Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-07 Thread Doug Hellmann
Joshua Cornutt writes: > On Wed, Nov 7, 2018 at 7:30 AM Doug Hellmann wrote: >> >> Joshua Cornutt writes: >> >> > Doug, >> > >> > I have such a list put together (my various installation documents for >> > getting these clouds working in FIPS mode) but it's hardly ready for >> > public

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-07 Thread Joshua Cornutt
On Wed, Nov 7, 2018 at 7:30 AM Doug Hellmann wrote: > > Joshua Cornutt writes: > > > Doug, > > > > I have such a list put together (my various installation documents for > > getting these clouds working in FIPS mode) but it's hardly ready for > > public consumption. I planned on releasing each

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-07 Thread Doug Hellmann
Joshua Cornutt writes: > Doug, > > I have such a list put together (my various installation documents for > getting these clouds working in FIPS mode) but it's hardly ready for > public consumption. I planned on releasing each bit as a code change > and/or bug ticket and letting the community

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-06 Thread Joshua Cornutt
The downside of this particular approach is that systems that get promoted to "FIPS mode" will get into a sticky situation as the code originally set hashes to use MD5 but then switches to SHA-x after users may have already used MD5 (and thus have that data stored / recalled). The best way really

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-06 Thread Julia Kreger
On Tue, Nov 6, 2018 at 9:19 AM Joshua Cornutt wrote: > > Another approach would be to make the projects "FIPS aware" where we > choose the hashing algorithm based on the system's FIPS-enforcing > state. An example of doing so is what I'm proposing for Django > (another FIPS-related patch that

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-06 Thread Joshua Cornutt
Doug, I have such a list put together (my various installation documents for getting these clouds working in FIPS mode) but it's hardly ready for public consumption. I planned on releasing each bit as a code change and/or bug ticket and letting the community consume it as it figures some of these

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-06 Thread Doug Hellmann
Luke Hinds writes: > On Tue, Nov 6, 2018 at 2:04 PM Julia Kreger > wrote: > >> >> >> On Tue, Nov 6, 2018 at 5:07 AM Doug Hellmann >> wrote: >> >>> Sean McGinnis writes: >>> >>> > I'm interested in some feedback from the community, particularly those >>> running >>> > OpenStack deployments, as

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-06 Thread Luke Hinds
On Tue, Nov 6, 2018 at 2:04 PM Julia Kreger wrote: > > > On Tue, Nov 6, 2018 at 5:07 AM Doug Hellmann > wrote: > >> Sean McGinnis writes: >> >> > I'm interested in some feedback from the community, particularly those >> running >> > OpenStack deployments, as to whether FIPS compliance [0][1]

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-06 Thread Julia Kreger
On Tue, Nov 6, 2018 at 5:07 AM Doug Hellmann wrote: > Sean McGinnis writes: > > > I'm interested in some feedback from the community, particularly those > running > > OpenStack deployments, as to whether FIPS compliance [0][1] is something > folks > > are looking for. > [trim] > > I know we've

Re: [openstack-dev] [Openstack-operators] FIPS Compliance

2018-11-06 Thread Doug Hellmann
Sean McGinnis writes: > I'm interested in some feedback from the community, particularly those running > OpenStack deployments, as to whether FIPS compliance [0][1] is something folks > are looking for. > > I've been seeing small changes starting to be proposed here and there for > things like