{"action":"created","comment":{"url":"https://api.github.com/repos/cylc/cylc/pulls/comments/48834781","id":48834781,"diff_hunk":"@@ -853,3 +853,70 @@ \\subsection{[authentication]}\n     \\end{myitemize}\n \\item {\\em default:} state-totals\n \\end{myitemize}\n+\n+\\subsubsection{[authentication] $\\rightarrow$ hashes}\n+\n+This sets the hash algorithms used for Pyro HMAC. SHA-256 and SHA-512 are\n+the most secure. The first item is used as the default hash. Subsequent items\n+(if any) are used as fallback hashes (e.g. for backwards compatibility should\n+the hash change).\n+\n+The default value is SHA256 followed by MD5. You may want to exclude MD5 for\n+security reasons - e.g. for FIPS compliance. Older cylc versions use MD5.\n+\n+MD5 is popularly used for HMAC, but is the least secure. SHA-1 is slightly\n+better. Note that HMAC use is not as susceptible to hash collision weakness,\n+so both algorithms are more secure for HMAC use than in the general case.\n+\n+Clients will attempt to establish a connection using the algorithms from first\n+to last. The exception is scanning, which will use the algorithm configured in\n+the [authentication] $\\rightarrow$ scan hash setting below. If you have lots\n+of suites running with e.g. MD5 hashes, you will want to include 'md5' in your\n+list of hashes and set it as the default scan hash.\n+\n+See \\url{https://docs.python.org/2/library/hmac.html} and\n+\\url{https://docs.python.org/2/library/hashlib.html} for discussion of hash\n+algorithms.\n+\n+\\begin{myitemize}\n+\\item {\\em type:} comma-separated list of hash names (must each be one of the\n+    following options)\n+\\item {\\em options:}\n+    \\begin{myitemize}\n+        \\item {\\em sha256} - SHA-256 (recommended, default)\n+        \\item {\\em sha512} - SHA-512 (most secure, but slowest)\n+        \\item {\\em sha1} - SHA-1 (may be the best option on legacy systems)\n+        \\item {\\em md5} - MD5 (old default, usually used for HMAC, but the\n+            least secure)\n+    \\end{myitemize}\n+\\item {\\em default:} sha256,md5\n+\\end{myitemize}\n+\n+\n+\\subsubsection{[authentication] $\\rightarrow$ scan hash}\n+\n+See [authentication] $\\rightarrow$ hashes.\n+\n+Configure which of the specified hash algorithms in [authentication]\n+$\\rightarrow$ hashes is used for scanning.\n+\n+The default hash algorithm for scans is MD5, for backwards compatibility\n+reasons. You can override it by specifying a different value for this setting\n+(e.g. for FIPS compliance).\n+\n+The default will become SHA-256 sometime in 2016, when it is unlikely that any\n+old MD5 suites are still around.","path":"doc/siterc.tex","position":56,"original_position":56,"commit_id":"0b7934fa3947e96d21a6b9704982e89c1b09c1f3","original_commit_id":"0b7934fa3947e96d21a6b9704982e89c1b09c1f3","user":{"login":"benfitzpatrick","id":1138333,"avatar_url":"https://avatars.githubusercontent.com/u/1138333?v=3","gravatar_id":"","url":"https://api.github.com/users/benfitzpatrick","html_url":"https://github.com/benfitzpatrick","followers_url":"https://api.github.com/users/benfitzpatrick/followers","following_url":"https://api.github.com/users/benfitzpatrick/following{/other_user}","gists_url":"https://api.github.com/users/benfitzpatrick/gists{/gist_id}","starred_url":"https://api.github.com/users/benfitzpatrick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benfitzpatrick/subscriptions","organizations_url":"https://api.github.com/users/benfitzpatrick/orgs","repos_url":"https://api.github.com/users/benfitzpatrick/repos","events_url":"https://api.github.com/users/benfitzpatrick/events{/privacy}","received_events_url":"https://api.github.com/users/benfitzpatrick/received_events","type":"User","site_admin":false},"body":"We can always site configure it back if it is not