Hi Frederic, that worked, i.e. NewPKI 2.0.0-beta3 runs in my distributed environment. The main repository "REP_alpha" resides on the alpha machine (protected internal LAN) and I could create the subsidiary repository "REP_dmz" successfully on the remote dmz machine (non protected, public). The REP_dmz was created on dmz as a standalone entity, that is, no prior installation of the PKI main entity on that machine. This also means, in setting up this there were no problems to generate the entity certificate for REP_dmz on the main instance using the "PKI admin" screen on the main instance. The REP_dmz is visible to the main instance and can be administrated from there via the "PKI admin" screen. Also, in the "Manage entities links" screen (rainbow colored button) the links are visible and configurable. The server instances talk to each other and do exchange their PKI config and PKI entity information.
Another question is whether it makes sense to reconfigure the links as set by default in the "Manage entities links". The default is the link REP_alpha <> REP_dmz. The link from/to the the subsidiary repository can indeed be reconfigured, at least on the adminstration level. This brings me to my other question. I wanted to check out if a subsidiary repository can hold just the data which should be visible on the dmz. There are conceptional implications. Specifically, on the dmz I need the CRL as issued from my CA. There should be no more data accessible/visible there than just the CRL. The related question is, in case I could access the CRL, if that should happen on the mysql level or LDAP level. At present I cannot justify what NewPKI offers with that regard. More can be asked on the concept of exchanging data between dmz and alpha with respect of the firewall. This means, pushing or pulling data for either server instance ? That refers to your note in the "Changes" document in the source doc of 2.0.0-beta3. Should be a matter for a new round. Wolf -----Urspr�ngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Fr�d�ric Giudicelli Gesendet: Mittwoch, 21. Januar 2004 13:11 An: [EMAIL PROTECTED] Betreff: Re: AW: server-2.0.0-beta3 / trouble repository objects [EMAIL PROTECTED] wrote: > The REP_dmz was built on the alpha (main) machine. The parameters of setting > up the REP_dmz in "Server admin" screen of the PKI residing on the alpha > machine are no doubt correct : "Add repository entity" points to the dmz > machine. No, there is a problem here, you need to connect to your DMZ (client) machine, using the Server GUI. You create the the Repository object called "REP_dmz". Now, you connect yourself to the PKI GUI on the alpha (main) machine, you import the signature request from "REP_dmz" into the PKI. You go back to your server GUI, and you import the signature response. > I did not create a separate PKI instance on the (client) dmz machine. In the > absence of better advice I assumed both machines would exchange the PKI > objects by themselves as a matter of concept. You must no create another PKI entity. > The entity REP_dmz was definitely not duplicated via synchronizing on the > dmz machine. That can be seen from looking into mysql, from the log > (attached) and from /var/log/newpki. The REP_dmz was just built on the alpha > machine. I think the problem, comes from your confusion about what the "Address" and "Port" fields are used for, when creating a Repository entity. Those fields are only used, to tell the PKI entity where this Repository can be accessed, this allows the other entities to know where they should connect to, to have access to their datas. In no case, a first server will connect to a second one, to tell this second one, "Please create this Repository". The Server Admin, must physically connect to the second server, create the Repository, then it must be declared into the PKI Entity, as mentioned above. Regards, -- Fr�d�ric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
