Duo Unix 2.x RPM Digests on RHEL 8 with FIPS enabled about duo_unix HOT 7 CLOSED

Did you try this on a fresh RHEL 8 box/VM, or one that you had previously tried to install on? Internally we were only able to reproduce this in the second case, but a new box with the published workaround was able to install the package. Hopefully that would work for you as well.

from duo_unix.

One that was already running; its been configured with FIPS per RHEL's FIPS Setup (# fips-mode-setup --enable) and the digest is still rejected. I had to use the workaround which makes it hard to manage multiple systems as I have to write a custom script just to handle Duo on yum/dnf updates.

from duo_unix.

FIPS seems to be part of the problem - we could reproduce the issue with FIPS enabled. We'll see what we can figure out. Thanks for reporting this.

from duo_unix.

After looking into this further it's unlikely that this is related to the signature. When installing the RPM in FIPS mode I get the following error

$ sudo rpm --install duo_unix-2.0.0-0.el8.x86_64.rpm
erro: unpacking of archive failed on file /etc/duo/login_duo.conf;63bedf4e: cpio: Digest mismatch
error: duo_unix 0:2.0.0-0.el8.x86_64: install failed

I'll continue to look into why this only is occurring in FIPS mode

from duo_unix.

This did end up being a file digest issue. The RPM build spec file wrongly listed MD5 as the _binary_filedigest_algorithm I'll work on getting a fixed package up shortly.

from duo_unix.

Even using the correct digest algorithm we're still having issues. Please bear with us.

from duo_unix.

We believe this was resolved, please reopen it if it was not.

from duo_unix.