Francisco Trivino fd7f4a7411 Custodia: use a stronger encryption algo when exporting keys ... The Custodia key export handler is using the default's OpenSSL encryption scheme for PKCS#12. This represents an issue when performing a migration from CentOS Stream 8 (C8S) to CentOS Steam 9 (C9S) where the Custodia client running in the new C9S replica talks to the Custodia server on C8S source server. The later creates an encrypted PKCS#12 file that contains the cert and the key using the OpenSSL's default encryption scheme, which is no longer supported on C9S. This commit enforces a stronger encryption algorigthm by adding following arguments to the Custodia server handler: -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg sha384 The new arguments enforce stronger PBEv2 instead of the insecure PBEv1. Fixes: https://pagure.io/freeipa/issue/9101 Signed-off-by: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>		2022-01-31 10:08:43 +01:00
..
advise	ipa-advise: Define the domain used when looking up ipa-ca	2021-08-03 11:05:15 -04:00
custodia	Also drop Custodia client and forwarder	2021-06-16 10:28:17 -04:00
dnssec	freeipa.spec: depend on bind-dnssec-utils	2021-11-25 16:49:00 +01:00
install	SMB: switch IPA domain controller role	2021-11-10 15:00:27 -05:00
plugins	Config plugin: return EmptyModlist when no change is applied	2022-01-13 14:20:59 -05:00
secrets	Custodia: use a stronger encryption algo when exporting keys	2022-01-31 10:08:43 +01:00
__init__.py	Change FreeIPA license to GPLv3+	2010-12-20 17:19:53 -05:00
dcerpc_common.py	Py3: Replace six.text_type with str	2018-09-27 16:11:18 +02:00
dcerpc.py	trust-fetch-domains: use custom krb5.conf overlay for all trust operations	2021-01-22 12:21:33 -05:00
dns_data_management.py	Add URI system records for KDC	2021-08-31 18:28:27 -04:00
Makefile.am	Build: Makefiles for Python packages	2016-11-09 13:08:32 +01:00
masters.py	Add hidden replica feature	2019-03-28 17:57:58 +01:00
p11helper.py	Grammar: whitespace is a word	2020-06-23 10:16:29 +02:00
rpcserver.py	ipa config: add --enable-sid option	2021-11-02 10:11:28 +01:00
servroles.py	Use api.env.container_sysaccounts	2020-04-28 11:28:29 +02:00
setup.cfg	Port all setup.py to setuptools	2016-10-20 18:43:37 +02:00
setup.py	Also drop Custodia client and forwarder	2021-06-16 10:28:17 -04:00
topology.py	Py3: Remove subclassing from object	2018-09-27 11:49:04 +02:00
wsgi.py	Improve wsgi app loading	2021-04-07 11:43:23 +03:00