Re: [HTCondor-users] - Re: Condor_master aborting because of FIPS mode

[Michael Pelletier <michael.v.pelletier@xxxxxxxxxxxx>]

With kernel FIPS enforcement on, the MD5 hash used in HTCondor network packets is not permitted.

A FIPS-enabled release of HTCondor is available, which replaces the message integrity hash with SHA1 rather than MD5. Since the hash size changed, the protocol is not compatible with the non-FIPS protocol, so a pool needs to be either all FIPS or all non-FIPS. The two releases cannot communicate with each other. You also need to remove the BLOWFISH algorithm from the SEC_DEFAULT_CRYPTO_METHODS list - set it to only use 3DES.

The YUM repo for the FIPS release is here: https://research.cs.wisc.edu/htcondor/yum/fips/


Michael V Pelletier
Principal Engineer

Raytheon Technologies
Information Technology
Digital Transormation & Innovation