ generate_binary_key.assert_called_once_with(random_bytes_count=256)
|
|
|
561fa3 |
self.env_assist.assert_reports(
|
|
|
561fa3 |
REPORTS
|
|
|
561fa3 |
.adapt(
|
|
|
561fa3 |
@@ -507,7 +507,7 @@ class AddRemote(TestCase):
|
|
|
561fa3 |
.env.push_cib(resources=FIXTURE_RESOURCES)
|
|
|
561fa3 |
)
|
|
|
561fa3 |
node_add_remote(self.env_assist.get_env(), skip_offline_nodes=True)
|
|
|
561fa3 |
- generate_binary_key.assert_called_once_with(random_bytes_count=384)
|
|
|
561fa3 |
+ generate_binary_key.assert_called_once_with(random_bytes_count=256)
|
|
|
561fa3 |
self.env_assist.assert_reports(
|
|
|
561fa3 |
fixture_reports_new_node_unreachable(NODE_NAME)
|
|
|
561fa3 |
+ [
|
|
|
561fa3 |
diff --git a/pcs/settings_default.py b/pcs/settings_default.py
|
|
|
561fa3 |
index e3a55b58..0d025b85 100644
|
|
|
561fa3 |
--- a/pcs/settings_default.py
|
|
|
561fa3 |
+++ b/pcs/settings_default.py
|
|
|
561fa3 |
@@ -21,11 +21,14 @@ corosync_qdevice_net_client_certs_dir = os.path.join(
|
|
|
561fa3 |
)
|
|
|
561fa3 |
corosync_qdevice_net_client_ca_file_name = "qnetd-cacert.crt"
|
|
|
561fa3 |
corosync_authkey_file = os.path.join(corosync_conf_dir, "authkey")
|
|
|
561fa3 |
-corosync_authkey_bytes = 384
|
|
|
561fa3 |
+# Must be set to 256 for corosync to work in FIPS environment.
|
|
|
561fa3 |
+corosync_authkey_bytes = 256
|
|
|
561fa3 |
corosync_log_file = "/var/log/cluster/corosync.log"
|
|
|
561fa3 |
pacemaker_authkey_file = "/etc/pacemaker/authkey"
|
|
|
561fa3 |
-pacemaker_authkey_bytes = 384
|
|
|
561fa3 |
+# Using the same value as for corosync. Higher values MAY work in FIPS.
|
|
|
561fa3 |
+pacemaker_authkey_bytes = 256
|
|
|
561fa3 |
booth_authkey_file_mode = 0o600
|
|
|
561fa3 |
+# Booth does not support keys longer than 64 bytes.
|
|
|
561fa3 |
booth_authkey_bytes = 64
|
|
|
561fa3 |
cluster_conf_file = "/etc/cluster/cluster.conf"
|
|
|
561fa3 |
fence_agent_binaries = "/usr/sbin/"
|
|
|
561fa3 |
--
|
|
|
561fa3 |
2.21.0
|
|
|
561fa3 |
|