[wildfly-dev] Supporting FIPS in domain mode
brian.stansberry at redhat.com
Thu Nov 19 11:38:26 EST 2015
On 11/19/15 10:07 AM, Darran Lofthouse wrote:
> On 19/11/15 15:50, Brian Stansberry wrote:
>> Darran's the expert on this, but my initial naive question is whether
>> this can be split into two logical use cases:
>> 1) Where we know TLS is not going to be used on the HC<->server
>> 2) Where we don't know that.
>> I ask because if case 2 is harder or requires changes that don't belong
>> in a micro release (e.g. management model changes) perhaps we can first
>> deal with case 1. My impression from the initial bug report is that
>> SSL/TLS was not configured on the host's management interfaces.
> To get to the error in the bug report the underlying user has taken
> these two steps: -
> 1 - Configure the JVM to be FIPS Compliant.
> 2 - Start a default domain configuration.
> They have experienced the error and reported it to us.
> I would be very surprised if they were not planning to subsequently
> enable TLS for the remote communication with the HostController.
I can't say I disagree. :)
> I suppose at a push master may have no application server instances but
> have TLS enable for remote communication and the individual slave host
> controllers only bind management to loopback so don't enable TLS.
With WildFly 9/10 the intra-domain comms can be running on a completely
separate network from non-management stuff, so the possibility that
traffic doesn't use TLS is a bit greater. But still not likely. In
earlier versions this kind of setup is harder since CLI would talk to
the DC over the same interface intra-domain comms use. With WF 9/10 the
CLI could use HTTP Upgrade to talk to the DC on one network while
intra-domain comms are on another network using the old native interface.
>> On 11/19/15 4:25 AM, Ryan Emerson wrote:
>>> Hello All,
>>> Currently domain mode is unable to execute when the JVM has FIPS
>>> enabled. See  for example config files and the resulting stacktrace.
>>> I am looking into this issue (SET engineer), however my current
>>> knowledge of core and FIPS is limited. What are your thoughts on how
>>> to implement FIPS compatibility? Is there any fundamental reasons why
>>> such a feature shouldn't be supported?
>>>  https://issues.jboss.org/browse/WFCORE-1135
>>> wildfly-dev mailing list
>>> wildfly-dev at lists.jboss.org
Senior Principal Software Engineer
JBoss by Red Hat
More information about the wildfly-dev