Bug #85906 Could not establish SSH. error:060800A3 EVP_DigestInit_ex:disabled for fips
Submitted: 11 Apr 2017 20:44 Modified: 12 Apr 2017 12:30
Reporter: Anvar Kuchkartaev Email Updates:
Status: Duplicate Impact on me:
None 
Category:MySQL Workbench Severity:S1 (Critical)
Version:6.3.9 OS:Oracle Linux (Oracle Linux Server 7.3 x86_64)
Assigned to: CPU Architecture:Any
Tags: WBBugReporter

[11 Apr 2017 20:44] Anvar Kuchkartaev
Description:
MySQL Workbench cannot establish any SSH connection either TCP/IP over SSH or SSH Remote Management Connections in FIPS enabled mode.

/home/admin/.mysql/workbench/log/wb.log

22:36:01 [INF][   WBContext UI]: Initializing workbench context UI with these values:
	base dir: /usr/share/mysql-workbench
	plugin path: /usr/lib64/mysql-workbench/plugins
	struct path: /usr/share/mysql-workbench/grt
	module path: /usr/lib64/mysql-workbench/modules
	library path: /usr/share/mysql-workbench/libraries
	user data dir: /home/admin/.mysql/workbench
	open at start: 
	open type: 
	run at startup: 
	run type: 
	Force SW rendering: No
	Force OpenGL: No
	quit when done: No
22:36:01 [INF][      WBContext]: WbContext::init
22:36:02 [INF][            WBA]: Looking for extension modules for WBA...
22:36:02 [INF][            WBA]: 0 extension modules found
22:36:02 [WRN][            grt]: /home/admin/.mysql/workbench/connections.xml:15: link 'eaa742d4-1ee5-11e7-a32f-008cfa3f7abe' <object GrtObject> key=owner could not be resolved
22:36:02 [INF][      WBContext]: System info:
 	MySQL Workbench Community (GPL) for Linux/Unix version 6.3.9 CE build 10690321 (64 bit)
	Configuration Directory: /home/admin/.mysql/workbench
	Data Directory: /usr/share/mysql-workbench
	Cairo Version: 1.14.2
	OS: Red Hat Enterprise Linux Server release 7.3 (Maipo) x86_64
	CPU: 8x Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz (3240.093MHz) - 23.18GiB RAM
No video adapter info available
	Distribution: Oracle Linux Server release 7.3

	Fips mode enabled: yes

22:36:10 [INF][SQL Editor Form]: Opened connection 'mysql.intranet.local' to MySQL Community Server (GPL) version 5.7.17
22:36:12 [INF][wb_admin_control.py:server_polling_thread:569]: Monitoring thread running...
22:36:13 [ERR][wb_admin_ssh.py:connect:469]: Error opening SSH connection: Traceback (most recent call last):
  File "/usr/lib64/mysql-workbench/modules/wb_admin_ssh.py", line 418, in connect
    key_filename = key, timeout = 10, look_for_keys=bool(usekey), allow_agent=bool(usekey) )
  File "/usr/lib/python2.7/site-packages/paramiko/client.py", line 361, in connect
    server_key)
  File "/usr/lib64/mysql-workbench/modules/wb_admin_ssh.py", line 51, in missing_host_key
    raise SSHFingerprintNewError("Key mismatched", client, hostname, key)
  File "/usr/lib64/mysql-workbench/modules/wb_common.py", line 111, in __init__
    self.fingerprint = binascii.hexlify(self.key.get_fingerprint())
  File "/usr/lib/python2.7/site-packages/paramiko/pkey.py", line 129, in get_fingerprint
    return md5(self.asbytes()).digest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

22:36:15 [ERR][wb_admin_main.py:shutdown:219]: shutting down admn
22:36:15 [ERR][               ]: atk_selection_ref_selection: assertion 'ATK_IS_SELECTION (obj)' failed
22:36:15 [INF][wb_admin_control.py:server_polling_thread:585]: Monitoring thread done.

How to repeat:
The error occuring every time when I try to use any ssh related operation in FIPS enabled mode. But it does not appear if system starts in non-fips mode.
[11 Apr 2017 20:46] Anvar Kuchkartaev
wb.log file

Attachment: wb.log (text/x-log), 2.67 KiB.

[12 Apr 2017 12:30] MySQL Verification Team
Hello Anvar Kuchkartaev,

Thank you for report.
Confirmed from the change log, and from internal discussion with developer that on Linux with FIPS (Federal Information Processing Standard) enabled, MySQL Workbench would fail to connect and emit a "Cannot start SSH tunnel manager" error. Creating local connections on FIPS enabled systems is now functional, although SSH tunneling (for remote connections) remains unavailable due to limitations with the underlining paramiko library. (Bug #20236376, Bug #75262) - this is mentioned in the change log as well - https://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-2-5.html

Marking this as duplicate of  Bug #75262

Thanks,
Umesh