Custom Query (1145 matches)

Reported by jdreed, 11 years ago.

There are no more language-support-input-* packages, so debathena-language-support is empty. We should either figure out what should go in there, or delete it from the tree.

Reported by jdreed, 11 years ago.

This is caused by debathena-language-support, which hasn't seen any love in forever and should just die. We should also file an LP bug

Reported by adehnert, 11 years ago.

Once sufficient progress has been made on Debathena #529 to let users get away without using 1DES, Debathena should stop setting allow_weak_crypto in /etc/krb5.conf.

Status wiki

We believe that:

• On client machines, we can unset allow_weak_crypto once the users on the machine have strong keys and the servers they communicate have strong keys.
• On application servers, we can unset allow_weak_crypto once the users connecting have a vaguely recent kerberos and the server has a strong key. (If it accepts passwords, the users also need to have a strong key.)
• On the KDC, we don't care because it doesn't run Debathena.

Key rolling status:

• FIXED: We believe that the cert update process will roll keys, so all (active-ish) users should now have updated keys.
• FIXED: AFS servers now use a hack to use AES keys, plus mostly don't count because of krb5_allow_weak_crypto.html (see comment:3).
• FIXED: Except for AFS (above), Server Operations' keys have all be updated (see comment:4).
• FIXED: The PO servers (IMAP) have new keys
• FIXED: SIPB services are generally rolled (contacting the maintainers is probably reasonable for anything that isn't, but we think that's done)
• Presumably user outreach is required to get other application servers to roll their keys.