certutil -d sql:</path/to/database> -N -f </path/to/database/password/file> \ -@ </path/to/database/password/file>
With this update, the default Fedora policy regarding cryptographic components has been updated to disallow the use of algorithms that are no longer considered secure. Specifically, the changes involve:
Require RSA of 2048 bits or more
Disable DSA
With this update, the libcurl library switches from using libssh2 to implement the SSH layer of SCP and SFTP protocols to libssh. The reason for the change is that the libssh2 library uses outdated cryptographic algorithms and lacks important features, such as GSS-API authentication. The newly used libssh library is more secure, feature-complete, and with more active upstream community.
In Fedora 28, the default file format used by the NSS library is changed to SQL. Unlike the previously used format, DBM, the SQL format allows parallel access to storage. This is particularly important for situations when the user wants to modify NSS storage while another concurrently running process, such as a daemon, accesses the database location at the same time. The use of the SQL format prevents data corruption in such cases.
All applications that currently use the DBM file format will be automatically migrated to the SQL file format on their first run. Use the following command to trigger an explicit migration:
certutil -d sql:</path/to/database> -N -f </path/to/database/password/file> \ -@ </path/to/database/password/file>
With this update, the OpenLDAP distribution in Fedora changed from using the NSS (or MozNSS) library to the OpenSSL library for providing cryptographic functions. The switch promises better support from OpenLDAP upstream, which had ceased maintaining the NSS support layer.
OpenLDAP clients and server now use the system-wide certificate store by default, instead of /etc/openldap/certs
.
Fedora has deprecated the use of TCP wrappers.
The OpenLDAP project also discourages their use and recommends that an IP firewall is used instead.
With this update, OpenLDAP will not be configured with --enable-wrappers
and so any TCP wrappers configuration will have no effect on OpenLDAP.
Other means should be used to protect the OpenLDAP server.