Ubuntu
ubuntu-advantage-tools package

enable-fips doesn't work on bionic

Bug #1911228 reported by Chris Johnston
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
ubuntu-advantage-script
Fix Released
Unknown
ubuntu-advantage-tools (Ubuntu)
Fix Released
High
Unassigned
Xenial
Fix Released
Undecided
Unassigned
Bionic
Fix Released
Undecided
Unassigned

Bug Description

$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.5 LTS"

$ sudo ua enable-fips TOKEN Sorry, but Canonical FIPS 140-2 Modules is not supported on bionic
$ sudo ua enable-fips-updates TOKEN Sorry, but Canonical FIPS 140-2 Modules is not supported on bionic

FIPS is supported on bionic now. Either the client should be able to enable it, or the tool should state that it isn't able to and point people to the correct instructions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ubuntu-advantage-tools (Ubuntu):
status: New → Confirmed
Revision history for this message
Adam Bell (arbell) wrote :

For reference, the correct instructions are at https://security-certs.docs.ubuntu.com/en/fips#manual-installation

Bug Watch Updater (bug-watch-updater)
Changed in ubuntu-advantage-script:
status: Unknown → New
Revision history for this message
Steven Parker (sbparke) wrote :

I'm escalating this to field high as this is impacting deployment on 4 customer clouds.
We can do this manually but it is a much more involved process and with the large number of nodes we need to deploy this will be prone to error and risk.

It is my understanding that FIPS for bionic is through the NIST certification process, but in addition to this we simply want to work on the compliant track which does not need this certification anyway.

Revision history for this message
Steven Parker (sbparke) wrote :

Sorry for the resubmit but wanted to get this to the field-high users...

I'm escalating this to field high as this is impacting deployment on 4 customer clouds.
We can do this manually but it is a much more involved process and with the large number of nodes we need to deploy this will be prone to error and risk.

It is my understanding that FIPS for bionic is through the NIST certification process, but in addition to this we simply want to work on the compliant track which does not need this certification anyway.

Revision history for this message
Richard Harding (rharding) wrote :

Thanks for poking at the packaging bug. We've got a tracking bug on the upstream source here:

https://github.com/canonical/ubuntu-advantage-client/issues/1300

We release a beta of the v26 client to the staging PPA yesterday:
https://launchpad.net/~ua-client/+archive/ubuntu/staging

This v26 enables FIPS support for users in the ua client. I've tested it on bionic.

Once we complete the beta testing of the various features in the v26 we'll release it to the stable PPA here:

https://launchpad.net/~ua-client/+archive/ubuntu/stable

Using this PPA will be upgradable when the ua client is SRU'd fully into xenial and bionic at some point in the future.

Changed in ubuntu-advantage-tools (Ubuntu):
status: Confirmed → Fix Committed
importance: Undecided → High
Revision history for this message
Steven Parker (sbparke) wrote :

Having some trouble adding this repository.

sudo add-apt-repository -m ppa:ua-client/staging

Cannot add PPA: 'ppa:~ua-client/ubuntu/staging'.
ERROR: '~ua-client' user or team does not exist.

---

We can curl the address so it does not seem like a proxy issue.

curl http://ppa.launchpad.net/ua-client/staging/ubuntu/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
 <head>
  <title>Index of /ua-client/staging/ubuntu</title>
 </head>
 <body>
<h1>Index of /ua-client/staging/ubuntu</h1>
  <table>
   <tr><th valign="top"><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Description</a></th></tr>
   <tr><th colspan="5"><hr></th></tr>
<tr><td valign="top"><img src="/icons/back.gif" alt="[PARENTDIR]"></td><td><a href="/ua-client/staging/">Parent Directory</a></td><td>&nbsp;</td><td align="right"> - </td><td>&nbsp;</td></tr>
<tr><td valign="top"><img src="/icons/folder.gif" alt="[DIR]"></td><td><a href="dists/">dists/</a></td><td align="right">2020-12-07 20:33 </td><td align="right"> - </td><td>&nbsp;</td></tr>
<tr><td valign="top"><img src="/icons/folder.gif" alt="[DIR]"></td><td><a href="pool/">pool/</a></td><td align="right">2020-10-26 19:09 </td><td align="right"> - </td><td>&nbsp;</td></tr>
   <tr><th colspan="5"><hr></th></tr>
</table>
<address>Apache/2.4.18 (Ubuntu) Server at ppa.launchpad.net Port 80</address>
</body></html>

Any guidance would be appreciated,

Thanks,
  Steven

Revision history for this message
Steven Parker (sbparke) wrote :

Ok that looks like a client environment problem. Never mind.

Steven

Bug Watch Updater (bug-watch-updater)
Changed in ubuntu-advantage-script:
status: New → Fix Released
Revision history for this message
Chad Smith (chad.smith) wrote :

This was fully resolved by an official SRU of the new ubuntu-advantage-tools version 27.0 to Xenial and Bionic on 2021-04-29.

The new UA client requires obtaining a contract token from https://ubuntu.com/advantage and using that global contract token on the commandline

   sudo ua attach <contract_token>
   # to enable fips if not auto-enabled by your contract
   sudo ua enable fips

The security documentation referenced has been updated since the SRU to reflect these steps if needed.
https://security-certs.docs.ubuntu.com/en/fips#manual-installation

Changed in ubuntu-advantage-tools (Ubuntu Xenial):
status: New → Fix Released
Changed in ubuntu-advantage-tools (Ubuntu Bionic):
status: New → Fix Released
Chad Smith (chad.smith)
Changed in ubuntu-advantage-tools (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.