[release-notes] 01/01: OpenSSH crypto policy
by git repository hosting
This is an automated email from the git hooks/post-receive script.
immanetize pushed a commit to branch f26
in repository release-notes.
commit 78c0cbc3b67c13d4426b613d96f8fdfef46e9cbe
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Fri Jun 30 18:03:32 2017 -0500
OpenSSH crypto policy
---
en-US/Security.xml | 27 ++++++++++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
diff --git a/en-US/Security.xml b/en-US/Security.xml
index ca9d179..e149478 100644
--- a/en-US/Security.xml
+++ b/en-US/Security.xml
@@ -6,5 +6,30 @@
<section id="sect-security">
<title>Security</title>
- <para />
+ <section id="security-crypto">
+ <title>System-wide Crypto Policy</title>
+ <para>
+ The security of network communications is a high priority for the Fedora project, with strong TLS providing the first line
+ of defense against traffic inspection. Two systems negotiating a TLS connection must agree on a common cipher to encrypt their
+ communications, and as ciphers become deprecated, it is important to exclude them.
+ </para>
+ <para>
+ The ciphers that an administrator might consider adequately secure are determined by vulnerabilities published against specific
+ ciphers. The acceptable cipher suite applies to all communications on the internet, and is not specific to any one system or daemon.
+ To ease administration and increase adminsitrator confidence in the system's security posture, Fedora has been configuring various software
+ to use a system-global configuration so that TLS ciphers need only be updated in one place.
+ </para>
+ <para>
+ With Fedora 26, two more things will use the system-wide crypto policy, <systemitem>OpenSSH</systemitem> and <systemitem>Java</systemitem>.
+ </para>
+ <formalpara>
+ <title>OpenSSH Crypt</title>
+ <para>
+ OpenSSH clients will use system preferred key exchange algorithms, encryption ciphers, and message authentication code (MAC) algorithms.
+ This is enabled by an <literal>Include</literal> directive in <filename>/etc/ssh/ssh_config</filename> to include directives in
+ <filename>/etc/ssh/ssh_config.d/*.conf</filename>, which pulls in <filename>/etc/crypto-policies/back-ends/openssh.config</filename>.
+ </para>
+ </formalpara>
+
+ </section>
</section>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.