Hash function for address key exchange Obsolete hash function SHA224
- Thread starter Niels90
- Start date
mangelot
Verified User
## Disable SHA-1 and SHA-224 signature algorithms server-wide
On AlmaLinux 8/9, system-wide crypto policies can be used to disable SHA-1 and SHA-224 signature algorithms for applications that use the system crypto-policy framework.
The built-in `NO-SHA1` policy module already exists:
You need to create a custom module for SHA-224:
Apply the combined crypto policy:
Verify the active policy:
Expected output:
You can also verify the active signature algorithms:
SHA-1 and SHA-224 signature algorithms should no longer be present, while SHA-256, SHA-384 and SHA-512 remain available.
### Reboot the server
The system-wide crypto policy is applied when applications start. Reboot the server so that all running services start with the new policy:
### Do NOT use `FUTURE` for this purpose
Do **not** switch the entire server to:
update-crypto-policies --set FUTURE
if the goal is only to disable SHA-1 and SHA-224 signature algorithms.
`FUTURE` is a substantially stricter crypto policy. It changes more than just the allowed signature algorithms and can introduce compatibility problems with older clients, mail servers, applications and other services.
Using:
DEFAULT:NO-SHA1:NO-SHA224
keeps the normal `DEFAULT` policy and makes the targeted change of removing SHA-1 and SHA-224 signature algorithms without applying the additional restrictions of `FUTURE`.
On AlmaLinux 8/9, system-wide crypto policies can be used to disable SHA-1 and SHA-224 signature algorithms for applications that use the system crypto-policy framework.
The built-in `NO-SHA1` policy module already exists:
Code:
/usr/share/crypto-policies/policies/modules/NO-SHA1.pmodYou need to create a custom module for SHA-224:
Code:
cat > /etc/crypto-policies/policies/modules/NO-SHA224.pmod <<'EOF'
# Disable SHA-224 signature algorithms
sign = -*-SHA2-224
EOFApply the combined crypto policy:
Code:
update-crypto-policies --set DEFAULT:NO-SHA1:NO-SHA224Verify the active policy:
Code:
update-crypto-policies --showExpected output:
Code:
DEFAULT:NO-SHA1:NO-SHA224You can also verify the active signature algorithms:
Code:
grep '^sign =' /etc/crypto-policies/state/CURRENT.polSHA-1 and SHA-224 signature algorithms should no longer be present, while SHA-256, SHA-384 and SHA-512 remain available.
### Reboot the server
The system-wide crypto policy is applied when applications start. Reboot the server so that all running services start with the new policy:
Code:
reboot### Do NOT use `FUTURE` for this purpose
Do **not** switch the entire server to:
update-crypto-policies --set FUTURE
if the goal is only to disable SHA-1 and SHA-224 signature algorithms.
`FUTURE` is a substantially stricter crypto policy. It changes more than just the allowed signature algorithms and can introduce compatibility problems with older clients, mail servers, applications and other services.
Using:
DEFAULT:NO-SHA1:NO-SHA224
keeps the normal `DEFAULT` policy and makes the targeted change of removing SHA-1 and SHA-224 signature algorithms without applying the additional restrictions of `FUTURE`.