From 6847060266792471c9c14518a5106e0f622cd6c5 Mon Sep 17 00:00:00 2001 From: Nick Thomas Date: Fri, 25 Aug 2017 14:08:48 +0100 Subject: Rework the permissions model for SSH key restrictions `allowed_key_types` is removed and the `minimum__bits` fields are renamed to `_key_restriction`. A special sentinel value (`-1`) signifies that the key type is disabled. This also feeds through to the UI - checkboxes per key type are out, inline selection of "forbidden" and "allowed" (i.e., no restrictions) are in. As with the previous model, unknown key types are disallowed, even if the underlying ssh daemon happens to support them. The defaults have also been changed from the lowest known bit size to "no restriction". So if someone does happen to have a 768-bit RSA key, it will continue to work on upgrade, at least until the administrator restricts them. --- doc/security/img/ssh_keys_restrictions_settings.png | Bin 41803 -> 13698 bytes 1 file changed, 0 insertions(+), 0 deletions(-) (limited to 'doc/security') diff --git a/doc/security/img/ssh_keys_restrictions_settings.png b/doc/security/img/ssh_keys_restrictions_settings.png index b62bfc2f7e0..7b8bbb05bce 100644 Binary files a/doc/security/img/ssh_keys_restrictions_settings.png and b/doc/security/img/ssh_keys_restrictions_settings.png differ -- cgit v1.2.1