freeipa

#9119 KRB instance: make provision to work with crypto policy without SHA-1 HMAC types
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

RHEL 9 system-wide crypto policies aim at eventual removal of SHA-1 use.

Due to bootstrapping process, force explicitly supported encryption types in kdc.conf or we may end up with AES128-CTS and AES256-CTS only in FIPS mode at bootstrap time which then fails to initialize kadmin principals requiring use of AES256-SHA2 and AES128-SHA2.

Camellia ciphers must be filtered out in FIPS mode, we do that already in the kerberos.ldif but if supported_enctypes is to be set explicitly, they need to be removed here as well.

PR: https://github.com/freeipa/freeipa/pull/6197

Note that switching master key to aes256-sha2 is not possible as we don't know in case of a replica what would be a master key encryption type on the master before creating the configuration files.

A process to upgrade master key encryption type is described at http://web.mit.edu/kerberos/krb5-latest/doc/admin/advanced/retiring-des.html (replace DES by any other encryption type) and is multi-step and non-trivial. We would need to make it easier before attempting to switch to the aes256-sha2 directly.

master:

  • d38dd2680fb828da4b36e8eb4ce8dc8b056491ce KRB instance: make provision to work with crypto policy without SHA-1 HMAC types
  • 2eee5931d714ca237290be7dc2fb7233ce747eca tests: ensure AD-SUPPORT subpolicy is active
  • 985dffe147501e1b9cba3ab0be378115a23c3564 ipatests: extend AES keyset to SHA2-based ones
  • 7d25eead994715b98f5dea5679c8fee0db4c4494 freeipa.spec: bump crypto-policies dependency for CentOS 9 Stream

ipa-4-9:

  • a51900819bd5332bc05ec9d513f062844b3a7763 KRB instance: make provision to work with crypto policy without SHA-1 HMAC types
  • b016683552a58f9cc2a05cf628cc467234eaf599 tests: ensure AD-SUPPORT subpolicy is active
  • 49d9147e38c5b50c52a1ebc7283753c779c2f81f ipatests: extend AES keyset to SHA2-based ones
  • ee39de46a1c1ea96bbe524f159ae435319b2d072 freeipa.spec: bump crypto-policies dependency for CentOS 9 Stream

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Issue status updated to: Open (was: Closed)

Issue linked to bug https://bugzilla.redhat.com/show_bug.cgi?id=2057471

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2057471

master:

  • a6030f5f53e077a0443605fba23ef104c797f168 Kerberos instance: default to AES256-SHA2 for master key encryption
  • 621af275c3564f1d5f1a97c46290b5d166fe8c8a test_otp: do not use paramiko unless it is really needed
  • 517ae594e1ad80598a154f1dcacf7b303f420fc8 test_krbtpolicy: skip SPAKE-related tests in FIPS mode

ipa-4-9:

  • 3e54c4362490b4da1b6cb3e141bb6e08fecc58c0 Kerberos instance: default to AES256-SHA2 for master key encryption
  • 3baae8d1bd0a0c4c707314524289e86e6ecbc0df test_otp: do not use paramiko unless it is really needed
  • 2e70535f74e7d9dd76e728eca1119ce522fd138a test_krbtpolicy: skip SPAKE-related tests in FIPS mode

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 5a42ab115e85698866219e3edc98ceaf439bab55 tests: ensure AD-SUPPORT subpolicy is active in more cases

ipa-4-9:

  • 09481117b58f1a237bb1048d3fe8d44caf9e167f tests: ensure AD-SUPPORT subpolicy is active in more cases
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.