| Warning |
|---|
Proceed with caution, as Checkmk does not currently support FIPS configurations. This article is a workaround only! |
| Status | ||||
|---|---|---|---|---|
|
...
Verify if FIPS is already enabled on the system.
Code Block language bash theme RDark $ fips-mode-setup --check FIPS mode is enabled.
If FIPS is not enabled, you will need to enable it using Red Hat's official methods..
The application works with FIPS mode fine, as the following screens show. The problem is that it doesn't install with the MD5-signed RPM.
If the RPM is signed by SHA256 or the --nofiledigest option is specified, Checkmk installs fine.Code Block language bash theme RDark [user@redhat8host ~]$ sudo rpm -ivh --nofiledigest check-mk-agent-2.1.0p16-d88c216c6ads3a29.noarch_1.rpm We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for checkmk: verifying ... #########################################################[100%] preparing ... #########################################################[100%] updating / installing ... l:check-mk-agent-2.1.0p16-3.d88c216######################################################[100%] Deploying systemd units: check-mk-agent-async.service check-mk-agent.socket check-mk-agent@.service cmk-agent-ctl-daemon.service Deployed systemd Creating/updating cmk-agent user account .. WARNING: The agent controller is operating in an insecure mode! To secure the connection run `cmk-agent-ctl register' Activating systemd unit *check-mk-agent-async.service'.. Created symlink /etc/systemd/system/multi-user.target.wants/check-mk-agent-async.service - /usr/lib/systemd/system/check-mk-agent-async.service. Activating systemd unit *check-mk-agent.socket"socket” Created symlink /etc/systemd/system/sockets.target.wants/check-mk-agent.socket ep etstthe - ustf ttorsys teudr /usr/lib/systemd/system/check-mk sys tem/ check-mk-agent. socket. Activating systemd unit *cmk-agent-ctl-daemon.service' ..' Created symlink /etc/systemd/system/multi-user,target.wants/cmk-agent-ctl-daemon.service - /usr/lib/systemd/system/cmk-agent-ctl-daemon.service. [user@redhat8host ~]$
Note Normal baked RPM is signed by MD5. This needs to be signed by SHA256. The --nofiledigest option will install Checkmk. .
While initially, it looks like Checkmk Agent isn't working, please note the "no “no route to host" host” error. We will need to enable a few firewall rules within the OS.
Adding Checkmk Agent ports to the firewall.
Info Add "“--permanent" permanent” to firewall-cmd to make firewall rules persistent.
Allow port 6556 for both TCP and UDPCode Block language bash theme RDark [user@redhat8host ~]$ sudo firewall-cmd --add-port=6556/tcp success [user@redhat8host ~]$ sudo firewall-cmd --add-port=6556/udp success
Code Block language bash theme RDark [user@redhat8host ~]$ sudo firewall-cmd --list-all public (active) target: default icmp-block-tnverston: no interfaces: ens18 sources: services: cockpit dhcpv6-cllent ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: [user@redhat8host ~]$ sudo firewall-cmd --add-port=6556/tcp Success [user@redhat8host ~]$ sudo firewall-cmd --add-port=6556/udp success [user@redhat8host -]$ sudo firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: ens18 sources: services: cockpit dhcpv6-client ssh ports: 6556/tcp 6556/udp protocols: forward: no masquerade: no forward-ports: source-ports: icnp-blocks: rich rules: [user@redhat8host ~]$
You will then want to rescan the host and accept the changes.
Now we can see that the Check MK agent and Service Discovery are working.
We can now verify that these changes have been applied at the OS level.
.
First, we will check that the FIPS mode is enabled.
Code Block language bash theme RDark [user@redhat8host ~]$ fips-mode-setup --check FIPS mode is enabled. [user@redhat8host ~]$ sestatus SELinux status: enabled SELinux mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode fron conflg flle: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protectlon checking: actual (secure) Max kernel policy version! 33 [user@redhat8host ~]$
.
Next, we will verify that port 6556 is open for TCP and UDP
Code Block language bash theme RDark [user@redhat8host ~]$ sudo firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: ens18 sources: services: cockpit dhcpv6-client ssh ports: 6556/tcp 6556/udp protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: [user@redhat8host ~]$
.
Finally, we can verify that the checmk-mk-agent is running correctly.
Code Block language bash theme RDark [user@redhat8host ~]$ systemctl status check-mk-agent.socket check-mk-agent.socket - Local Checkmk agent socket loaded: loaded (/usr/lib/systemd/system/check-mk-agent.socket; enabled; vendor preset: disabled) Active: active (running)/ since Mon 2022.12-12 20:35:07 EST: 49min ago Listen: /run/check-mk-ayent.socket (stream) Accepted: 36; Connected: 0; Tasks: 0 (limit: 24726) Memory: 4.0K CGroup: /system.slice/check-mk-agent.socket Dec 12 20:35:07 redhat8host[1]: Starting Local Checkmk agent socket. Dec 12 20:35:07 redhat8host[1]: Listening on Local checkmk agent socket. [user@redhat8host ~]$
Code Block language bash theme RDark [user@redhat8host ~]$ systemctl status cmk-agent-ctl-daemon.service cmk-agent-ctl-daemon.service - Checkmk agent controller daemon Loaded: loaded (/usr/1ib/systemd/system/cmk-agent.ctl-daemon.service; enabled; vendor preset: disabled) Active: active (listening) since Mon 2022-12-12 20:35:07 EST; 49nin ago Main PID: 4975 (cmk-agent-ctl) Tasks: 3 (limit; 24726) Memory; 10.3M CGroup: /system.slice/cmk-agent-ctl-daemon.service - 4975/usr/bin/cmk-agent-ctl daemon Dec 12 20:35:07 redhat8host systemd[1]: Started Checkmk agent controller daemon. [user@redhat8host ~]$
...