Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of trawick@gmail.com designates
 74.125.83.45 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=QXnBd1Avi73cDKQz3/0LN7ku8EU71i/5Py2UjxWap5ZlTntS3VOI6pMgTtR9greGMY
         QDDGRrbi5o+lDe1YHNvoKIsrJTMrmYEobGAC0tmc2EeBU/4tTEUw3y7wOMJmwj1oCL5g
         yWIqiZYAOtvs1JmJPD6Zbdh1D+mGJljaPjf4w=
MIME-Version: 1.0
In-Reply-To: <1a658ba.4c7e00fc38006e7e298da4cb7136e1e5@webmail.lomag.net>
References: <1a658ba.4c7e00fc38006e7e298da4cb7136e1e5@webmail.lomag.net>
Date: Fri, 6 Aug 2010 11:17:38 -0400
Message-ID: <AANLkTim=oqQtebO76iDZauCRCiH0WfdgZ3-XpJ1itOHo@mail.gmail.com>
From: Jeff Trawick <trawick@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [users@httpd] Apache 2.2.16

On Fri, Aug 6, 2010 at 10:57 AM,  <james@nixsecurity.org> wrote:
>
> Hello,
>
> I've recently upgraded to 2.2.16 and am encountering some issues. I've no=
ticed the addition of SSLFIPS, however, I did not see any mention of this i=
n the release notes. I did, however, see mention of it in the release notes=
 for 2.3.6, interesting. I've compiled against OpenSSL 0.9.8o-fips (FIPS 1.=
2 module from openssl.org).
>
> I have a web application that uses OpenLDAP and SSH to add/check resource=
s, such as users. Going through HTTPS and testing the LDAP server configura=
tion (manually entered settings) to verify that I can communicate with the =
server properly, the Apache child process segfaults. The OpenLDAP version i=
s 2.4.23.
>
> [Fri Aug 06 09:17:54 2010] [notice] child pid 15419 exit signal Segmentat=
ion fault (11)
>
> Has anyone encountered this issue before?
>
> My other issue is when adding an user over HTTPS and having PHP exec() th=
e system's ssh command to connect to the remote machine and perform a few m=
inor operations. The error message I am getting is:
>
> digest.c(151): OpenSSL internal error, assertion failed: Digest update pr=
evious FIPS forbidden algorithm error ignored
> [Fri Aug 06 09:32:27 2010] [notice] child pid 29661 exit signal Aborted (=
6)
>
> After researching that error message a bit, it appears to be caused by an=
 MD5 checksum and MD5 is one of the forbidden algorithms in FIPS.
>
> The above mentioned functionality worked flawlessly in 2.2.15 and below.

Did you use the same OpenSSL build with 2.2.15 and below?

My suggestion:

Find out what symptoms are specific to the use of FIPS-enabled OpenSSL
Get backtraces for any crashes (SIGSEGV, SIGABRT) you're seeing
Open bugs with the appropriate component(s) -- httpd, PHP, apr,
OpenLDAP, etc. -- depending on what code crashes or is implicated in
misusing some other component.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org