Bug 1109114

Summary:	Use the system crypto policy unless otherwise specified
Product:	[Fedora] Fedora	Reporter:	Nikos Mavrogiannopoulos <nmavrogi>
Component:	dovecot	Assignee:	Michal Hlavinka <mhlavink>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	22	CC:	janfrode, mhlavink
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	dovecot-2.2.18-4.fc22	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-12-08 14:18:33 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1179209

Description Nikos Mavrogiannopoulos 2014-06-13 09:33:48 UTC

Please convert to use the system's crypto policy for SSL and TLS:
https://fedoraproject.org/wiki/Changes/CryptoPolicy#Scope

If this program is compiled against gnutls, change the default priority string to be "@SYSTEM" or to use gnutls_set_default_priority().

If this program is compiled against openssl, and there is no default cipher list specified, you don't need to modify it. Otherwise replace the default cipher list with "PROFILE=SYSTEM".

If this program obtains its cipher list (or priority) using a configuration file, please update the shipped configuration files with the appropriate string that sets the system policy.

In all cases verify (as described in the URL above) that the application uses the system's crypto profiles.

Please contact me for any questions.

Comment 1 Nikos Mavrogiannopoulos 2014-07-04 10:57:38 UTC

A quick reminder; this is a blocker for #1076390. if you have no resources to pursue that please contact me.

Comment 2 Nikos Mavrogiannopoulos 2014-08-08 13:24:16 UTC

Any update on this issue?

Comment 3 Michal Hlavinka 2014-08-08 14:11:06 UTC

Not yet. 
As I understand it, given the configuration, it should be enough to change /etc/dovecot/conf.d/10-ssl.conf ssl_cipher_list to PROFILE=SYSTEM.

I've tried that together with changig system configuration from legacy to future, but it changed nothing. I did not yet have the time to investigate why nothing happened.

Comment 4 Nikos Mavrogiannopoulos 2014-09-11 10:07:46 UTC

Hi, is there any way I can help to speed that up?

Comment 5 Nikos Mavrogiannopoulos 2014-10-27 15:01:46 UTC

No longer blocks the Fedora change. However, the packet needs to be updated to adhere to the policy anyway.

Comment 6 Jaroslav Reznik 2015-03-03 16:01:43 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle.
Changing version to '22'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22

Comment 7 Nikos Mavrogiannopoulos 2015-07-09 14:57:36 UTC

(In reply to Michal Hlavinka from comment #3)
> Not yet. 
> As I understand it, given the configuration, it should be enough to change
> /etc/dovecot/conf.d/10-ssl.conf ssl_cipher_list to PROFILE=SYSTEM.
> 
> I've tried that together with changig system configuration from legacy to
> future, but it changed nothing. I did not yet have the time to investigate
> why nothing happened.

When you change the system policy you need to run update-crypto-policies.
What is the blocker for that issue?

Comment 8 Michal Hlavinka 2015-08-24 15:38:52 UTC

Fixed in
dovecot-2.2.18-4.fc22
dovecot-2.2.18-5.fc23
dovecot-2.2.18-5.fc24

Comment 9 Nikos Mavrogiannopoulos 2015-08-24 15:40:10 UTC

Thanks.