convenient.","created_at":"2016-01-05T11:14:23Z","updated_at":"2016-01-05T11:14:23Z","html_url":"https://github.com/cylc/cylc/pull/1700#discussion_r48834781","pull_request_url":"https://api.github.com/repos/cylc/cylc/pulls/1700","_links":{"self":{"href":"https://api.github.com/repos/cylc/cylc/pulls/comments/48834781"},"html":{"href":"https://github.com/cylc/cylc/pull/1700#discussion_r48834781"},"pull_request":{"href":"https://api.github.com/repos/cylc/cylc/pulls/1700"}}},"pull_request":{"url":"https://api.github.com/repos/cylc/cylc/pulls/1700","id":53816049,"html_url":"https://github.com/cylc/cylc/pull/1700","diff_url":"https://github.com/cylc/cylc/pull/1700.diff","patch_url":"https://github.com/cylc/cylc/pull/1700.patch","issue_url":"https://api.github.com/repos/cylc/cylc/issues/1700","number":1700,"state":"open","locked":false,"title":"cylc auth: allow hash choice, SHA256 by default","user":{"login":"benfitzpatrick","id":1138333,"avatar_url":"https://avatars.githubusercontent.com/u/1138333?v=3","gravatar_id":"","url":"https://api.github.com/users/benfitzpatrick","html_url":"https://github.com/benfitzpatrick","followers_url":"https://api.github.com/users/benfitzpatrick/followers","following_url":"https://api.github.com/users/benfitzpatrick/following{/other_user}","gists_url":"https://api.github.com/users/benfitzpatrick/gists{/gist_id}","starred_url":"https://api.github.com/users/benfitzpatrick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benfitzpatrick/subscriptions","organizations_url":"https://api.github.com/users/benfitzpatrick/orgs","repos_url":"https://api.github.com/users/benfitzpatrick/repos","events_url":"https://api.github.com/users/benfitzpatrick/events{/privacy}","received_events_url":"https://api.github.com/users/benfitzpatrick/received_events","type":"User","site_admin":false},"body":"This change allows a site or user configuration of the hashing\r\nalgorithm used in Pyro communication. MD5 is not really recommended for\r\nHMAC use, and is actually disabled on some POSIX systems.\r\n\r\nMultiple hash algorithms are now allowed for both client and daemon.\r\nThe daemon can accept authentication in any of the configured hash\r\nalgorithms, and the client will work through any of the configured hash\r\nalgorithms until one works.\r\n\r\nThe default is SHA256 followed by MD5 as a fallback and for scanning.\r\nThis allows MD5 (old) suites to work - it preserves\r\nold-client/new-daemon and new-scan-client/old-daemons.\r\n\r\nSHA1 can be used for older Python version sites that don't want MD5.\r\n\r\n(updated)\r\n\r\nCloses #1629.","created_at":"2015-12-16T09:20:20Z","updated_at":"2016-01-05T11:14:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d3e7d17aa2a60023a3ff41e763e13b5e8a8820d4","assignee":{"login":"matthewrmshin","id":908613,"avatar_url":"https://avatars.githubusercontent.com/u/908613?v=3","gravatar_id":"","url":"https://api.github.com/users/matthewrmshin","html_url":"https://github.com/matthewrmshin","followers_url":"https://api.github.com/users/matthewrmshin/followers","following_url":"https://api.github.com/users/matthewrmshin/following{/other_user}","gists_url":"https://api.github.com/users/matthewrmshin/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewrmshin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewrmshin/subscriptions","organizations_url":"https://api.github.com/users/matthewrmshin/orgs","repos_url":"https://api.github.com/users/matthewrmshin/repos","events_url":"https://api.github.com/users/matthewrmshin/events{/privacy}","received_events_url":"https://api.github.com/users/matthewrmshin/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/cylc/cylc/milestones/46","html_url":"https://github.com/cylc/cylc/milestones/next%20release","labels_url":"https://api.github.com/repos/cylc/cylc/milestones/46/labels","id":1455232,"number":46,"title":"next