ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

[kamal2222ahmed]

I am trying to use s3cmd on CentOs 7.5 , and it works fine with $s3cmd ls s3://alpha-team-share/chefprod

but when uploading:

s3cmd put backup_chef_2018-09-26-133542.tar.gz s3://alpha-team-share/chefprod

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
An unexpected error has occurred.
Please try reproducing the error using
the latest s3cmd code from the git master
branch found at:
https://github.com/s3tools/s3cmd
and have a look at the known issues list:
https://github.com/s3tools/s3cmd/wiki/Common-known-issues-and-their-solutions
If the error persists, please report the
following lines (removing any private
info as necessary) to:
[email protected]

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Invoked as: /bin/s3cmd put backup_chef_2018-09-26-133542.tar.gz s3://alpha-team-share/chefprod
Problem: ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
S3cmd: 2.0.2
python: 2.7.5 (default, May 31 2018, 09:41:32)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]
environment LANG=en_US.UTF-8

Traceback (most recent call last):
File "/bin/s3cmd", line 3092, in
rc = main()
File "/bin/s3cmd", line 3001, in main
rc = cmd_func(args)
File "/bin/s3cmd", line 369, in cmd_object_put
local_list, single_file_local, exclude_list, total_size_local = fetch_local_list(args, is_src = True)
File "/usr/lib/python2.7/site-packages/S3/FileLists.py", line 352, in fetch_local_list
total_size = _fetch_local_list_info(local_list)
File "/usr/lib/python2.7/site-packages/S3/FileLists.py", line 231, in _fetch_local_list_info
md5 = loc_list.get_md5(relative_file) # this does the file I/O
File "/usr/lib/python2.7/site-packages/S3/FileDict.py", line 48, in get_md5
md5 = Utils.hash_file_md5(self[relative_file]['full_name'])
File "/usr/lib/python2.7/site-packages/S3/Utils.py", line 260, in hash_file_md5
h = md5()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
An unexpected error has occurred.
Please try reproducing the error using
the latest s3cmd code from the git master
branch found at:
https://github.com/s3tools/s3cmd
and have a look at the known issues list:
https://github.com/s3tools/s3cmd/wiki/Common-known-issues-and-their-solutions
If the error persists, please report the
above lines (removing any private
info as necessary) to:
[email protected]
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

i tried with disabeling md5, same error:

s3cmd put backup_chef_2018-09-26-133542.tar.gz --no-check-md5 s3://alpha-team-share/chefprod
upload: 'backup_chef_2018-09-26-133542.tar.gz' -> 's3://alpha-team-share/chefprod' [part 1 of 14, 15MB] [1 of 1]
ERROR:
Upload of 'backup_chef_2018-09-26-133542.tar.gz' part 1 failed. Use
/bin/s3cmd abortmp s3://alpha-team-share/chefprod A0JRa0hmeyBjBcie3VEDFl_bHhjEkhDGr2nJCO095X0UmGmuFYR7n1mKEDtN2km.CrToyN6OhLdRVFtiW7AqmxHNPs_uhNzESzEO_M3xM6
to abort the upload, or
/bin/s3cmd --upload-id A0JRa0hmeyBjBcie3VEDFl_bHhjEkhDGr2nJCO095X0UmGmuFYR7n1mKEDtN2km.CrToyN6OhLdRVFtiW7AqmxHNPs_uhNzESzEO_M3xM6 put ...
to continue the upload.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
An unexpected error has occurred.
Please try reproducing the error using
the latest s3cmd code from the git master
branch found at:
https://github.com/s3tools/s3cmd
and have a look at the known issues list:
https://github.com/s3tools/s3cmd/wiki/Common-known-issues-and-their-solutions
If the error persists, please report the
following lines (removing any private
info as necessary) to:
[email protected]

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Invoked as: /bin/s3cmd put backup_chef_2018-09-26-133542.tar.gz --no-check-md5 s3://alpha-team-share/chefprod
Problem: ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
S3cmd: 2.0.2
python: 2.7.5 (default, May 31 2018, 09:41:32)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]
environment LANG=en_US.UTF-8

