mirror of
https://github.com/torvalds/linux.git
synced 2024-11-26 14:12:06 +00:00
dfe9a12345
Because the DES block cipher has been deprecated by Internet standard, highly secure configurations might require that DES support be blacklisted or not installed. NFS Kerberos should still be able to work correctly with only the AES-based enctypes in that situation. Also note that MIT Kerberos has begun a deprecation process for DES encryption types. Their README for 1.19.3 states: > Beginning with the krb5-1.19 release, a warning will be issued > if initial credentials are acquired using the des3-cbc-sha1 > encryption type. In future releases, this encryption type will > be disabled by default and eventually removed. > > Beginning with the krb5-1.18 release, single-DES encryption > types have been removed. Aside from the CONFIG option name change, there are two important policy changes: 1. The 'insecure enctype' group is now disabled by default. Distributors have to take action to enable support for deprecated enctypes. Implementation of these enctypes will be removed in a future kernel release. 2. des3-cbc-sha1 is now considered part of the 'insecure enctype' group, having been deprecated by RFC 8429, and is thus disabled by default After this patch is applied, SunRPC support can be built with Kerberos 5 support but without CRYPTO_DES enabled in the kernel. And, when these enctypes are disabled, the Linux kernel's SunRPC RPCSEC GSS implementation fully complies with BCP 179 / RFC 6649 and BCP 218 / RFC 8429. Tested-by: Scott Mayhew <smayhew@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
111 lines
3.1 KiB
Plaintext
111 lines
3.1 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config SUNRPC
|
|
tristate
|
|
depends on MULTIUSER
|
|
|
|
config SUNRPC_GSS
|
|
tristate
|
|
select OID_REGISTRY
|
|
depends on MULTIUSER
|
|
|
|
config SUNRPC_BACKCHANNEL
|
|
bool
|
|
depends on SUNRPC
|
|
|
|
config SUNRPC_SWAP
|
|
bool
|
|
depends on SUNRPC
|
|
|
|
config RPCSEC_GSS_KRB5
|
|
tristate "Secure RPC: Kerberos V mechanism"
|
|
depends on SUNRPC && CRYPTO
|
|
default y
|
|
select SUNRPC_GSS
|
|
select CRYPTO_SKCIPHER
|
|
select CRYPTO_HASH
|
|
help
|
|
Choose Y here to enable Secure RPC using the Kerberos version 5
|
|
GSS-API mechanism (RFC 1964).
|
|
|
|
Secure RPC calls with Kerberos require an auxiliary user-space
|
|
daemon which may be found in the Linux nfs-utils package
|
|
available from http://linux-nfs.org/. In addition, user-space
|
|
Kerberos support should be installed.
|
|
|
|
If unsure, say Y.
|
|
|
|
config RPCSEC_GSS_KRB5_SIMPLIFIED
|
|
bool
|
|
depends on RPCSEC_GSS_KRB5
|
|
|
|
config RPCSEC_GSS_KRB5_CRYPTOSYSTEM
|
|
bool
|
|
depends on RPCSEC_GSS_KRB5
|
|
|
|
config RPCSEC_GSS_KRB5_ENCTYPES_DES
|
|
bool "Enable Kerberos enctypes based on DES (deprecated)"
|
|
depends on RPCSEC_GSS_KRB5
|
|
depends on CRYPTO_CBC && CRYPTO_CTS && CRYPTO_ECB
|
|
depends on CRYPTO_HMAC && CRYPTO_MD5 && CRYPTO_SHA1
|
|
depends on CRYPTO_DES
|
|
default n
|
|
select RPCSEC_GSS_KRB5_SIMPLIFIED
|
|
help
|
|
Choose Y to enable the use of deprecated Kerberos 5
|
|
encryption types that utilize Data Encryption Standard
|
|
(DES) based ciphers. These include des-cbc-md5,
|
|
des-cbc-crc, and des-cbc-md4, which were deprecated by
|
|
RFC 6649, and des3-cbc-sha1, which was deprecated by RFC
|
|
8429.
|
|
|
|
These encryption types are known to be insecure, therefore
|
|
the default setting of this option is N. Support for these
|
|
encryption types is available only for compatibility with
|
|
legacy NFS client and server implementations.
|
|
|
|
Removal of support is planned for a subsequent kernel
|
|
release.
|
|
|
|
config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1
|
|
bool "Enable Kerberos enctypes based on AES and SHA-1"
|
|
depends on RPCSEC_GSS_KRB5
|
|
depends on CRYPTO_CBC && CRYPTO_CTS
|
|
depends on CRYPTO_HMAC && CRYPTO_SHA1
|
|
depends on CRYPTO_AES
|
|
default y
|
|
select RPCSEC_GSS_KRB5_CRYPTOSYSTEM
|
|
help
|
|
Choose Y to enable the use of Kerberos 5 encryption types
|
|
that utilize Advanced Encryption Standard (AES) ciphers and
|
|
SHA-1 digests. These include aes128-cts-hmac-sha1-96 and
|
|
aes256-cts-hmac-sha1-96.
|
|
|
|
config SUNRPC_DEBUG
|
|
bool "RPC: Enable dprintk debugging"
|
|
depends on SUNRPC && SYSCTL
|
|
select DEBUG_FS
|
|
help
|
|
This option enables a sysctl-based debugging interface
|
|
that is be used by the 'rpcdebug' utility to turn on or off
|
|
logging of different aspects of the kernel RPC activity.
|
|
|
|
Disabling this option will make your kernel slightly smaller,
|
|
but makes troubleshooting NFS issues significantly harder.
|
|
|
|
If unsure, say Y.
|
|
|
|
config SUNRPC_XPRT_RDMA
|
|
tristate "RPC-over-RDMA transport"
|
|
depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
|
|
default SUNRPC && INFINIBAND
|
|
select SG_POOL
|
|
help
|
|
This option allows the NFS client and server to use RDMA
|
|
transports (InfiniBand, iWARP, or RoCE).
|
|
|
|
To compile this support as a module, choose M. The module
|
|
will be called rpcrdma.ko.
|
|
|
|
If unsure, or you know there is no RDMA capability on your
|
|
hardware platform, say N.
|