<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">OpenSSH does not work with the FIPS mode of OpenSSL. This has been discussed both here and on the OpenSSH list.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> openssl-users [mailto:openssl-users-bounces@openssl.org]
<b>On Behalf Of </b>cloud force<br>
<b>Sent:</b> Friday, February 12, 2016 11:44 AM<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> Re: [openssl-users] no version information available error<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Thanks Jakob for the detailed info.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Feb 11, 2016 at 7:50 AM, Jakob Bohm <<a href="mailto:jb-openssl@wisemo.com" target="_blank">jb-openssl@wisemo.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">On 10/02/2016 22:46, cloud force wrote:<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi Everyone,<br>
<br>
I installed the FIPS capable openssl library (which was built by myself) on my Ubuntu linux box.<br>
<br>
For some reason, I keep running into the following errors whenever I run ssh related command:<br>
<br>
<br>
ssh: /lib/x86_64-linux-gnu/libcrypto.so.1.0.0: no version<br>
information available (required by ssh)<br>
<br>
<br>
The same error happens when I ran openssl command such as the following:<br>
<br>
linux-fips@ubuntu:/usr/local/ssl/lib$ openssl ciphers -v | wc -l<br>
openssl: /lib/x86_64-linux-gnu/libcrypto.so.1.0.0: no version information available (required by openssl)<br>
openssl: /lib/x86_64-linux-gnu/libcrypto.so.1.0.0: no version information available (required by openssl)<br>
openssl: /lib/x86_64-linux-gnu/libcrypto.so.1.0.0: no version information available (required by /lib/x86_64-linux-gnu/libssl.so.1.0.0)<br>
openssl: /lib/x86_64-linux-gnu/libcrypto.so.1.0.0: no version information available (required by /lib/x86_64-linux-gnu/libssl.so.1.0.0)<o:p></o:p></p>
<p class="MsoNormal">The Debian-family (includes Ubuntu) standard OpenSSL shared<br>
libraries is built in a special way to include "version tags"<br>
in the resulting .so files, and all the openssl-needing<br>
binaries in Debian/Ubuntu/etc. produce the error message<br>
above if you install copies of those libraries without those<br>
extra "version tags".<br>
<br>
There are two alternative ways to solve this:<br>
<br>
A) Build your FIPS-cabable OpenSSL (not the FIPScanister)<br>
with all the extra steps and patches in the Ubuntu OpenSSL<br>
source package (.dsc etc.), just adding the FIPS canister.<br>
Note that some of the patches in the source package are<br>
backports of the security fixes included in the latest<br>
OpenSSL versions, you'll probably have to figure out the<br>
details yourself (unless Kurt Roeckz posts a recipe<br>
somewhere).<br>
<br>
B) Patch your FIPS-capable OpenSSL makefile (not the<br>
FIPScanister makefile) to use a different .so-version, such<br>
as .so.1.0.2 . Then your private openssl build will not be<br>
used by the prepackaged software while software explicitly<br>
compiled against your locally build OpenSSL will not<br>
accidentally pick up the standard non-FIPS OpenSSL.<br>
<br>
<br>
<br>
Enjoy<br>
<br>
Jakob<span style="color:#888888"><br>
<span class="hoenzb">-- </span><br>
<span class="hoenzb">Jakob Bohm, CIO, Partner, WiseMo A/S. <a href="https://www.wisemo.com" target="_blank">
https://www.wisemo.com</a></span><br>
<span class="hoenzb">Transformervej 29, 2860 Søborg, Denmark. Direct <a href="tel:%2B45%2031%2013%2016%2010" target="_blank">
+45 31 13 16 10</a></span><br>
<span class="hoenzb">This public discussion message is non-binding and may contain errors.</span><br>
<span class="hoenzb">WiseMo - Remote Service Management for PCs, Phones and Embedded</span><br>
<br>
<span class="hoenzb">-- </span><br>
<span class="hoenzb">openssl-users mailing list</span><br>
<span class="hoenzb">To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">
https://mta.openssl.org/mailman/listinfo/openssl-users</a></span></span><o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<div>
<p class="MsoNormal">Rich<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>