Revision as of 15:20, 16 December 2015

Crypto policy support for Kerberos

Summary

Fedora supports a system wide crypto policy and Kerberos (libkrb5) should respect that policy and adjust its crypto-related configuration based on it.

Owner

Name: Nikos Mavrogiannopoulos
Email: <nmav@redhat.com>
Release notes owner:

Current status

Targeted release: Fedora 24
Last updated: 2015-12-16
Tracker bug: <will be assigned by the Wrangler>

Detailed Description

Fedora supports a system wide crypto policy and Kerberos should respect that policy and adjust its crypto-related configuration based on it.

As it is now kerberos' configuration is hard coded and the administrator is responsible for doing any changes to it. In case of software upgrades he's tasked to keep up-to-date the list of ciphers allowed, modify the cryptographic parameters etc. Kerberos following the system-wide crypto policy by default would simplify the tasks of the administrator and reduce errors due to not disabling an insecure cipher or enabling incorrect crypto settings. That way unless the administrator changes the configuration the policies the Kerberos configuration will be kept up to date and will be consistent with the policies followed in other parts of the system.

Benefit to Fedora

An administrator using fedora would have simpler tasks as he would not be required to review configuration settings as recommended by: https://bettercrypto.org/static/applied-crypto-hardening.pdf (for the Kerberos part at least).

Scope

Proposal owners:

The libkrb5 (kerberos) configuration should be able to include an external part generated by the crypto policies package. This is tracked in bugzilla.

Other developers: N/A (not a System Wide Change)

Release engineering: N/A (not a System Wide Change)
- List of deliverables: N/A (not a System Wide Change)

Policies and guidelines: N/A (not a System Wide Change)

Trademark approval: N/A (not needed for this Change)