# systemd gets stuck with FIPS enabled **URL:** \ **Category:** SLES Install-Boot\ **Created:** [January 31, 2019, 12:22pm UTC](https://forums.suse.com/t/systemd-gets-stuck-with-fips-enabled/33459 "2019-01-31T12:22:42Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bugraturhan](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bugraturhan](https://forums.suse.com/u/bugraturhan)\ **Post date:** [January 31, 2019, 12:22pm UTC](https://forums.suse.com/t/systemd-gets-stuck-with-fips-enabled/33459/1 "2019-01-31T12:22:42Z")
Hello everyone, I am trying to enable FIPS on a Suse Linux Enterprise Server 15 and systemd gets stuck really early on. If I wait a bit I can see ‘random: systemd: uninitialized urandom read’ logs, so I’ve tried to generate some entropy before running systemd. To test this, I’ve added ‘rngd’ to my initrd, changed init to a shell, started rngd manually and then started systemd, it worked. This is easily reproducible in a virtual machine, I was also able to reproduce it on a Supermicro SYS-E300-8D. Just install ‘fips’ pattern and add ‘fips=1’ to kernel parameters. If my Googling is correct, this related to kernel changes for CVE-2018-1108, it was intentional. So, Is there any additional steps I should be taking to make it work on a machines that doesn’t use hardware rng? Or is there an easy way to generate entropy without intervening boot process? What do you think? Thanks in advance, Buğra ---
**Author:** ![Andreas1](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Andreas1](https://forums.suse.com/u/Andreas1)\ **Post date:** [January 31, 2019, 10:42pm UTC](https://forums.suse.com/t/systemd-gets-stuck-with-fips-enabled/33459/2 "2019-01-31T22:42:56Z")
Did you read the FIPS documentation for SLES15 (post #5): [https://forums.suse.com/showthread.php?12171-Loading-graphical-environment-is-slow-when-FIPS-is-enabled&p=52864#post52864](https://forums.suse.com/showthread.php?12171-Loading-graphical-environment-is-slow-when-FIPS-is-enabled&p=52864#post52864) Professional virtual machine solutions like VMware give guest os access to the hardware random number generator (HRNG/TRNG) of the host os (or physical machine). [https://communities.vmware.com/thread/471512](https://communities.vmware.com/thread/471512) [https://kb.vmware.com/s/article/1003746](https://kb.vmware.com/s/article/1003746) [https://en.wikipedia.org/wiki/RdRand](https://en.wikipedia.org/wiki/RdRand) [https://en.wikipedia.org/wiki/Hardware\_random\_number\_generator](https://en.wikipedia.org/wiki/Hardware_random_number_generator) If the guest os has no access to the hardware random number generator or the guest os has no access to the hardware acceleration for encryption or decryption (like AES-NI) you shouldn’t acctivate FIPS mode for a guest os. [https://en.wikipedia.org/wiki/AES\_instruction\_set](https://en.wikipedia.org/wiki/AES_instruction_set) ---
**Author:** ![Andreas1](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Andreas1](https://forums.suse.com/u/Andreas1)\ **Post date:** [January 31, 2019, 10:58pm UTC](https://forums.suse.com/t/systemd-gets-stuck-with-fips-enabled/33459/3 "2019-01-31T22:58:11Z")
I can’t find any FIPS 140-2 certificate for SLE15: [https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search](https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search) ---
**Author:** ![Andreas1](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Andreas1](https://forums.suse.com/u/Andreas1)\ **Post date:** [January 31, 2019, 11:08pm UTC](https://forums.suse.com/t/systemd-gets-stuck-with-fips-enabled/33459/4 "2019-01-31T23:08:55Z")
[QUOTE=bugraturhan;56427]Is there any additional steps I should be taking to make it work on a machines that doesn’t use hardware rng? Or is there an easy way to generate entropy without intervening boot process? What do you think?[/QUOTE]See: [https://wiki.archlinux.org/index.php/Rng-tools](https://wiki.archlinux.org/index.php/Rng-tools) and “Virtual machines”: [https://wiki.archlinux.org/index.php/Haveged](https://wiki.archlinux.org/index.php/Haveged) ---
**Author:** ![Andreas1](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Andreas1](https://forums.suse.com/u/Andreas1)\ **Post date:** [January 31, 2019, 11:36pm UTC](https://forums.suse.com/t/systemd-gets-stuck-with-fips-enabled/33459/5 "2019-01-31T23:36:49Z")
[QUOTE=bugraturhan;56427]I can see ‘random: systemd: uninitialized urandom read’ logs[/QUOTE]ArchWiki is an excellent source for Linux related information: [https://wiki.archlinux.org/index.php/Random\_number\_generation](https://wiki.archlinux.org/index.php/Random_number_generation) ---
**Author:** ![bugraturhan](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bugraturhan](https://forums.suse.com/u/bugraturhan)\ **Post date:** [February 1, 2019, 4:20pm UTC](https://forums.suse.com/t/systemd-gets-stuck-with-fips-enabled/33459/6 "2019-02-01T16:20:47Z")
Hi AndreasMeyer, Thanks a ton for pointing me to right direction. Also it did not occur to me to check certification, thanks for that, too.