Revert RL9 crypto policy to DEFAULT #2084
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly reverts the RHEL 9 crypto policy from FIPS to DEFAULT to allow the use of modern SSH key types like ed25519. The change is well-documented with a new comment and a release note.
However, for this change to be fully effective, a related modification is required in a file not included in this PR's changes. The file etc/kayobe/ansible/maintenance/cis.yml contains an Ansible assertion that explicitly blocks the use of ed25519 keys on Red Hat systems. This assertion was relevant for the FIPS policy but now contradicts the goal of this PR. It should be removed to prevent failures for users who wish to use ed25519 keys.
I've also added one suggestion to improve the clarity of comments in the configuration file.
This should resolve SSH issues with some modern key types such as ed25519.
priteau
force-pushed
the
rhel9cis-crypto-policy
branch
from
77eb16d to
8516ab3
Compare
This should resolve SSH issues with some modern key types such as ed25519.