diff --git a/changelog/15858.txt b/changelog/15858.txt new file mode 100644 index 000000000..24f448833 --- /dev/null +++ b/changelog/15858.txt @@ -0,0 +1,3 @@ +```release-note:change +core/fips: Disable and warn about entropy augmentation in FIPS 140-2 Inside mode +``` diff --git a/command/server.go b/command/server.go index 9a0cdb77b..179a4f112 100644 --- a/command/server.go +++ b/command/server.go @@ -34,6 +34,7 @@ import ( config2 "github.com/hashicorp/vault/command/config" "github.com/hashicorp/vault/command/server" "github.com/hashicorp/vault/helper/builtinplugins" + "github.com/hashicorp/vault/helper/constants" "github.com/hashicorp/vault/helper/metricsutil" "github.com/hashicorp/vault/helper/namespace" vaulthttp "github.com/hashicorp/vault/http" @@ -424,6 +425,12 @@ func (c *ServerCommand) parseConfig() (*server.Config, []configutil.ConfigError, config = config.Merge(current) } } + + if config.Entropy != nil && config.Entropy.Mode == configutil.EntropyAugmentation && constants.IsFIPS() { + c.UI.Warn("WARNING: Entropy Augmentation is not supported in FIPS 140-2 Inside mode; disabling from server configuration!\n") + config.Entropy = nil + } + return config, configErrors, nil }