Installation failure on Linux

[spacemeb]

Cannot install the following on red hat host:

Cisco Secure Endpoint Connector Version: 1.17.0.802

Error:

[root@ ciscoamp]# sudo yum localinstall amp_haproxy_rhel-centos-8prev.rpm -y

Updating Subscription Management repositories.

Package                                          Architecture                          Version                                         Repository                                   Size

==========================================================================================================================================================================================

Installing:

ciscoampconnector                                x86_64                                1.16.2.789-1.el8                                @commandline                                 28 M

Transaction Summary

==========================================================================================================================================================================================

Install 1 Package

Total size: 28 M

Installed size: 74 M

Downloading Packages:

warning: /root/ciscoamp/amp_haproxy_rhel-centos-8prev.rpm: Header V4 RSA/SHA1 Signature, key ID h2f7es8f: NOKEY

Public key for amp_haproxy_rhel-centos-8prev.rpm is not installed

Error: GPG check FAILED

[root@ciscoamp]# sudo yum localinstall amp_haproxy_rhel-centos-8.rpm -y --nogpgcheck

Updating Subscription Management repositories.

==========================================================================================================================================================================================

Package                                          Architecture                          Version                                         Repository                                   Size

================================================

Installing:

ciscoampconnector                                x86_64                                1.17.0.802-1.el8                                @commandline                                 29 M

Transaction Summary

==========================================================================================================================================================================================

Install 1 Package

Total size: 29 M

Installed size: 78 M

Downloading Packages:

Running transaction check

Transaction check succeeded.

Running transaction test

Error: Transaction test error:

  package ciscoampconnector-1.17.0.802-1.el8.x86_64 does not verify: no digest

Same results with version: (1.16.2.789)

Any ideas?

[balaji.bandi]

What Linux ? Centos or RHEL ?

follow below guide :

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215378-installation-of-the-amp-for-endpoints-li.html

[spacemeb]

Hello,

Its RHEL.

I followed the doc but installation fails cause of "GPG check FAILED"

Is there any bug for rhel8? On rhel6/7 runs normally.. 

[balaji.bandi]

Not that i am aware any bugs reported.

[ChrysostomosTzouros]

Hello team,

We are facing the same issue.

We tried the installation on RHEL 8 and we had the same results.

We even tried the installation with the switch - nogpgcheck and the result is

[root@rsl-ha02 ciscoamp]# sudo yum localinstall amp_xxxxxx_rhel-centos-8.rpm -y --nogpgcheck

Updating Subscription Management repositories.

Last metadata expiration check: 4:12:20 ago on Mon 17 Jan 2022 11:11:56 AM EET.

Dependencies resolved.

==========================================================================================================================================================================================

Package                                          Architecture                          Version                                         Repository                                   Size

==========================================================================================================================================================================================

Installing:

ciscoampconnector                                x86_64                                1.17.0.802-1.el8                                @commandline                                 29 M

Transaction Summary

==========================================================================================================================================================================================

Install  1 Package

Total size: 29 M

Installed size: 78 M

Downloading Packages:

Running transaction check

Transaction check succeeded.

Running transaction test

Error: Transaction test error:

  package ciscoampconnector-1.17.0.802-1.el8.x86_64 does not verify: no digest

We tried also a previous version, but no luck.

Is it possible that this issue is caused by FIPS mode?

In our server it is enabled

[ChrysostomosTzouros]

We managed to complete the installation by disabling fips mode on a test RHEL 8 machine.

When we re-enabled fips and tried the installation again, it failed.

Cisco, can you elaborate on this please?

[balaji.bandi]

I have seen this issue with fedora selinux settings,. not sure that helps you.

[spacemeb]

It's indeed working without FIPS, I hope it's not because the rpm does not comply with the relevant security standards..

[balaji.bandi]

Cheers  !!! thank you for the feedback and sharing your solution, we mark this as resolved now..

[spacemeb]

OK, but is it even safe to disable FIPS? I mean this is just a workaround ..:/

[spacemeb]

So is it safe?? Should I keep it disabled?? Any cisco reference??

[balaji.bandi]

it is all depends on requirement : ( we do not use FIPS)

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/enable-fips.html