Bug 2102774
| Summary: | An amendment to crypto policy to set minimal RSA key bits for openssh | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Dmitry Belyavskiy <dbelyavs> |
| Component: | crypto-policies | Assignee: | Alexander Sosedkin <asosedki> |
| Status: | CLOSED ERRATA | QA Contact: | Ondrej Moriš <omoris> |
| Severity: | medium | Docs Contact: | Jan Fiala <jafiala> |
| Priority: | medium | ||
| Version: | 9.1 | CC: | asosedki, jafiala, mhavrila, omoris |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | crypto-policies-20220815-1.git0fbe86f.el9 | Doc Type: | Enhancement |
| Doc Text: |
.`crypto-policies` enforce 2048-bit RSA key length minimum for OpenSSH by default
Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting minimum RSA key length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default.
If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys.
Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`:
. Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file.
. Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-15 11:12:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2066882 | ||
| Bug Blocks: | |||
|
Description
Dmitry Belyavskiy
2022-06-30 15:30:19 UTC
I hear it as a request for just
--- a/python/policygenerators/openssh.py
+++ b/python/policygenerators/openssh.py
@@ -210,6 +210,8 @@ class OpenSSHGenerator(ConfigGenerator):
if s:
cfg += f'CASignatureAlgorithms {s}\n'
+ cfg += f"MinRSABits {policy.integers['min_rsa_size']}\n"
+
return cfg
not counting the changes in tests / reference outputs.
But as that'd conflict with openssh that doesn't recognize the option,
I can't just push that, I'll have to know the version that supports it
and mind synchronizing these updates.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (crypto-policies bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8279 |