Back to bug 1851442
| Who | When | What | Removed | Added |
|---|---|---|---|---|
| Red Hat Bugzilla | 2020-06-26 14:10:29 UTC | Pool ID | sst_identity_management_rhel_8 | |
| Andreas Schneider | 2020-06-26 14:11:15 UTC | CC | asn | |
| Andreas Schneider | 2020-06-26 14:12:03 UTC | Priority | unspecified | high |
| Status | NEW | ASSIGNED | ||
| Severity | unspecified | high | ||
| Alexander Bokovoy | 2020-06-26 15:02:20 UTC | Depends On | 1851458 | |
| Denis Karpelevich | 2020-06-30 19:10:44 UTC | CC | dkarpele | |
| Robbie Harwood | 2020-07-01 21:26:13 UTC | CC | rharwood | |
| Filip Hanzelka | 2020-07-11 12:53:39 UTC | CC | fhanzelk | |
| Filip Hanzelka | 2020-07-16 08:07:07 UTC | Flags | needinfo?(asn) | |
| Andreas Schneider | 2020-07-27 09:19:27 UTC | Flags | needinfo?(asn) | |
| Filip Hanzelka | 2020-07-27 10:30:46 UTC | Doc Text | .`krb5` now only requests permitted encryption types Previously, permitted encryption types specified in the `permitted_enctypes` variable in the `/etc/krb5.conf` file did not apply to the default encryption types if the `default_tgs_enctypes` or `default_tkt_enctypes` attributes were not set. Consequently, Kerberos clients were able to request deprecated cipher suites like RC4, which may cause other processes to fail. With this update, encryption types specified in the `permitted_enctypes` variable apply to the default encryption types as well, and only permitted encryption types are requested. The RC4 cipher suite, which has been deprecated in RHEL 8, is the default encryption type for users, services, and trusts between Active Directory (AD) domains in an AD forest. * To ensure support for strong AES encryption types between AD domains in an AD forest, see the link:https://support.microsoft.com/en-us/help/4492348/kerberos-unsupported-etype-error-when-authenticating-across-trust[AD DS: Security: Kerberos "Unsupported etype" error when accessing a resource in a trusted domain] Microsoft article. * To enable support for the deprecated RC4 encryption type on a domain member for backwards compatibility with AD, use the `update-crypto-policies --set DEFAULT:AD-SUPPORT` command. | |
| Doc Type | If docs needed, set a value | Bug Fix | ||
| Andreas Schneider | 2020-07-27 11:26:02 UTC | Doc Text | .`krb5` now only requests permitted encryption types Previously, permitted encryption types specified in the `permitted_enctypes` variable in the `/etc/krb5.conf` file did not apply to the default encryption types if the `default_tgs_enctypes` or `default_tkt_enctypes` attributes were not set. Consequently, Kerberos clients were able to request deprecated cipher suites like RC4, which may cause other processes to fail. With this update, encryption types specified in the `permitted_enctypes` variable apply to the default encryption types as well, and only permitted encryption types are requested. The RC4 cipher suite, which has been deprecated in RHEL 8, is the default encryption type for users, services, and trusts between Active Directory (AD) domains in an AD forest. * To ensure support for strong AES encryption types between AD domains in an AD forest, see the link:https://support.microsoft.com/en-us/help/4492348/kerberos-unsupported-etype-error-when-authenticating-across-trust[AD DS: Security: Kerberos "Unsupported etype" error when accessing a resource in a trusted domain] Microsoft article. * To enable support for the deprecated RC4 encryption type on a domain member for backwards compatibility with AD, use the `update-crypto-policies --set DEFAULT:AD-SUPPORT` command. | .`krb5` now only requests permitted encryption types Previously, permitted encryption types specified in the `permitted_enctypes` variable in the `/etc/krb5.conf` file did not apply to the default encryption types if the `default_tgs_enctypes` or `default_tkt_enctypes` attributes were not set. Consequently, Kerberos clients were able to request deprecated cipher suites like RC4, which may cause other processes to fail. With this update, encryption types specified in the `permitted_enctypes` variable apply to the default encryption types as well, and only permitted encryption types are requested. The RC4 cipher suite, which has been deprecated in RHEL 8, is the default encryption type for users, services, and trusts between Active Directory (AD) domains in an AD forest. * To ensure support for strong AES encryption types between AD domains in an AD forest, see the link:https://support.microsoft.com/en-us/help/4492348/kerberos-unsupported-etype-error-when-authenticating-across-trust[AD DS: Security: Kerberos "Unsupported etype" error when accessing a resource in a trusted domain] Microsoft article. * To enable support for the deprecated RC4 encryption type on a Domain Member for backwards compatibility with AD, use the `update-crypto-policies --set DEFAULT:AD-SUPPORT` command. |
| Lucie Vařáková | 2020-07-27 13:47:14 UTC | CC | lmanasko | |
| Docs Contact | fhanzelk | |||
| Namita Soman | 2020-07-28 13:50:00 UTC | CC | nsoman | |
| Red Hat One Jira (issues.redhat.com) | 2020-11-04 19:45:23 UTC | Link ID | Red Hat Issue Tracker - Private RHELPLAN-47648 | |
| RHEL Program Management | 2020-11-13 16:21:37 UTC | Keywords | Triaged | |
| PnT Account Manager | 2021-01-04 07:33:36 UTC | CC | iboukris | |
| Tomas Halman | 2021-02-09 08:24:37 UTC | Link ID | Red Hat Issue Tracker - Private SSSD-3188 | |
| Filip Dvorak | 2021-03-16 15:20:13 UTC | QA Contact | idmafs-qe | sssd-qe |
| Kaushik Banerjee | 2021-04-13 10:48:27 UTC | Pool ID | sst_identity_management_rhel_8 | sst_idm_sssd_rhel_8 |
| Denis Karpelevich | 2021-06-09 12:08:00 UTC | QA Contact | sssd-qe | dkarpele |
| Andreas Schneider | 2021-06-17 13:42:11 UTC | Sub Component | default | |
| Pool ID | sst_idm_sssd_rhel_8 | sst_ccs_rhel_8 | ||
| CC | mmuehlfe, rhel-docs | |||
| Component | samba | Documentation | ||
| Docs Contact | fhanzelk | |||
| Assignee | asn | rhel-docs | ||
| QA Contact | dkarpele | |||
| Tomas Capek | 2021-06-23 10:14:47 UTC | Keywords | Documentation | |
| CC | tcapek | |||
| Assignee | rhel-docs | sdubewar | ||
| Tomas Capek | 2021-06-24 08:31:11 UTC | Target Release | 8.0 | 8.5 |
| Marc Muehlfeld | 2021-06-28 08:39:18 UTC | Assignee | sdubewar | mmuehlfe |
| Flags | needinfo?(asn) | |||
| Andreas Schneider | 2021-07-14 08:44:37 UTC | Status | ASSIGNED | CLOSED |
| Resolution | --- | CURRENTRELEASE | ||
| Flags | needinfo?(asn) | |||
| Last Closed | 2021-07-14 08:44:37 UTC |
Back to bug 1851442