spacewalk-fips-tool

8

`spacewalk-fips-tool`

A tool to help in the process of converting certificates of registered systems from using MD5 digest to certificates with SHA-256 digest.

            spacewalk-fips-tool
            -i|-c
            -o output.csv
            options
            systemid01 systemid02 ...

## Description

spacewalk-fips-tool is a helper script aiming to help in the process of converting certificates of registered systems from using MD5 digest to SHA-256 digest.

Ordinarily, conversion of client certificates of your registered systems from MD5 digest to SHA-256 is not required.

Updating the digest of client certificates is needed if you plan to run your &RHNSAT; in FIPS mode, which does not allow MD5 algorithm for authentication.

Client certificate conversion is a two step process:

- 1. Installation of spacewalk-client-cert package on given client systems (-i command line option). This package implements client side logic (action) allowing to download and update client certificate.
- 2. Once spacewalk-client-cert packages are successfully installed on client systems, certificate update for the given systems can be scheduled (-c command line option).

Both the package installation and certificate update are client side actions, which will be picked up and executed by rhn_check utility on the specified systems.

The tool uses &RHNSAT; XML-RPC API to schedule both the package installations and certificate updates. Therefore, the tool requires user credentials able to perform both types of actions, ideally an organization administrator.

For tracking purposes, all successfully scheduled client side actions are recorded in a file in CSV format (-o command line option).

The tool requires several mandatory command line options to operate:

- * Action to schedule: installation (-i option) or certificate update (-c option).
- * Output CSV (-o option).
- * List of system identifiers to schedule the given action for.

List of systems currently using MD5 certificate can be easily obtained with spacewalk-report tool:

`$ spacewalk-report system-md5-certificates > systems-md5.csv`

## Options

-h, --help

- Display usage message and exit.

-i

- Schedule installation of spacewalk-client-cert package.

-c

- Schedule update of client certificates.

-o `output.csv`

- The output file in CSV format to record the details of scheduled actions in.

-u `username`

- User name to use for scheduling the actions. If not specified, will be prompted for.

-p `password`

- Password for the user name. If not specified, will be prompted for.

-s `hostname`

- Hostname of your &RHNSAT;, local hostname by default.

-d `date`

- Date in %Y-%m-%d %H-%M-%S format (e.g. 2014-10-30 19:35:00) to schedule the given actions for. Defaults to "now".

## Files

- /etc/sysconfig/rhn/systemid - client side certificate

## See Also

- spacewalk-report(8)
- rhn_check(8)

## Authors

- Milan Zazrivec mzazrivec@redhat.com