This issue tracks the release note for the following Fedora Change:
https://fedoraproject.org/wiki/Changes/OpenSSH_Server_Crypto_Policy - @jjelen
If you own this change, please add additional information here that we should communicate to Fedora users. Specifically, please consider:
Your notes to us do not need to be formally written. We will edit them and add details as needed. This is a way for you to ensure that we know what is critical about your change.
If you want to write this release note, then:
Once you're done with the above, make sure to either commit the relnote to an appropriate section of the Release Notes book, or, if you're not familiar with Git, AsciiDoc, or whatever else, just add it to this issue as a comment and let pbokoc[1] know that you're done with this one and you'd like the note included. Be sure to do this at least one day before the final release (October 29 according to the current schedule). Also make sure to do this even for relnotes that haven't been checked by the change owner.
[0] You can do that by asking the change owner listed on the wiki page; alternatively you can infer it by checking the tracker bug (linked in Wiki) in Bugzilla and looking at its status; see bug comments for details. Ask someone on the mailing list or on IRC if you're not sure. [1] In #fedora-docs on FreeNode (UTC+1 timezone, online mostly during the day on weekdays), or pbokoc @redhat.com if you can't get a hold of me on IRC.
Metadata Update from @rkratky: - Issue assigned to rkratky
@jjelen, could you please have a look at the following text for this RN:
OpenSSH Server now follows system-wide crypto policies
Fedora defines system-wide crypto policies, which are followed by cryptographic libraries and tools, including OpenSSH clients. This allows administrators to use different system-wide security levels. With this update, OpenSSH Server adheres to these system-wide crypto policies, too.
This modification is implemented using a script, which places configuration generated according to currently defined crypto policies into the OpenSSH Server's configuration file. The script is executed by systemd when the sshd service is started. It is, therefore, necessary to restart the sshd service for changes to crypto-policy configuration to take effect.
sshd
Sorry for a confusion. This got changed and I forgot to make sure it was up to date in all the places of the wiki. So the last paragraph does not apply anymore. It should say something like this:
The modification adds environment variables that are passed to sshd daemon on commandline specifying enabled algorithms. It is, therefore, necessary to restart the sshd service for changes to crypto-policy configuration to take effect.
Thanks, I updated the text.
Metadata Update from @rkratky: - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.