From fead30b808a8d14d8d018e6cbb736854cc39c75a Mon Sep 17 00:00:00 2001 From: JackieBinya Date: Oct 29 2020 23:23:56 +0000 Subject: [PATCH 1/3] Adds Crypto Settings release note --- diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc index 0ee01a6..4bc8b42 100644 --- a/modules/release-notes/pages/sysadmin/Security.adoc +++ b/modules/release-notes/pages/sysadmin/Security.adoc @@ -13,3 +13,35 @@ PARSEC serves as an abstraction layer that keeps workloads decoupled from physic After users install the PARSEC stack on Fedora Workstation edition, the PARSEC daemon will automatically start during the early boot process. On Fedora IoT edition, the stack installation and start of the daemon is done by the OS itself. From a hardware perspective, the PARSEC daemon can currently use a Trusted Platform Module 2 (TPM2) chip, Hardware Security Module (HSM) device, or systems that have an Arm TrustZone technology enabled. + + +== Strong Crypto Settings - Phase 2 + +Fedora 33 disables: + +* TSL Protocols versions older than 1.2 version, so TSL versions 1.0 and 1.1 are now disabled by default. +* SHA hash signatures in TLS, SSH and IKE protocols. +* Diffie Hellman key exchange with parameter size less that 2048 bits. + +As a result Fedora 33 cannot communicate with legacy systems that support all the disabled entities which are outlined above. + +If you want to communicate with legacy systems, you may: + +* Set the system wide crypto policy to LEGACY, by using the command below: + +[source,shell] +---- +# update-crypto-policies --set LEGACY +---- + +* Or add the snippet below to your ssh config file (~/.ssh/config) + +[source,shell] +---- +# Host + PubkeyAcceptedKeyTypes ssh-rsa +---- + +* The most secure method is to use Elliptic Curve Digital signature Algorithm (ECDSA) to generate your ssh keys, as the methods above override Fedora 33 new crypto polices rendering your system vulnerable. + + From b11a6c9f0592408c69ca723a2a50d2a5046d501d Mon Sep 17 00:00:00 2001 From: JackieBinya Date: Oct 29 2020 23:30:00 +0000 Subject: [PATCH 2/3] Fixes typo --- diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc index 4bc8b42..6ff7db3 100644 --- a/modules/release-notes/pages/sysadmin/Security.adoc +++ b/modules/release-notes/pages/sysadmin/Security.adoc @@ -42,6 +42,6 @@ If you want to communicate with legacy systems, you may: PubkeyAcceptedKeyTypes ssh-rsa ---- -* The most secure method is to use Elliptic Curve Digital signature Algorithm (ECDSA) to generate your ssh keys, as the methods above override Fedora 33 new crypto polices rendering your system vulnerable. +* The most secure method is to use Elliptic Curve Digital signature Algorithm (ECDSA) to generate new ssh keys, as the methods above override Fedora 33 new crypto polices rendering your system vulnerable. From ab8eb39c0e1d8589a9dd1ed546d5c7d3d966170a Mon Sep 17 00:00:00 2001 From: JackieBinya Date: Oct 30 2020 09:15:36 +0000 Subject: [PATCH 3/3] Fixes wording --- diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc index 6ff7db3..1459d25 100644 --- a/modules/release-notes/pages/sysadmin/Security.adoc +++ b/modules/release-notes/pages/sysadmin/Security.adoc @@ -42,6 +42,6 @@ If you want to communicate with legacy systems, you may: PubkeyAcceptedKeyTypes ssh-rsa ---- -* The most secure method is to use Elliptic Curve Digital signature Algorithm (ECDSA) to generate new ssh keys, as the methods above override Fedora 33 new crypto polices rendering your system vulnerable. +* The most secure method is to use Elliptic Curve Digital Signature Algorithm (ECDSA) to generate new ssh keys, as the methods above override Fedora 33 new crypto polices rendering your system vulnerable.