[freeipa PR#3357][opened] Don't configure disabled krb5 enctypes in FIPS mode
by rcritten
URL: https://github.com/freeipa/freeipa/pull/3357
Author: rcritten
Title: #3357: Don't configure disabled krb5 enctypes in FIPS mode
Action: opened
PR body:
"""
The only permitted ciphers are the AES family (called aes, which
is the combination of: aes256-cts-hmac-sha1-96,
aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and
aes128-cts-hmac-sha256-128).
DES, RC4, and Camellia are not permitted in FIPS mode. While 3DES
is permitted, the KDF used for it in krb5 is not, and Microsoft
doesn't implement 3DES anyway.
This is only applied on new installations because we don't
allow converting a non-FIPS install into a FIPS one.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3357/head:pr3357
git checkout pr3357
4 years, 9 months
FreeIPA 4.8.0 release notes draft
by Alexander Bokovoy
Hi,
I've loaded the draft of 4.8.0 release notes to https://www.freeipa.org/page/Releases/4.8.0
We need to add more substance to the highlights, enhancements, known
issues, and bugfixes. Please help me by going through the tickets you
worked on and by adding some details to the sections of the wiki.
I'm planning to complete the release tomorrow (Tuesday) morning European
time.
Thanks in advance!
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
4 years, 9 months
[freeipa PR#3350][opened] Use only TLS 1.2 by default
by tiran
URL: https://github.com/freeipa/freeipa/pull/3350
Author: tiran
Title: #3350: Use only TLS 1.2 by default
Action: opened
PR body:
"""
TLS 1.3 is causing some trouble with client cert authentication.
Conditional client cert authentication requires post-handshake
authentication extension on TLS 1.3. The new feature is not fully
implemented yet.
TLS 1.0 and 1.1 are no longer state of the art and now disabled by
default.
TLS 1.2 works everywhere and supports PFS.
Related: pagure.io/freeipa/issue/7667
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3350/head:pr3350
git checkout pr3350
4 years, 9 months