release","description":"","creator":{"login":"hjoliver","id":2362137,"avatar_url":"https://avatars.githubusercontent.com/u/2362137?v=3","gravatar_id":"","url":"https://api.github.com/users/hjoliver","html_url":"https://github.com/hjoliver","followers_url":"https://api.github.com/users/hjoliver/followers","following_url":"https://api.github.com/users/hjoliver/following{/other_user}","gists_url":"https://api.github.com/users/hjoliver/gists{/gist_id}","starred_url":"https://api.github.com/users/hjoliver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hjoliver/subscriptions","organizations_url":"https://api.github.com/users/hjoliver/orgs","repos_url":"https://api.github.com/users/hjoliver/repos","events_url":"https://api.github.com/users/hjoliver/events{/privacy}","received_events_url":"https://api.github.com/users/hjoliver/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":11,"state":"open","created_at":"2015-12-11T00:28:23Z","updated_at":"2016-01-05T10:31:14Z","due_on":"2016-01-07T11:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/cylc/cylc/pulls/1700/commits","review_comments_url":"https://api.github.com/repos/cylc/cylc/pulls/1700/comments","review_comment_url":"https://api.github.com/repos/cylc/cylc/pulls/comments{/number}","comments_url":"https://api.github.com/repos/cylc/cylc/issues/1700/comments","statuses_url":"https://api.github.com/repos/cylc/cylc/statuses/0b7934fa3947e96d21a6b9704982e89c1b09c1f3","head":{"label":"benfitzpatrick:auth.configurable-hash","ref":"auth.configurable-hash","sha":"0b7934fa3947e96d21a6b9704982e89c1b09c1f3","user":{"login":"benfitzpatrick","id":1138333,"avatar_url":"https://avatars.githubusercontent.com/u/1138333?v=3","gravatar_id":"","url":"https://api.github.com/users/benfitzpatrick","html_url":"https://github.com/benfitzpatrick","followers_url":"https://api.github.com/users/benfitzpatrick/followers","following_url":"https://api.github.com/users/benfitzpatrick/following{/other_user}","gists_url":"https://api.github.com/users/benfitzpatrick/gists{/gist_id}","starred_url":"https://api.github.com/users/benfitzpatrick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benfitzpatrick/subscriptions","organizations_url":"https://api.github.com/users/benfitzpatrick/orgs","repos_url":"https://api.github.com/users/benfitzpatrick/repos","events_url":"https://api.github.com/users/benfitzpatrick/events{/privacy}","received_events_url":"https://api.github.com/users/benfitzpatrick/received_events","type":"User","site_admin":false},"repo":{"id":2606625,"name":"cylc","full_name":"benfitzpatrick/cylc","owner":{"login":"benfitzpatrick","id":1138333,"avatar_url":"https://avatars.githubusercontent.com/u/1138333?v=3","gravatar_id":"","url":"https://api.github.com/users/benfitzpatrick","html_url":"https://github.com/benfitzpatrick","followers_url":"https://api.github.com/users/benfitzpatrick/followers","following_url":"https://api.github.com/users/benfitzpatrick/following{/other_user}","gists_url":"https://api.github.com/users/benfitzpatrick/gists{/gist_id}","starred_url":"https://api.github.com/users/benfitzpatrick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benfitzpatrick/subscriptions","organizations_url":"https://api.github.com/users/benfitzpatrick/orgs","repos_url":"https://api.github.com/users/benfitzpatrick/repos","events_url":"https://api.github.com/users/benfitzpatrick/events{/privacy}","received_events_url":"https://api.github.com/users/benfitzpatrick/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/benfitzpatrick/cylc","description":"The cylc forecast suite metascheduler","fork":true,"url":"https://api.github.com/repos/benfitzpatrick/cylc","forks_url":"https://api.github.com/repos/benfitzpatrick/cylc/forks","keys_url":"https://api.github.com/repos/benfitzpatrick/cylc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/benfitzpatrick/cylc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/benfitzpatrick/cylc/teams","hooks_url":"https://api.github.com/repos/benfitzpatrick/cylc/hooks","issue_events_url":"https://api.github.com/repos/benfitzpatrick/cylc/issues/events{/number}","events_url":"https://api.github.com/repos/benfitzpatrick/cylc/events","assignees_url":"https://api.github.com/repos/benfitzpatrick/cylc/assignees{/user}","branches_url":"https://api.github.com/repos/benfitzpatrick/cylc/branches{/branch}","tags_url":"https://api.github.com/repos/benfitzpatrick/cylc/tags","blobs_url