Bug 2134436
| Summary: | [RFE] Let Apache adhere to system crypto policies | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Ganesh Payelkar <gpayelka> |
| Component: | Installation | Assignee: | Ewoud Kohl van Wijngaarden <ekohlvan> |
| Status: | CLOSED ERRATA | QA Contact: | Griffin Sullivan <gsulliva> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.11.3 | CC: | ahumbe, dsinglet, ehelms, ekohlvan, gsulliva, pdudley |
| Target Milestone: | 6.14.0 | Keywords: | FutureFeature, Triaged |
| Target Release: | Unused | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-08 14:18:02 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Ganesh Payelkar
2022-10-13 12:24:47 UTC
Upstream bug assigned to ekohlvan Upstream bug assigned to ekohlvan Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/35629 has been resolved. Verified on stream snap Satellite is adhering to custom system policies. Steps: 1) Follow documentation for customizing system wide cryptographic policies with sub-policies: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#customizing-system-wide-cryptographic-policies-with-subpolicies_using-the-system-wide-cryptographic-policies Results: # cat /etc/crypto-policies/state/CURRENT.pol | grep rsa_size min_rsa_size = 3072 # nmap --script ssl-enum-ciphers localhost -p 443 Starting Nmap 7.70 ( https://nmap.org ) at 2023-05-15 12:01 EDT Nmap scan report for localhost (127.0.0.1) Host is up (0.00014s latency). Other addresses for localhost (not scanned): ::1 PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A | TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 4096) - A | TLS_RSA_WITH_AES_256_CCM (rsa 4096) - A | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 4096) - A | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 4096) - A | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 4096) - A | TLS_DHE_RSA_WITH_AES_256_CCM (dh 4096) - A | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 4096) - A | TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 4096) - A | compressors: | NULL | cipher preference: server | warnings: | Key exchange (ecdh_x25519) of lower strength than certificate key |_ least strength: A Nmap done: 1 IP address (1 host up) scanned in 0.59 seconds Not writing a new test for this BZ as it has more to do with RHEL and Insights than Satellite itself. The changes made were to have Satellite follow the system's settings for crypto policies. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: Satellite 6.14 security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:6818 |