Your message dated Fri, 22 Jul 2022 23:19:35 +0000
with message-id <[email protected]>
and subject line Bug#1009927: fixed in krb5 1.20-1
has caused the Debian Bug report #1009927,
regarding krb5: deprecated encryption type for master_key_type
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1009927: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009927
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: krb5
Version: 1.19.2-2
Severity: normal
Dear Maintainer,
when creating a new realm using `krb5_newrealm`, the following warning
is logged in /var/log/syslog:
Apr 20 20:43:16 kdc krb5kdc[3136]: Stash file /etc/krb5kdc/stash uses
DEPRECATED enctype des3-cbc-sha1!
This comes from the kdc.conf template in
/usr/share/krb5-kdc/kdc.conf.template which has "master_key_type =
des3-hmac-sha1".
Maybe it's time to update that encryption type? The kdc.conf manpage
says that the current default is "aes256-cts-hmac-sha1-96". The sample
kdc.conf in the documentation at
https://web.mit.edu/kerberos/krb5-latest/doc/admin/install_kdc.html#kdc-conf
suggests just "master_key_type = aes256-cts".
I understand there may be important upgrade path considerations. Given
all the care and precautions that are shown for migrating away from
single DES in
https://web.mit.edu/kerberos/krb5-latest/doc/admin/advanced/retiring-des.html,
changing the default master key type for fresh installs might also
require careful planning and thought, but at some point this process
must start. And upstream is now flagging DES3 as deprecated already.
--- End Message ---
--- Begin Message ---
Source: krb5
Source-Version: 1.20-1
Done: Sam Hartman <[email protected]>
We believe that the bug you reported is fixed in the latest version of
krb5, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sam Hartman <[email protected]> (supplier of updated krb5 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Fri, 22 Jul 2022 16:32:38 -0600
Source: krb5
Architecture: source
Version: 1.20-1
Distribution: unstable
Urgency: medium
Maintainer: Sam Hartman <[email protected]>
Changed-By: Sam Hartman <[email protected]>
Closes: 1009927
Changes:
krb5 (1.20-1) unstable; urgency=medium
.
* New Upstream Version
* Do not specify master key type to avoid weak crypto, Closes: #1009927
Checksums-Sha1:
45651c088ae5c3f0021d949e53f39a61a99ccc23 3150 krb5_1.20-1.dsc
e6addc23e361798b9f1243e6809620449d7fcb38 8660756 krb5_1.20.orig.tar.gz
56387f43b201bc8f11a4b1885c6c23fd9ab2e6a0 833 krb5_1.20.orig.tar.gz.asc
0918b050d1d986cbda08f421313644eb69761dba 104112 krb5_1.20-1.debian.tar.xz
9e85f843f7aa19559309a5d52f598a9bad951fef 5138 krb5_1.20-1_source.buildinfo
Checksums-Sha256:
bcfd574ef97a80f0edf34b90d8cc15b319ca388eab75dae4487711115402460d 3150
krb5_1.20-1.dsc
7e022bdd3c851830173f9faaa006a230a0e0fdad4c953e85bff4bf0da036e12f 8660756
krb5_1.20.orig.tar.gz
ecfecebc6c837952788accf519ba5034a982c46270907e15fe7e2abfa2f468b3 833
krb5_1.20.orig.tar.gz.asc
f0c714364e382d277464b69486692730f3abb3f31efd4f733aad32f271d82182 104112
krb5_1.20-1.debian.tar.xz
8c7e7e7acd05aa9b3599221206f9e27c565a53c3a25f546ce275e4aa52c2c851 5138
krb5_1.20-1_source.buildinfo
Files:
a9f77f08bedf2418a2bf386db25bfb6f 3150 net optional krb5_1.20-1.dsc
e88657aca6e6b0528c11a78643498bd5 8660756 net optional krb5_1.20.orig.tar.gz
9167059f7092cc773808b6dbf4ae09a8 833 net optional krb5_1.20.orig.tar.gz.asc
ed407d5dde49f4ef3027782cd0e4fcd1 104112 net optional krb5_1.20-1.debian.tar.xz
2ac2affdaddf20f5bb1e9798aeaf1926 5138 net optional krb5_1.20-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iHUEARYIAB0WIQSj2jRwbAdKzGY/4uAsbEw8qDeGdAUCYtsrUgAKCRAsbEw8qDeG
dLbLAP4nFDGjMBmGWloiRbSff3Q9gPaI1ykV5BkNWhzLk3vEegEA/ts/M0O3tDLI
pJruzwNVsJzJRIO7B8pObU0vfp7mIgQ=
=Swb3
-----END PGP SIGNATURE-----
--- End Message ---