":"https://api.github.com/repos/benfitzpatrick/cylc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/benfitzpatrick/cylc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/benfitzpatrick/cylc/git/refs{/sha}","trees_url":"https://api.github.com/repos/benfitzpatrick/cylc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/benfitzpatrick/cylc/statuses/{sha}","languages_url":"https://api.github.com/repos/benfitzpatrick/cylc/languages","stargazers_url":"https://api.github.com/repos/benfitzpatrick/cylc/stargazers","contributors_url":"https://api.github.com/repos/benfitzpatrick/cylc/contributors","subscribers_url":"https://api.github.com/repos/benfitzpatrick/cylc/subscribers","subscription_url":"https://api.github.com/repos/benfitzpatrick/cylc/subscription","commits_url":"https://api.github.com/repos/benfitzpatrick/cylc/commits{/sha}","git_commits_url":"https://api.github.com/repos/benfitzpatrick/cylc/git/commits{/sha}","comments_url":"https://api.github.com/repos/benfitzpatrick/cylc/comments{/number}","issue_comment_url":"https://api.github.com/repos/benfitzpatrick/cylc/issues/comments{/number}","contents_url":"https://api.github.com/repos/benfitzpatrick/cylc/contents/{+path}","compare_url":"https://api.github.com/repos/benfitzpatrick/cylc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/benfitzpatrick/cylc/merges","archive_url":"https://api.github.com/repos/benfitzpatrick/cylc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/benfitzpatrick/cylc/downloads","issues_url":"https://api.github.com/repos/benfitzpatrick/cylc/issues{/number}","pulls_url":"https://api.github.com/repos/benfitzpatrick/cylc/pulls{/number}","milestones_url":"https://api.github.com/repos/benfitzpatrick/cylc/milestones{/number}","notifications_url":"https://api.github.com/repos/benfitzpatrick/cylc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/benfitzpatrick/cylc/labels{/name}","releases_url":"https://api.github.com/repos/benfitzpatrick/cylc/releases{/id}","created_at":"2011-10-19T14:47:18Z","updated_at":"2015-03-16T11:30:50Z","pushed_at":"2016-01-04T12:37:44Z","git_url":"git://github.com/benfitzpatrick/cylc.git","ssh_url":"git@github.com:benfitzpatrick/cylc.git","clone_url":"https://github.com/benfitzpatrick/cylc.git","svn_url":"https://github.com/benfitzpatrick/cylc","homepage":"https://github.com/cylc/cylc","size":97277,"stargazers_count":3,"watchers_count":3,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":3,"default_branch":"master"}},"base":{"label":"cylc:master","ref":"master","sha":"d371387951ea8eff91cfbc257d0f53046108d37b","user":{"login":"cylc","id":824878,"avatar_url":"https://avatars.githubusercontent.com/u/824878?v=3","gravatar_id":"","url":"https://api.github.com/users/cylc","html_url":"https://github.com/cylc","followers_url":"https://api.github.com/users/cylc/followers","following_url":"https://api.github.com/users/cylc/following{/other_user}","gists_url":"https://api.github.com/users/cylc/gists{/gist_id}","starred_url":"https://api.github.com/users/cylc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cylc/subscriptions","organizations_url":"https://api.github.com/users/cylc/orgs","repos_url":"https://api.github.com/users/cylc/repos","events_url":"https://api.github.com/users/cylc/events{/privacy}","received_events_url":"https://api.github.com/users/cylc/received_events","type":"Organization","site_admin":false},"repo":{"id":1836229,"name":"cylc","full_name":"cylc/cylc","owner":{"login":"cylc","id":824878,"avatar_url":"https://avatars.githubusercontent.com/u/824878?v=3","gravatar_id":"","url":"https://api.github.com/users/cylc","html_url":"https://github.com/cylc","followers_url":"https://api.github.com/users/cylc/followers","following_url":"https://api.github.com/users/cylc/following{/other_user}","gists_url":"https://api.github.com/users/cylc/gists{/gist_id}","starred_url":"https://api.github.com/users/cylc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cylc/subscriptions","organizations_url":"https://api.github.com/users/cylc/orgs","repos_url":"https://api.github.com/users/cylc/repos","events_url":"https://api.github.com/users/cylc/events{/privacy}","received_events_url":"https://api.github.com/users/cylc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/cylc/cylc","description":"This