ssh: remove diffie-hellman-group-exchange-sha256 key exchange algorithm
because of a bug in openssh which weakens security. The algorithm can be
added again by setting
services.openssh.settings.KexAlgorithms = [ "diffie-hellman-group-exchange-sha256" ];
if old clients should require it.
This also adds the diffie-hellman-group16-sha512 and diffie-hellman-group18-sha512
kex algorithms (PL-131620).
agent: improve scheduling of maintenance activities for system updates and
VM property changes (memory, CPU cores). The main change is that activities
can be merged/updated now. As a result, the number of reboots is reduced
and multiple pending updates can be applied faster. Activities can be
cancelled if they are no longer effective, for example if a memory change
is requested in error and reset to the previous value some time later.
Reboots for kernel updates now happen directly after system updates,
avoiding scheduling another maintenance for the reboot. We also fixed the
long-standing bug that delayed activities could be executed outside of
maintenance windows. Activities that are overdue (more than 30min after
planned time) are postponed for at least 8 hours and scheduled again
(PL-129777).
agent: handle special exit codes of maintenance enter commands (defined by
flyingcircus.agent.maintenance.enter.*) correctly. They can now use
EXIT_POSTPONE (69) or EXIT_TEMPFAIL (75) to stop execution before
maintenance requests are run, typically when pre-conditions are not met.
This is currently not used by platform code but will be useful to prevent
redundant machines from having service interruptions caused by automated
maintenance at the same time (PL-130625).
python: re-enable the crypt module for obsolete Python version 2.7
to fix compatibility with legacy applications (PL-131527).
Enable and configure fail2ban to reduce the impact of brute force attacks
against SSH (PL-131632).