Enabling FIPS on a luks encrypted CentOS system breaks boot password

The problem was that I encrypted the volumes before enabling FIPS. As garethTheRed alluded to in a comment, LUKS used a non FIPS approved algorithm, so when FIPS was enabled things went bonkers.

The solution is to

1. Enable FIPS
2. Encrypt volumes

In that order.

This guide was also useful in solving the problem. It is lengthy with extra explanation so I won't copy paste the full thing here. Here's the jist:

A. ENABLE FIPS

1. Check if FIPS is enabled using one of two methods:

   cat /proc/sys/crypto/fips_enabled
   0 = not enabled
   1 = enabled
   
   openssl md5 /any/file
   valid hash = not enabled
   "Error setting digest md5" = enabled (likely)
   

2. Check if you have prelinking turned on.

   vi /etc/sysconfig/prelink
   
   Change
   PRELINKING=yes
   to
   PRELINKING=no
   

3. Undo all current prelinking

   [root@centos64]# prelink -ua
   

4. Install dracut-fips

   [root@centos64]# yum install dracut-fips
   

5. Rebuild your initramfs

   [root@centos64]# dracut -f      
   

6. Find device path of /boot

   [root@centos64]# df /boot
   Filesystem     1K-blocks   Used Available Use% Mounted on
   /dev/sda2         487652 115447    346605  25% /boot
   

7. cp /etc/grub.conf /etc/grub.bak

8. Edit /etc/grub.conf

   Add in the "fips=1" and "boot=/dev/***" lines to the kernel command line 
   
   Example: 
   kernel /vmlinuz-2.6.32-358.el6.x86_64 ro root=/dev/mapper/vg_centos6464bittempl-lv_root rd_NO_LUKS KEYBOARDTYPE=pc KEYTABLE=us LANG=en_US.UTF-8 rd_LVM_LV=vg_centos6464bittempl/lv_swap rd_LVM_LV=vg_centos6464bittempl/lv_root rd_NO_MD crashkernel=auto SYSFONT=latarcyrheb-sun16 rd_NO_DM rhgb quiet fips=1 boot=/dev/sda2
   

9. Reboot

10. Check if FIPS is enabled (See Step 1 above).

B. ENCRYPT VOLUME

1. Are you sure FIPS is enabled? If not, do not proceed - go back to ENABLE FIPS and make sure that part is working before continuing...

2. Get the device path of the logical volume you wish to encrypt. In my example, this is /dev/mapper/vg_mybox-LogVol03

3. BACK UP ALL DATA ON THIS VOLUME. It will be DESTROYED.

4. umount volume.

   In my case, umount /db_fips

5. shred -v -n1 /dev/mapper/vg_mybox-LogVol03

6. Encrypt volume and set passphrase

   cryptsetup -v --verify-passphrase luksFormat /dev/mapper/vg_mybox-LogVol03
   

   NOTE: a RHEL minimal install may not include cryptsetup by default. Just yum install cryptsetup to get what you need. CentOS 6.7's minimal package set includes cryptsetup.

7. Open the device and alias it to “somename” of your choice (in this case, "db_fips")

   cryptsetup luksOpen /dev/mapper/vg_mybox-LogVol03 db_fips
   

8. Verify mapper has the path

   [root@centos64]# ls /dev/mapper/db_fips
   
   At this point, treat /dev/mapper/db_fips as you would any ordinary filesystem or device
   

9. Create filesystem as you normally would

   [root@centos64]# mkfs -t ext4 /dev/mapper/db_fips
   

10. Mount it and verify it

    [root@centos64]# mount /dev/mapper/db_fips /db_fips
    [root@centos64]# date >> /db_fips/today.txt
    

11. ¡¡¡IMPORTANT!!!: Comment out the existing /etc/fstab entry for the target volume, lest you have headaches on reboot. :-)

    vi /etc/fstab

    # /dev/mapper/vg_mybox-LogVol03 /some/path ext4 defaults 1,2

12. Reboot to ensure the steps above are working.

13. get UUID of encrypted volume

    blkid

    /dev/mapper/vg_mybox-LogVol03: UUID="2e52ffee-7a02-4c91-b6bf-223b05f90ded" TYPE="crypto_LUKS"

14. Add encrypted volume to /etc/crypttab - so it can be decrypted on boot. You can specify a passfile here, but it is not recommended. Install DRAC in the server if it is to be remotely administered (so you can enter the pass phrase during boot). crypttab man page

    [root@centos64]# vi /etc/crypttab
    
    db_fips UUID="2e52ffee-7a02-4c91-b6bf-223b05f90ded" 
    

15. Reboot to test.