[EMAIL PROTECTED] wrote:
Another question is whether it makes sense to reconfigure the links as set by default in the "Manage entities links". The default is the link REP_alpha <> REP_dmz. The link from/to the the subsidiary repository can indeed be reconfigured, at least on the adminstration level. This brings me to my other question.
I wanted to check out if a subsidiary repository can hold just the data which should be visible on the dmz. There are conceptional implications. Specifically, on the dmz I need the CRL as issued from my CA. There should be no more data accessible/visible there than just the CRL.
Right now every thing is synchronized, but be aware that the datas are always encrypted at destination of the the recipient entity, and signed by the sending entity.
So even if a hacker, breaks into your dmz machine, he will never be able to actually read the entities' conf, or their objects, nor push some phoney objects.
Meaning, if you cannot trust encryption, who can you trust ? :)
The related question is, in case I could access the CRL, if that should happen on the mysql level or LDAP level. At present I cannot justify what NewPKI offers with that regard.
I don't understand what you mean.
More can be asked on the concept of exchanging data between dmz and alpha with respect of the firewall. This means, pushing or pulling data for either server instance ? That refers to your note in the "Changes" document in the source doc of 2.0.0-beta3. Should be a matter for a new round.
It means that one of the repository is aware that it should pull datas, as well, from the other repository, intead of only pushing.
-- Fr�d�ric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
