3. Installation Notes¶

3.1. Installing Tower on Systems with FIPS Mode Enabled¶

Tower can run on systems where FIPS mode is enabled, though there are a few limitations to keep in mind:

• Only Enterprise Linux 7+ is supported. The standard python that ships with RHEL must be used for Ansible Tower to work in FIPS mode. Using any non-standard, non-system python for Tower is therefore, unsupported.

• By default, Tower configures PostgreSQL using password-based authentication, and this process relies on the usage of md5 when CREATE USER is run at install time. If you intend to run the Tower installer from a FIPS-enabled system, you’ll need to pre-compute an md5 hash yourself at install time and add its value to the inventory file described in Setting up the Inventory File.

  Specifically, you must pre-compute the hashed value on a system without FIPS enabled:

  $ python -c 'from hashlib import md5; print("md5" + md5("choose-a-password" + "awx").hexdigest())'
  md57d08dde7e95e862eaadfff09565e92e6
  

  …and specify both pg_password and pg_hashed_password in your inventory file:

  pg_password='choose-a-password'
  pg_hashed_password='md57d08dde7e95e862eaadfff09565e92e6'
  

  The “awx” implies the Postgres username. If you have an alternative username, provide that rather than “awx”.

• The ssh-keygen command generates keys in a format (RFC4716) which uses the md5 digest algorithm at some point in the process (as part of a transformation performed on the input passphrase). On a FIPS-enforcing system, md5 is completely disabled, so these types of encrypted SSH keys (RFC4716 private keys protected by a passphrase) will not be usable. When FIPS mode is enabled, any encrypted SSH key you import into Ansible Tower must be a PKCS8-formatted key. Existing AES128 keys can be converted to PKCS8 by running the following openssl command:

  $ openssl pkcs8 -topk8 -v2 aes128 -in <INPUT_KEY> -out <NEW_OUTPUT_KEY>
  

For more details, see: https://access.redhat.com/solutions/1519083

• Use of Ansible features that use the paramiko library will not be FIPS compliant. This includes setting ansible_connection=paramiko as a transport and using network modules that utilize the ncclient NETCONF library.

• The TACACS+ protocol uses md5 to obfuscate the content of authorization packets; TACACS+ Authentication is not supported for systems where FIPS mode is enabled.

• The RADIUS protocol uses md5 to encrypt passwords in Access-Request queries; RADIUS Authentication is not supported for systems where FIPS mode is enabled.

3.2. Notes for Red Hat Enterprise Linux and CentOS setups¶

• PackageKit can frequently interfere with the installation/update mechanism. Consider disabling or removing PackageKit if installed prior to running the setup process.

• Only the “targeted” SELinux policy is supported. The targeted policy can be set to disabled, permissive, or enforcing.

• When performing a bundled install (refer to Using the Bundled Tower Installation Program for more information), Red Hat Enterprise Linux customers must enable the following repositories which are disabled by default:

  • Red Hat Enterprise Linux 7 users must enable the extras repositories.

3.3. Configuration and Installation of Ansible with Red Hat Enterprise Linux and CentOS¶

The following steps help you configure access to the repository as well as install Ansible on older versions of Tower.

root@localhost:~$ yum install http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

root@localhost:~$ yum install ansible

3.4. Configuration and Installation of Ansible with Ubuntu¶

The following steps help you configure access to the repository as well as install Ansible on older versions of Tower.

root@localhost:~$ apt-get install software-properties-common
root@localhost:~$ apt-add-repository ppa:ansible/ansible

root@localhost:~$ apt-get update
root@localhost:~$ apt-get install ansible

3.5. Configuration and Installation on OpenShift¶

For OpenShift-based deployments, refer to OpenShift Deployment and Configuration.