Fredric, CRL : the dmz machine runs in non-protected environment. The issue is how to read out the CRL, since CRL is needed in SSLCARevocationFile of my SSL secured apache. This parameter requires an up-to-date CRL file. The other alternative is accessing a CRL via LDAP along with configuring apache for dynamic CRL acccess - provided the CRL resides in LDAP, e.g. supplied from newpki. In the dmz I wanted local access to the CRL, either from selecting it from mysql or selecting it from LDAP. On what is recommened I'm in the dark since no white papers present. Is the CRL extractable from mysql at all (I saw some promising in table logs_hash) ? Can LDAP be loaded via newpki to contain the CRL ?
Pulling/pushing : I do not want to come too close to the synchronization concept and I can imagine side-effects which reach out far more. So eventually I should refrain. Anyway, I feel pulling data by the dmz from the alpha site is not a splendid idea. It implies open ports on the alpha machine and anyone after successfully breaking into the dmz could try it same way and to read out the entity conf info via mysql, e.g. via the open standard port 3306. So my favourite is pushing/publishing. Even if you say the config data is encrypted : the mysql server should not be regarded safe. Wolf -----Urspr�ngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Fr�d�ric Giudicelli Gesendet: Donnerstag, 22. Januar 2004 14:28 An: [EMAIL PROTECTED] Betreff: Re: RE : server-2.0.0-beta3 / trouble repository objects [EMAIL PROTECTED] wrote: > Another question is whether it makes sense to reconfigure the links as set > by default in the "Manage entities links". The default is the link REP_alpha > <> REP_dmz. The link from/to the the subsidiary repository can indeed be > reconfigured, at least on the adminstration level. This brings me to my > other question. > > I wanted to check out if a subsidiary repository can hold just the data > which should be visible on the dmz. There are conceptional implications. > Specifically, on the dmz I need the CRL as issued from my CA. There should > be no more data accessible/visible there than just the CRL. Right now every thing is synchronized, but be aware that the datas are always encrypted at destination of the the recipient entity, and signed by the sending entity. So even if a hacker, breaks into your dmz machine, he will never be able to actually read the entities' conf, or their objects, nor push some phoney objects. Meaning, if you cannot trust encryption, who can you trust ? :) > The related question is, in case I could access the CRL, if that should > happen on the mysql level or LDAP level. At present I cannot justify what > NewPKI offers with that regard. I don't understand what you mean. > More can be asked on the concept of exchanging data between dmz and alpha > with respect of the firewall. This means, pushing or pulling data for either > server instance ? That refers to your note in the "Changes" document in the > source doc of 2.0.0-beta3. Should be a matter for a new round. It means that one of the repository is aware that it should pull datas, as well, from the other repository, intead of only pushing. -- Fr�d�ric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
