News for hackers. Stuff that matters.

A comment on Red Hat cutting back RHEL source availability. Parent comment

Re:Red Hat cutting back RHEL source availability by ilyt on Wednesday June 21, 2023 @04:49PM (#36424231)
RHEL also introduced some.... interesting changes few times, like re-enabling ciphers removed from upstreams because their clients needed them for something.

I remember our amazement on how we failed audit on having a cipher enabled in OpenSSH version that had that cipher removed in upstream...

[ Parent | on HN ]
Re:Red Hat cutting back RHEL source availability by cookiengineer on Thursday June 22, 2023 @04:05AM (#36429279)
I always have to chuckle a little when git tells me that Azure DevOps is too unsecure to connect to because of a deprecated cipher they still use today :D

Losely related: I've audited so many BSD instances that were using MD4/NTHASH in their passwd and shadow files because they wanted to keep compatibility with their Windows infrastructure... it's stunning to see what is still possible in terms of misconfigurations. Things that should have been removed a long time ago.

[ Parent | on HN ]
Re:Red Hat cutting back RHEL source availability by yrro on Monday June 26, 2023 @07:16AM (#36478224)
The neat thing about RHEL is that there's a single 'crypto-policies' package which configures available TLS versions and algorithms for everything in the system: TLS, SSH, IPSec, DNSSEC, Kerberos and so on.

Regarding SSH, the FUTURE policy removes AES128, HMAC-SHA1 and DH Group 14.

[ Parent | on HN ]