Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Backport][ipa-4-7] do not use RC4 in FIPS mode #2244

Closed
wants to merge 2 commits into from
Closed

[Backport][ipa-4-7] do not use RC4 in FIPS mode #2244

wants to merge 2 commits into from

Conversation

Tiboris
Copy link
Member

@Tiboris Tiboris commented Aug 13, 2018

This PR was opened automatically because PR #2228 was pushed to master and backport to ipa-4-7 is required.

@abbra @Tiboris
Move fips_enabled to a common library to share across different plugins
9beac52 
Related: https://pagure.io/freeipa/issue/7659
@abbra @Tiboris
ipasam: do not use RC4 in FIPS mode
2a473e2 
When creating Kerberos keys for trusted domain object account, ipasam
module requests to generate keys using a series of well-known encryption
types. In FIPS mode it is not possible to generate RC4-HMAC key:
MIT Kerberos is using openssl crypto backend and openssl does not allow
use of RC4 in FIPS mode.

Thus, we have to filter out RC4-HMAC encryption type when running in
FIPS mode. A side-effect is that a trust to Active Directory running
with Windows Server 2003 will not be possible anymore in FIPS mode.

Resolves: https://pagure.io/freeipa/issue/7659
@Tiboris
Copy link
Member Author

Tiboris commented Aug 13, 2018

PR was ACKed automatically because this is backport of PR #2228. Wait for CI to finish before pushing. In case of questions or problems contact @abbra who is author of the original PR.

@Tiboris Tiboris added ack Pull Request approved, can be merged pushed Pull Request has already been pushed labels Aug 13, 2018
@Tiboris
Copy link
Member Author

Tiboris commented Aug 13, 2018

ipa-4-7:

  • 5e8bc96 Move fips_enabled to a common library to share across different plugins
  • 04c5798 ipasam: do not use RC4 in FIPS mode

@Tiboris Tiboris closed this Aug 13, 2018
@Tiboris Tiboris deleted the backport_pr2228_ipa-4-7 branch July 2, 2019 13:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
ack Pull Request approved, can be merged pushed Pull Request has already been pushed
Projects
None yet
Milestone
No milestone
2 participants
@Tiboris @abbra