xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-07-31 18:19:40 +00:00
Code Issues Releases Wiki Activity

docs(dhcp): clarify legacy OMAPI FIPS limits

Browse Source 
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
This commit is contained in:
Vinícius Ferrão
2026-07-17 16:09:05 -03:00
parent 983ff507d8
commit c362904e0d
3 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/source/advanced/domain_name_resolution/domain_name_resolution.rst
+1 -2
View File
@@ -93,7 +93,7 @@ Edit **/etc/resolv.conf** to contain the cluster domain value you set in the sit
Legacy ISC DHCP and BIND TSIG Key Options
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04, SLES 12, SLES 15, and openSUSE Leap 15 leave **dhcpomapialgorithm** unset because their bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm.
xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04, SLES 12, SLES 15, and openSUSE Leap 15 leave **dhcpomapialgorithm** unset because their bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. HMAC-MD5 is not approved for FIPS mode; a FIPS-mode site that needs OMAPI must provide an ``omshell`` supporting ``key-algorithm`` and set a SHA-2 algorithm explicitly. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm.
To use another supported algorithm, set **dhcpomapialgorithm** in the site table and update the matching **passwd** table secret. Supported values are **hmac-md5**, **hmac-sha1**, **hmac-sha224**, **hmac-sha256**, **hmac-sha384**, and **hmac-sha512**. For example: ::
@@ -519,4 +519,3 @@ Execute ``confignetwork -s`` to configure provision IP address as static IP addr
b. If the compute node is already running, use ``updatenode`` command to run ``confignetwork -s`` postscript without rebooting the node ::
updatenode cn1 -P "confignetwork -s"
docs/source/guides/admin-guides/references/man5/site.5.rst
+5 -2
View File
@@ -102,8 +102,11 @@ site Attributes:
omshell does not support the key-algorithm command.
When this attribute is not set, including on an
existing installation, xCAT uses hmac-md5 for
compatibility. Kea does not use OMAPI, but Kea DDNS
uses this TSIG algorithm.
compatibility. HMAC-MD5 is not approved for FIPS
mode; a FIPS-mode site that needs OMAPI must provide
an omshell supporting key-algorithm and explicitly
select a SHA-2 algorithm. Kea does not use OMAPI, but
Kea DDNS uses this TSIG algorithm.
dhcpomapikeyname: The TSIG/OMAPI key name used by legacy ISC DHCP and
BIND DDNS integration. The default is xcat_key. The
perl-xCAT/xCAT/Schema.pm
+5 -2
View File
@@ -1052,8 +1052,11 @@ passed as argument rather than by table value',
" omshell does not support the key-algorithm command.\n" .
" When this attribute is not set, including on an\n" .
" existing installation, xCAT uses hmac-md5 for\n" .
" compatibility. Kea does not use OMAPI, but Kea DDNS\n" .
" uses this TSIG algorithm.\n\n" .
" compatibility. HMAC-MD5 is not approved for FIPS\n" .
" mode; a FIPS-mode site that needs OMAPI must provide\n" .
" an omshell supporting key-algorithm and explicitly\n" .
" select a SHA-2 algorithm. Kea does not use OMAPI, but\n" .
" Kea DDNS uses this TSIG algorithm.\n\n" .
" dhcpomapikeyname: The TSIG/OMAPI key name used by legacy ISC DHCP and\n" .
" BIND DDNS integration. The default is xcat_key. The\n" .
" value maps to the passwd table entry where key=omapi\n" .