SHA-1 algorithm no longer considered secure for RHEL9

[SmaraMurgilasi]

Hello, 

We have a customer which is preparing to upgrade from RHEL8 to RHEL9 and has received the following warning:

Summary: Digital signatures using SHA-1 hash algorithm are no longer considered secure and are not allowed to be used on RHEL 9 systems by default. This causes issues when using DNF/RPM to handle packages with RSA/SHA1 signatures as the signature cannot be checked with the default cryptographic policy. Any such packages cannot be installed, removed, or replaced unless the signature check is disabled in dnf/rpm or SHA-1 is enabled using non-default crypto-policies. For more information see the following documents:

  - Major changes in RHEL 9: https://red.ht/rhel-9-overview-major-changes

  - Security Considerations in adopting RHEL 9: https://red.ht/rhel-9-security-considerationsRemediation: [hint] It is recommended that you contact your package vendor and ask them for new new builds signed with supported signatures and install the new packages before the upgrade. If this is not possible you may instead remove the incompatible packages.

In the case of RHEL9 Upgrade, do you have any guidance on how to proceed? 

Do you know of any timeline for Flexera to be provided with supported signing other than SHA-1?

Thanks you!

[ChrisG]

I'm not aware of any timeline for an update to the agent installer having been announced by Flexera.

You may want to consider creating a Idea in Flexera Ideas related to this to bring it to the attention of the Flexera Product team, and so that the level of interest in it can be assessed.

[weskus]

FNMS agent is no longer supported in RHEL 9?

[ChrisG]

Current FlexNet inventory agent versions support RHEL 9. You can find full details of operating systems supported by the 2024 R1 agent release here: https://docs.flexera.com/FlexNetManagerSuite2024R1/EN/SysReq/index.html#FNMS_sys_req/RN_sys_req_prereq.html

[weskus]

Not, due this unsecure SHA-1 packaging by Flexera. We have hit the same issue and SHA-1 signature check bypassing is not an option since its been completely cracked and hosting vendor and security organizations totally prevents it usage. 

[mag00_75]

@weskus  I saw in 2024R1 agent that there should be SHA-2 support and a new PGP key. Which agent version are you running?

[weskus]

Thanks, good to know. We are on 2023R2. 

[mag00_75]

Usually its possible running newer version of the agent connecting to a lower version of application.

However the next upgrade to 2024r2 will introduce new functionality which in certain cases require a newer beacon version. This is mentioned in the flexeraone/itam release notes

[weskus]

This is exactly what we have done here 😉