Skip to content
This repository has been archived by the owner on Dec 7, 2023. It is now read-only.

Changing the ssh key gen algorithm for FIPS machines #136

Merged
merged 2 commits into from
Jul 12, 2019
Merged

Changing the ssh key gen algorithm for FIPS machines #136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8bdfde3
Changing the ssh key gen algorithm for FIPS machines
Jul 11, 2019
8f0af24
moved the fips check to util
Jul 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions pkg/metadata/vmmd/vm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,9 +193,13 @@ func (md *VM) ClearIPAddresses() {
// Generate a new SSH keypair for the vm
func (md *VM) newSSHKeypair() (string, error) {
privKeyPath := path.Join(md.ObjectPath(), fmt.Sprintf(constants.VM_SSH_KEY_TEMPLATE, md.GetUID()))

// Use ED25519 instead of RSA for performance (it's equally secure, but a lot faster to generate/authenticate)
_, err := util.ExecuteCommand("ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", privKeyPath)
// TODO: In future versions, let the user specify what key algorithm to use through the API types
ssh_key_algorithm := "ed25519"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a note here like this:

// TODO: In future versions, let the user specify what key algorithm to use through the API types

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

if util.FIPSEnabled() {
// Use rsa on FIPS machines
ssh_key_algorithm = "rsa"
}
_, err := util.ExecuteCommand("ssh-keygen", "-q", "-t", ssh_key_algorithm, "-N", "", "-f", privKeyPath)
if err != nil {
return "", err
}
Expand Down
18 changes: 18 additions & 0 deletions pkg/util/fips.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
package util

import (
"os"
)

// FIPSEnabled returns true if running in FIPS mode.
// currently it just checks the system wide /etc/system-fips file present or not.
// TODO - Find a better generic solution for this.
func FIPSEnabled() bool {
fips_file := "/etc/system-fips"
if _, err := os.Stat(fips_file); err != nil {
if os.IsNotExist(err) {
return false
}
}
return true
}