[release-notes] 01/01: OpenSSH crypto policy

This is an automated email from the git hooks/post-receive script. immanetize pushed a commit to branch f26 in repository release-notes. commit 78c0cbc3b67c13d4426b613d96f8fdfef46e9cbe Author: Pete Travis <immanetize(a)fedoraproject.org&gt; Date: Fri Jun 30 18:03:32 2017 -0500 OpenSSH crypto policy --- en-US/Security.xml | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/en-US/Security.xml b/en-US/Security.xml index ca9d179..e149478 100644 --- a/en-US/Security.xml +++ b/en-US/Security.xml @@ -6,5 +6,30 @@ <section id="sect-security"> <title>Security</title> - <para /> + <section id="security-crypto"> + <title>System-wide Crypto Policy</title> + <para> + The security of network communications is a high priority for the Fedora project, with strong TLS providing the first line + of defense against traffic inspection. Two systems negotiating a TLS connection must agree on a common cipher to encrypt their + communications, and as ciphers become deprecated, it is important to exclude them. + </para> + <para> + The ciphers that an administrator might consider adequately secure are determined by vulnerabilities published against specific + ciphers. The acceptable cipher suite applies to all communications on the internet, and is not specific to any one system or daemon. + To ease administration and increase adminsitrator confidence in the system's security posture, Fedora has been configuring various software + to use a system-global configuration so that TLS ciphers need only be updated in one place. + </para> + <para> + With Fedora 26, two more things will use the system-wide crypto policy, <systemitem>OpenSSH</systemitem> and <systemitem>Java</systemitem>. + </para> + <formalpara> + <title>OpenSSH Crypt</title> + <para> + OpenSSH clients will use system preferred key exchange algorithms, encryption ciphers, and message authentication code (MAC) algorithms. + This is enabled by an <literal>Include</literal> directive in <filename>/etc/ssh/ssh_config</filename> to include directives in + <filename>/etc/ssh/ssh_config.d/*.conf</filename>, which pulls in <filename>/etc/crypto-policies/back-ends/openssh.config</filename>. + </para> + </formalpara> + + </section> </section> -- To stop receiving notification emails like this one, please contact the administrator of this repository.