11.3. Updating FIPS standards

Procedure 11.3. Updating User Passwords

1. Export a list of users with MD5-encrypted passwords:

   # spacewalk-report users-md5 > users-md5.csv
   

2. Change the password of each user using the following for loop:

   # for i in $(cat users-md5.csv | awk -F, 'NR>1 { print $4 }'); do
         echo "Changing password for user $i";
         satpasswd $i;
         echo;
   done
   

   Alternatively, instruct all users on the users-md5.csv to log into Satellite's Web UI. Satellite will automatically change their passwords in the database to use SHA-256.

Procedure 11.4. Updating Client Certificates

1. Export a list of client systems using certificates using MD5-encryption:

   # spacewalk-report system-md5-certificates > system-md5-certificates.csv
   

2. Use the spacewalk-fips-tool to schedule an update of systems in an organization. You need to repeat this process for each organization in your Satellite environment. First use the following commands for organization with ID 1:

   # ORG_ID=1
   # for system in $(awk -F, "NR>1 { if (\$3 == $ORG_ID) print \$1 }" system-md5-certificates.csv); do systems="$systems $system"; done
   # spacewalk-fips-tool -i -u admin -d "2014-12-01 14:00:00" -o /tmp/scheduled-installations.csv $systems
   

   This schedules the installation of packages requires for the certificate update on December 1, 2014 at 2pm.
   Next, Either run rhn_check -v on each client or wait until osad picks up the event.
   Finally, use the spacewalk-fips-tool again to schedule an update of certificates:

   # ORG_ID=1
   # for system in $(awk -F, "NR>1 { if (\$3 == $ORG_ID) print \$1 }" system-md5-certificates.csv); do systems="$systems $system"; done
   # spacewalk-fips-tool -c -u admin -d "2014-12-01 14:00:00" -o /tmp/scheduled-installations.csv $systems
   

3. Repeat this process for each organization ID.