# Unable to login after enabling Fips

**URL:** <https://forums.rockylinux.org/t/unable-to-login-after-enabling-fips/10492>\
**Category:** Rocky Linux Help & Support\
**Created:** [June 29, 2023, 7:57am UTC](https://forums.rockylinux.org/t/unable-to-login-after-enabling-fips/10492 "2023-06-29T07:57:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sagarseapatil](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@sagarseapatil](https://forums.rockylinux.org/u/sagarseapatil)\
**Post date:** [June 29, 2023, 7:57am UTC](https://forums.rockylinux.org/t/unable-to-login-after-enabling-fips/10492/1 "2023-06-29T07:57:56Z")

</div>

Hi,

Unable to login after fips enabled  
Error message  
ebug1: load\_hostkeys: fopen /etc/ssh/ssh\_known\_hosts: No such file or directory  
debug1: load\_hostkeys: fopen /etc/ssh/ssh\_known\_hosts2: No such file or directory  
debug1: SSH2\_MSG\_KEXINIT sent  
debug1: SSH2\_MSG\_KEXINIT received  
debug1: kex: algorithm: curve25519-sha256  
debug1: kex: host key algorithm: ecdsa-sha2-nistp256  
debug1: kex: server-\>client cipher: [chacha20-poly1305@openssh.com](mailto:chacha20-poly1305@openssh.com) MAC: compression: none  
debug1: kex: client-\>server cipher: [chacha20-poly1305@openssh.com](mailto:chacha20-poly1305@openssh.com) MAC: compression: none  
debug1: expecting SSH2\_MSG\_KEX\_ECDH\_REPLY  
Connection closed by 10.87.14.156 port 22

Steps Followed  
yum install -y dracut-fips  
dracut -f  
/sbin/grubby --update-kernel=ALL --args=“fips=1”  
reboot

Seems like ssh config changed after fibs enabled

Is the steps followed correct?  
Let me know if need to make any changes  
Can you help me on this .

---

<div class="post-metadata">

**Author:** ![hubbs](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/hubbs/32/3043_2.png) [@hubbs](https://forums.rockylinux.org/u/hubbs)\
**Post date:** [June 29, 2023, 7:27pm UTC](https://forums.rockylinux.org/t/unable-to-login-after-enabling-fips/10492/2 "2023-06-29T19:27:42Z")

</div>

Only certain ciphers are allowed to be used with SSH once you’ve enabled FIPS mode. You may need to delete your existing key and regenerate with an approved one. IIRC ed25519 is not an allowed cipher which causes issues on AWS since that’s one of the types that it suggests at when asking you to generate keys. You can use the following command to determine if FIPS is enabled.

`fips-mode-setup --check`

---

<div class="post-metadata">

**Author:** ![reukiodo](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/reukiodo/32/4148_2.png) [@reukiodo](https://forums.rockylinux.org/u/reukiodo)\
**Post date:** [April 1, 2024, 11:08pm UTC](https://forums.rockylinux.org/t/unable-to-login-after-enabling-fips/10492/3 "2024-04-01T23:08:16Z")

</div>

[https://www.federalregister.gov/documents/2023/02/03/2023-02273/announcing-issuance-of-federal-information-processing-standard-fips-186-5-digital-signature-standard](https://www.federalregister.gov/documents/2023/02/03/2023-02273/announcing-issuance-of-federal-information-processing-standard-fips-186-5-digital-signature-standard)

Since February 2023…