From 58ab032f1ae20454d4b9d760c7601fd8b44045f5 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 23 Nov 2015 13:40:42 -0500 Subject: Use only AES enctypes by default Remove des3 and arcfour from the defaults for new installs. NOTE: the ipasam/dcerpc code sill uses arcfour Signed-off-by: Simo Sorce Ticket: https://fedorahosted.org/freeipa/ticket/4740 Reviewed-By: Martin Basti Reviewed-By: Alexander Bokovoy --- daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) (limited to 'daemons/ipa-slapi-plugins') diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c index 1a8ef47b0..5dc606d22 100644 --- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c +++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c @@ -55,18 +55,10 @@ extern const char *ipa_realm_dn; extern const char *ipa_etc_config_dn; extern const char *ipa_pwd_config_dn; -/* These are the default enc:salt types if nothing is defined. - * TODO: retrieve the configure set of ecntypes either from the - * kfc.conf file or by synchronizing the file content into - * the directory */ +/* These are the default enc:salt types if nothing is defined in LDAP */ static const char *ipapwd_def_encsalts[] = { - "des3-hmac-sha1:normal", -/* "arcfour-hmac:normal", - "des-hmac-sha1:normal", - "des-cbc-md5:normal", */ - "des-cbc-crc:normal", -/* "des-cbc-crc:v4", - "des-cbc-crc:afs3", */ + "aes256-cts:special", + "aes128-cts:special", NULL }; -- cgit