Bug 2102774

Summary:	An amendment to crypto policy to set minimal RSA key bits for openssh
Product:	Red Hat Enterprise Linux 9	Reporter:	Dmitry Belyavskiy <dbelyavs>
Component:	crypto-policies	Assignee:	Alexander Sosedkin <asosedki>
Status:	CLOSED ERRATA	QA Contact:	Ondrej Moriš <omoris>
Severity:	medium	Docs Contact:	Jan Fiala <jafiala>
Priority:	medium
Version:	9.1	CC:	asosedki, jafiala, mhavrila, omoris
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	crypto-policies-20220815-1.git0fbe86f.el9	Doc Type:	Enhancement
Doc Text:	.`crypto-policies` enforce 2048-bit RSA key length minimum for OpenSSH by default Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting minimum RSA key length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-11-15 11:12:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2066882
Bug Blocks:

Description Dmitry Belyavskiy 2022-06-30 15:30:19 UTC

Description of problem: Bug https://bugzilla.redhat.com/show_bug.cgi?id=2066882 introduces a new option MinRSABits to manage the minimal key length allowed for RSA keys for signature and verification. We need to support this option in our CP.

Comment 1 Alexander Sosedkin 2022-06-30 15:55:12 UTC

I hear it as a request for just

--- a/python/policygenerators/openssh.py
+++ b/python/policygenerators/openssh.py
@@ -210,6 +210,8 @@ class OpenSSHGenerator(ConfigGenerator):
         if s:
             cfg += f'CASignatureAlgorithms {s}\n'

+        cfg += f"MinRSABits {policy.integers['min_rsa_size']}\n"
+
         return cfg

not counting the changes in tests / reference outputs.

But as that'd conflict with openssh that doesn't recognize the option,
I can't just push that, I'll have to know the version that supports it
and mind synchronizing these updates.

Comment 11 errata-xmlrpc 2022-11-15 11:12:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (crypto-policies bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8279