API is not compatible with FIPS

[mgmacias95]

Hi team,

I've enabled FIPS in the host I have a Wazuh manager installed in following this guide.

I'm getting errors in some API calls:

• GET/agents/groups:

  # curl -u foo:bar "localhost:55000/agents/groups?pretty"
  {
      "error": 1000,
      "message": "Wazuh-Python Internal Error: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips"
  }
  # curl -u foo:bar "localhost:55000/agents/groups?pretty&hash=sha256"
  {
      "error": 0,
      "data": {
          "totalItems": 1,
          "items": [
              {
                  "count": 0,
                  "mergedSum": "432b8119fc2241ed911512c606481b4f58e91a59499a6565dccbeaad504cc204",
                  "configSum": "d76908d51018ec72afc1a7e17fbc3971c6a812446fd930fdba5ed66f1af47ed0",
                  "name": "default"
              }
          ]
      }
  }

• GET/agents/groups/files:

  # curl -u foo:bar "localhost:55000/agents/groups/default/files?pretty"
  {
      "error": 1727,
      "message": "Error listing group files: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips"
  }
  # curl -u foo:bar "localhost:55000/agents/groups/default/files?pretty&hash=sha256"
  {
      "error": 604,
      "message": "Filter error. Allowed filters: [ offset  limit  sort  search ]  "
  }

• PUT/agents/:agent_name (and all registering agents API calls):

  # curl -u foo:bar -XPUT "localhost:55000/agents/pepe?pretty"
  {
      "error": 1725,
      "message": "Error registering a new agent: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips"
  }

I think a hash option should be added in those API calls to, at least, minimize the impact of these errors.

Best regards,
Marta

[mgmacias95]

Hello,

I've made two PRs: wazuh/wazuh#1358 and #166. Those PRs add a hash parameter to GET/agents/groups/files so it can be used with different algorithms than md5.

In order to register agents using the API, ossec-authd must be enabled:

# /var/ossec/bin/ossec-control enable auth
# systemctl restart wazuh-manager

This is a temporary fix so the API could be used in systems with FIPS enabled but in the future, all MD5 hashes should be removed.

Best regards,
Marta