is the official repository of the cylc suite engine. It will normally contain just the master branch, with completed features merged in from feature branches in developer forks.","fork":false,"url":"https://api.github.com/repos/cylc/cylc","forks_url":"https://api.github.com/repos/cylc/cylc/forks","keys_url":"https://api.github.com/repos/cylc/cylc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cylc/cylc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cylc/cylc/teams","hooks_url":"https://api.github.com/repos/cylc/cylc/hooks","issue_events_url":"https://api.github.com/repos/cylc/cylc/issues/events{/number}","events_url":"https://api.github.com/repos/cylc/cylc/events","assignees_url":"https://api.github.com/repos/cylc/cylc/assignees{/user}","branches_url":"https://api.github.com/repos/cylc/cylc/branches{/branch}","tags_url":"https://api.github.com/repos/cylc/cylc/tags","blobs_url":"https://api.github.com/repos/cylc/cylc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cylc/cylc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cylc/cylc/git/refs{/sha}","trees_url":"https://api.github.com/repos/cylc/cylc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cylc/cylc/statuses/{sha}","languages_url":"https://api.github.com/repos/cylc/cylc/languages","stargazers_url":"https://api.github.com/repos/cylc/cylc/stargazers","contributors_url":"https://api.github.com/repos/cylc/cylc/contributors","subscribers_url":"https://api.github.com/repos/cylc/cylc/subscribers","subscription_url":"https://api.github.com/repos/cylc/cylc/subscription","commits_url":"https://api.github.com/repos/cylc/cylc/commits{/sha}","git_commits_url":"https://api.github.com/repos/cylc/cylc/git/commits{/sha}","comments_url":"https://api.github.com/repos/cylc/cylc/comments{/number}","issue_comment_url":"https://api.github.com/repos/cylc/cylc/issues/comments{/number}","contents_url":"https://api.github.com/repos/cylc/cylc/contents/{+path}","compare_url":"https://api.github.com/repos/cylc/cylc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cylc/cylc/merges","archive_url":"https://api.github.com/repos/cylc/cylc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cylc/cylc/downloads","issues_url":"https://api.github.com/repos/cylc/cylc/issues{/number}","pulls_url":"https://api.github.com/repos/cylc/cylc/pulls{/number}","milestones_url":"https://api.github.com/repos/cylc/cylc/milestones{/number}","notifications_url":"https://api.github.com/repos/cylc/cylc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cylc/cylc/labels{/name}","releases_url":"https://api.github.com/repos/cylc/cylc/releases{/id}","created_at":"2011-06-02T08:31:49Z","updated_at":"2015-12-09T22:22:58Z","pushed_at":"2016-01-05T10:31:15Z","git_url":"git://github.com/cylc/cylc.git","ssh_url":"git@github.com:cylc/cylc.git","clone_url":"https://github.com/cylc/cylc.git","svn_url":"https://github.com/cylc/cylc","homepage":"http://cylc.github.com/cylc","size":89474,"stargazers_count":32,"watchers_count":32,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":18,"mirror_url":null,"open_issues_count":172,"forks":18,"open_issues":172,"watchers":32,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/cylc/cylc/pulls/1700"},"html":{"href":"https://github.com/cylc/cylc/pull/1700"},"issue":{"href":"https://api.github.com/repos/cylc/cylc/issues/1700"},"comments":{"href":"https://api.github.com/repos/cylc/cylc/issues/1700/comments"},"review_comments":{"href":"https://api.github.com/repos/cylc/cylc/pulls/1700/comments"},"review_comment":{"href":"https://api.github.com/repos/cylc/cylc/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/cylc/cylc/pulls/1700/commits"},"statuses":{"href":"https://api.github.com/repos/cylc/cylc/statuses/0b7934fa3947e96d21a6b9704982e89c1b09c1f3"}}}}