mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
Revert "Require a minimum SASL security factor of 56"
This reverts commit 3509545897.
We cannot force increase in minimum SASL security factor until our
consumers are ready to deal with it. Unfortunately, realmd uses
anonymous connection for discovery and validation of IPA LDAP server.
The way it is done is fragile (it doesn't take into account an
advertised IPA version, only checks that 'IPA' string exists in the info
field) but since bumping of minimum SSF prevents reading IPA info field
using anonymous connection, client enrollment fails.
We should get back to bumping minimum SSF after realmd and other
potential consumers are fixed.
Reviewed-By: François Cami <fcami@redhat.com>
This commit is contained in:
committed by
François Cami
parent
e73fdcf8ba
commit
294aa3a333
@@ -94,7 +94,6 @@ dist_app_DATA = \
|
||||
ipa-kdc-proxy.conf.template \
|
||||
ipa-pki-proxy.conf.template \
|
||||
ipa-rewrite.conf.template \
|
||||
min-ssf.ldif \
|
||||
ipaca_default.ini \
|
||||
ipaca_customize.ini \
|
||||
ipaca_softhsm2.ini \
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
# config
|
||||
# pretend SSF for LDAPI connections
|
||||
# nsslapd-localssf must be equal to or greater than nsslapd-minssf
|
||||
dn: cn=config
|
||||
changetype: modify
|
||||
replace: nsslapd-localssf
|
||||
nsslapd-localssf: 256
|
||||
|
||||
# minimum security strength factor for SASL and TLS
|
||||
# 56 is considered weak, but some old clients announce wrong SSF.
|
||||
dn: cn=config
|
||||
changetype: modify
|
||||
replace: nsslapd-minssf
|
||||
nsslapd-minssf: 56
|
||||
Reference in New Issue
Block a user