Traceback (most recent call last):
File "/bin/s3cmd", line 3092, in
rc = main()
File "/bin/s3cmd", line 3001, in main
rc = cmd_func(args)
File "/bin/s3cmd", line 421, in cmd_object_put
response = s3.object_put(full_name, uri_final, extra_headers, extra_label = seq_label)
File "/usr/lib/python2.7/site-packages/S3/S3.py", line 677, in object_put
return self.send_file_multipart(src_stream, headers, uri, size, extra_label)
File "/usr/lib/python2.7/site-packages/S3/S3.py", line 1603, in send_file_multipart
upload.upload_all_parts(extra_label)
File "/usr/lib/python2.7/site-packages/S3/MultiPart.py", line 119, in upload_all_parts
self.upload_part(seq, offset, current_chunk_size, labels, remote_status = remote_statuses.get(seq))
File "/usr/lib/python2.7/site-packages/S3/MultiPart.py", line 176, in upload_part
response = self.s3.send_file(request, self.file_stream, labels, buffer, offset = offset, chunk_size = chunk_size)
File "/usr/lib/python2.7/site-packages/S3/S3.py", line 1417, in send_file
md5_hash = md5()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
An unexpected error has occurred.
Please try reproducing the error using
the latest s3cmd code from the git master
branch found at:
https://github.com/s3tools/s3cmd
and have a look at the known issues list:
https://github.com/s3tools/s3cmd/wiki/Common-known-issues-and-their-solutions
If the error persists, please report the
above lines (removing any private
info as necessary) to:
[email protected]
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[fviard]

Hum, a similar case happened previously.
Your distribution/crypto package is in FIPS mode.

For FIPS, md5 is not a good (/allowed) cryptographic primitive because it is weak.
For that reason the function is disabled in your openssl library.

The problem, is that we are using md5 for differentiating files to be uploading for sync, but also for integrity check of transfer.
When you disable "md5" in the config, you in fact disable the md5 sum for file comparison for sync because it is an expensive operation. But not the md5 that is there to check that the server has the right file, not a corrupted one. This operation is not expensive.

The case of the FIPS is stupid because here the md5 is not used in a cryptographic context.
And it will not be used for "encryption" or to check the connection that uses https.

For your case, your only solution would be to modify the source of s3cmd if you can't change your distribution/ssl library.

If you want my opinion, what i have read is that it is stupid to use the FIPS version of openssl because you will get legacy versions...

[aiskuld]

I had this issue with a python package that was using md5 for hashing identifiers. Specifically, it was Django when I was trying to migrate my database with python manage.py migrate. To fix it, I changed the hashlib.md5() function that was causing the error to hashlib.md5(usedforsecurity=False)

Here is the command to do that if you don't want to dig through the file
single file:

sed -i 's/hashlib.md5()/hashlib.md5(usedforsecurity=False)/g' <virtual_environment>/lib/python3.6/site-packages/django/db/backends/base/schema.py

This function is also found in the following file locations, but I would probably only change it if it causes an error.

$ grep -iRl "hashlib.md5()" .
<virtual_environment>/lib/python3.6/site-packages/django/utils/cache.py
<virtual_environment>/lib/python3.6/site-packages/django/db/models/indexes.py
<virtual_environment>/lib/python3.6/site-packages/django/contrib/staticfiles/storage.py

I know this is somewhat unrelated to the question asked, but it is the first result on Google, and I wouldn't be surprised if it's the same or a similar issue here

[kdickerson]

Sorry for a little bit of noise, but I have a blog post that's relevant to @aiskuld 's comment about patching hashlib: http://blog.serindu.com/2019/11/12/django-in-fips-mode/ I monkey-patch the appropriate Django packages at runtime so I can avoid a forked codebase.

That approach should be useful for any other instance of needing to utilize libraries using blocked algorithms for non-security purposes while in FIPS mode.

[fviard]

Fixed, thanks to @maroth96 !