System wide crypto policy

389ds / 389-ds-base

The enterprise-class Open Source LDAP server for Linux

https://www.port389.org/

Other

211 stars 90 forks source link

System wide crypto policy #1845

Open 389-ds-bot opened 4 years ago

389-ds-bot commented 4 years ago

Cloned from Pagure issue: https://pagure.io/389-ds-base/issue/48785

Created at 2016-04-04 06:32:43 by firstyear (@Firstyear)
Assigned to mhonek (@kenoh)

https://fedoraproject.org/wiki/Changes/CryptoPolicy

We should be able to support the system wide crypto policy in DS. This should be able to apply to the listening tls sockets, and for the available routines to outbound connections.

389-ds-bot commented 4 years ago

Comment from firstyear (@Firstyear) at 2017-02-11 23:09:19

Metadata Update from @Firstyear:

Issue set to the milestone: FUTURE

389-ds-bot commented 4 years ago

Comment from firstyear (@Firstyear) at 2017-04-05 06:13:42

Metadata Update from @Firstyear:

Issue assigned to Firstyear

389-ds-bot commented 4 years ago

Comment from firstyear (@Firstyear) at 2017-11-27 09:11:39

Metadata Update from @Firstyear:

Custom field reviewstatus adjusted to None
Issue assigned to kenoh (was: Firstyear)
Issue close_status updated to: None

389-ds-bot commented 4 years ago

Comment from mhonek (@kenoh) at 2019-03-06 16:27:59

Metadata Update from @kenoh:

Issue tagged with: Security

389-ds-bot commented 4 years ago

Comment from mhonek (@kenoh) at 2020-04-29 16:09:35

Suggestions for how to achieve this:

Deprecate allowweakciphers – default ciphers should be always good.
Fix logic around tlsversion – use SSL_VersionRangeGet{Default,Supported}, do not force, warn if out of default, and err if out of supported.
User-requested ciphers – check against default and warn if out of it.

Outbound connections should be fine since it seems we don't set ciphers at all for them (so defaults according to policy apply), and the TLS version min. is inherited from our cn=config sslVersionMin.

389-ds-bot commented 4 years ago

Comment from mreynolds (@mreynolds389) at 2020-04-29 16:27:05

Metadata Update from @mreynolds389:

Issue set to the milestone: 1.4.5 (was: FUTURE)

389-ds-bot commented 4 years ago

Comment from mreynolds (@mreynolds389) at 2020-04-29 16:30:32

Metadata Update from @mreynolds389:

Issue set to the milestone: 1.4.3 (was: 1.4.5)

tbordaz commented 3 years ago

@mreynolds389 should not be only be done in 2.0