Add NEWS entry for openafs-fileserver rekeying

Conflicts:
	debian/openafs-fileserver.NEWS

diff --git a/debian/changelog b/debian/changelog
index ac626dc90b89eca11bb2e146298761d60f90a2fe..5aa26cbc007ec23efe6173b8206e4a72884e821a 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-openafs (1.4.12.1+dfsg-4+squeeze2) UNRELEASED; urgency=high
+openafs (1.4.12.1+dfsg-4+squeeze2) squeeze-security; urgency=high
 
   * Apply upstream security patches:
     - OPENAFS-SA-2013-003: New support for non-DES enctypes in the

diff --git a/debian/openafs-fileserver.NEWS b/debian/openafs-fileserver.NEWS
index f55236617e0c59177b6de478f1be829afbdaa3e9..0657a5b0d33e6f21700b93a83a8dc6672a0872a2 100644 (file)
--- a/debian/openafs-fileserver.NEWS
+++ b/debian/openafs-fileserver.NEWS
@@ -1,3 +1,35 @@
+openafs (1.4.12.1+dfsg-4+squeeze2) squeeze-security; urgency=high
+
+  The DES keys used by all previous versions of OpenAFS are not
+  sufficiently strong to be secure.  As of this release, all OpenAFS
+  servers support using stronger long-term keys than DES.  All sites are
+  strongly encouraged to rekey their AFS cells after deploying the new
+  version of the AFS server software on all AFS file server and AFS
+  database server machines.
+
+  To do so, generate a new set of keys for the afs/<cell> principal for
+  your site and store those keys in /etc/openafs/server/rxkad.keytab on
+  all file server and database server machines and then restart the server
+  processes to upgrade the strength of server-to-server connections.
+  After all existing AFS tokens have expired, you can then move the
+  KeyFile aside, which will invalidate all old, existing DES tokens.
+
+  If you are using Heimdal as your Kerberos KDC, you need to ensure that
+  the afs/<cell> key includes a des-cbc-crc enctype (to allow for session
+  keys), but you should remove all DES keys from the keytab before
+  deploying it as rxkad.keytab.
+
+  These are only abbreviated instructions and don't include some relevant
+  details.  If possible, please study and follow the more comprehensive
+  instructions available at:
+
+      http://www.openafs.org/pages/security/install-rxkad-k5-1.6.txt
+      http://www.openafs.org/pages/security/how-to-rekey.txt
+
+  linked from <http://www.openafs.org/security/>.
+
+ -- Russ Allbery <rra@debian.org>  Wed, 24 Jul 2013 12:08:46 -0700
+
 openafs (1.4.4.dfsg1-4) unstable; urgency=low
 
   The files previously located in /etc/openafs/server-local have been