[EMAIL PROTECTED] wrote:
Fredric,
CRL : the dmz machine runs in non-protected environment. The issue is how to read out the CRL, since CRL is needed in SSLCARevocationFile of my SSL secured apache. This parameter requires an up-to-date CRL file. The other alternative is accessing a CRL via LDAP along with configuring apache for dynamic CRL acccess - provided the CRL resides in LDAP, e.g. supplied from newpki. In the dmz I wanted local access to the CRL, either from selecting it from mysql or selecting it from LDAP. On what is recommened I'm in the dark since no white papers present. Is the CRL extractable from mysql at all (I saw some promising in table logs_hash) ? Can LDAP be loaded via newpki to contain the CRL ?
No problem, you create a Publication Entity on your DMZ machine.
Right now there is a LDAP publication module. For apache you probably will want to develop a "File publication" module, that will copy the CRL to a file. Then you can add a little script in /etc/cron.hourly, that will reload the apache.
Pulling/pushing : I do not want to come too close to the synchronization concept and I can imagine side-effects which reach out far more. So eventually I should refrain. Anyway, I feel pulling data by the dmz from the alpha site is not a splendid idea. It implies open ports on the alpha machine and anyone after successfully breaking into the dmz could try it same way and to read out the entity conf info via mysql, e.g. via the open standard port 3306. So my favourite is pushing/publishing. Even if you say the config data is encrypted : the mysql server should not be regarded safe.
No you didn't understand. Your DMZ machine will never connect to your alpha machine, but you need to let the repositories know, to do this:
- go to the links management in the PKI GUI,
- right click to your link between the alpha machine and the DMZ machine, uncheck the sentence "DMZ_rep can connect to DMZ_alpha"
- now, only REP_alpha connects to REP_dmz, and it pushes/pulls datas to/from REP_dmz.
-- Fr�d�ric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
