Revert RL9 crypto policy to DEFAULT

priteau · priteau · commit 77eb16dc81b6 · 2026-01-13T23:51:22.000+01:00
This should resolve SSH issues with some modern key types such as
ed25519.
diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis
@@ -27,7 +27,8 @@ rhel9cis_rule_3_4_1_2: false
 rhel9cis_selinux_disable: true
 
 # NOTE: FUTURE breaks wazuh agent repo metadata download
-rhel9cis_crypto_policy: FIPS
+# NOTE: FIPS break ed25519 SSH keys
+rhel9cis_crypto_policy: DEFAULT
 
 # Skip package updates
 rhel9cis_rule_1_9: false
diff --git a/releasenotes/notes/rhel9cis-crypto-policy-default-2de03e6a67a9efae.yaml b/releasenotes/notes/rhel9cis-crypto-policy-default-2de03e6a67a9efae.yaml
@@ -0,0 +1,6 @@
+---
+security:
+  - |
+    Updates the default CIS hardening configuration to set
+    ``rhel9cis_crypto_policy`` to ``DEFAULT`` instead of ``FIPS``. This
+    resolves SSH issues with some modern key types such as ``ed25519``.
