From 408c7bb609fc905eb817417255b4c2e2f0f19173 Mon Sep 17 00:00:00 2001
From: Jan Kratochvil <jan.kratochvil@redhat.com>
Date: Nov 20 2020 21:39:49 +0000
Subject: F-33 release notes: CentOS-7 Dovecot key is fixed in 7.9.


---

diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc
index 714ca1d..23a51c1 100644
--- a/modules/release-notes/pages/sysadmin/Security.adoc
+++ b/modules/release-notes/pages/sysadmin/Security.adoc
@@ -42,12 +42,12 @@ If you want to communicate with legacy systems, you may:
     PubkeyAcceptedKeyTypes ssh-rsa
 ----
 
-* For RHEL-7/CentOS-7 Dovecot set in /etc/pki/dovecot/dovecot-openssl.cnf:
+* For Dovecot in RHEL/CentOS up to 7.8 (it is fixed in 7.9) set in /etc/pki/dovecot/dovecot-openssl.cnf:
 
 [source,shell]
 ----
 [ req ]
-default_bits = 2048
+default_bits = 3072
 ----
 
 * The most secure method is to use Elliptic Curve Digital Signature Algorithm (ECDSA) to generate new ssh keys, as the methods above override Fedora 33 new crypto polices rendering your system vulnerable.