Bug 1732449

Summary:	rsa-sha2-*-cert-v01@openssh.com host key types are ignored in FIPS despite being in the policy
Product:	Red Hat Enterprise Linux 8	Reporter:	Ondrej Moriš <omoris>
Component:	openssh	Assignee:	Jakub Jelen <jjelen>
Status:	CLOSED ERRATA	QA Contact:	Ivan Nikolchev <inikolch>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.1	CC:	inikolch, tmraz
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.0
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openssh-8.0p1-3.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-05 22:42:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 1 Jakub Jelen 2019-07-23 13:33:42 UTC

The HostKeyAlgorithms client configuration option is not passed from crypto policies because of the previous issues (breaks order from the known_hosts). The bug here is in the fips patch in myproposal.h, which omits these two methods in FIPS mode. We should fix this in 8.1.

Comment 6 errata-xmlrpc 2019-11-05 22:42:07 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3702