<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE: [Openswan Users] CKAIDNSS keyword not found where expected in RSAkey in /var/log/secure</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">>Please follow the comments at</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">> </FONT></SPAN><A HREF="https://bugzilla.redhat.com/show_bug.cgi?id=508107"><SPAN LANG="en-us"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">https://bugzilla.redhat.com/show_bug.cgi?id=508107</FONT></U></SPAN></A><SPAN LANG="en-us"></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">></FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">>It should solve the problem, or wait for 2.6.21-5</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">></FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">>Avesh</FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">I read thru that whole bug report top to bottom. The final thing was, it **needed** a password at least 8 characters with at least one number. </FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">But no good for me, both without and with FIPS, both times starting with a clean NSS database. What is FIPS?</FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Does the 2.6.22 .tar.gz file get past all this?</FONT></SPAN>
</P>
<BR>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# mkdir nssdb</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# certutil -N -d sql:/etc/ipsec.d/nssdb</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Enter a password which will be used to encrypt your keys.</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">The password should be at least 8 characters long,</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">and should contain at least one non-alphabetic character.</FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Enter new password:</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Re-enter password:</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# nano nss-password.txt</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# ipsec newhostkey --configdir /etc/ipsec.d/nssdb --password ZSE45tgb --output /etc/ipsec.d/hostkey.secrets</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">ipsec rsasigkey: key pair generation failed: "-8126"</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# rmdir -R -f nssdb</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">rmdir: invalid option -- 'R'</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Try `rmdir --help' for more information.</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# rm -R -f nssdb</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# mkdir nssdb</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# certutil -N -d sql:/etc/ipsec.d/nssdb</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Enter a password which will be used to encrypt your keys.</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">The password should be at least 8 characters long,</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">and should contain at least one non-alphabetic character.</FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Enter new password:</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Re-enter password:</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# modutil -fips true -dbdir sql:/etc/ipsec.d/nssdb </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">WARNING: Performing this operation while the browser is running could cause</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">corruption of your security databases. If the browser is currently running,</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">you should exit browser before continuing this operation. Type</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">'q <enter>' to abort, or <enter> to continue:</FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">FIPS mode enabled.</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# ipsec newhostkey --configdir /etc/ipsec.d/nssdb --password ZSE45tgb --output /etc/ipsec.d/hostkey.secrets</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# date</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Wed Jul 8 13:48:41 CDT 2009</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# ls -al hostkey.secrets</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">-rw-------. 1 root root 94 2009-07-08 13:48 hostkey.secrets</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]# more hostkey.secrets</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">: RSA {</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">FIPS integrity verification test failed.</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial"> }</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial"># do not change the indenting of that "}"</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">[root@huge-fw ipsec.d]#</FONT></SPAN>
</P>
</BODY>
</HTML>