03f7adfdd1
Since ssh-dss is no longer supported by default, users relying on those keys for their login may be locked out. They should ideally use stronger keys, but adding the support for ssh-dss back in can also be done through extraConfig.
138 lines
4.5 KiB
XML
138 lines
4.5 KiB
XML
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-18.03">
|
|
|
|
<title>Release 18.03 (“Impala”, 2018/03/??)</title>
|
|
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-18.03-highlights">
|
|
|
|
<title>Highlights</title>
|
|
|
|
<para>In addition to numerous new and upgraded packages, this release
|
|
has the following highlights: </para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
</section>
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-18.03-new-services">
|
|
|
|
<title>New Services</title>
|
|
|
|
<para>The following new services were added since the last release:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para></para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
</section>
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-18.03-incompatibilities">
|
|
|
|
<title>Backward Incompatibilities</title>
|
|
|
|
<para>When upgrading from a previous release, please be aware of the
|
|
following incompatible changes:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
Dollar signs in options under <option>services.postfix</option> are
|
|
passed verbatim to Postfix, which will interpret them as the beginning of
|
|
a parameter expression. This was already true for string-valued options
|
|
in the previous release, but not for list-valued options. If you need to
|
|
pass literal dollar signs through Postfix, double them.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <literal>postage</literal> package (for web-based PostgreSQL
|
|
administration) has been renamed to <literal>pgmanage</literal>. The
|
|
corresponding module has also been renamed. To migrate please rename all
|
|
<option>services.postage</option> options to
|
|
<option>services.pgmanage</option>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<emphasis role="strong">
|
|
The OpenSSH service no longer enables support for DSA keys by default,
|
|
which could cause a system lock out. Update your keys or, unfavorably,
|
|
re-enable DSA support manually.
|
|
</emphasis>
|
|
</para>
|
|
|
|
<para>
|
|
DSA support was
|
|
<link xlink:href="https://www.openssh.com/legacy.html">deprecated in OpenSSH 7.0</link>,
|
|
due to it being too weak. To re-enable support, add
|
|
<literal>PubkeyAcceptedKeyTypes +ssh-dss</literal> to the end of your
|
|
<option>services.openssh.extraConfig</option>.
|
|
</para>
|
|
|
|
<para>
|
|
After updating the keys to be stronger, anyone still on a pre-17.03
|
|
version is safe to jump to 17.03, as vetted
|
|
<link xlink:href="https://search.nix.gsc.io/?q=stateVersion">here</link>.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
</section>
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-18.03-notable-changes">
|
|
|
|
<title>Other Notable Changes</title>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
ZNC option <option>services.znc.mutable</option> now defaults to
|
|
<literal>true</literal>. That means that old configuration is not
|
|
overwritten by default when update to the znc options are made.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The option <option>networking.wireless.networks.<name>.auth</option>
|
|
has been added for wireless networks with WPA-Enterprise authentication.
|
|
There is also a new <option>extraConfig</option> option to directly
|
|
configure <literal>wpa_supplicant</literal> and <option>hidden</option>
|
|
to connect to hidden networks.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The option <option>services.xserver.desktopManager.default</option> is now <literal>none</literal> by default.
|
|
An assertion failure is thrown if WM's and DM's default are <literal>none</literal>.
|
|
To explicitly run a plain X session without and DM or WM, the newly introduced option <option>services.xserver.plainX</option>
|
|
must be set to true.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
</section>
|
|
</section>
|