Turbo Fredriksson wrote:
On 9 Apr 2017, at 04:06, Howard Chu <h...@symas.com> wrote:
It's clear that nobody in the standards organizations considers storing private
keys in the directory to be a safe thing to do. IMO this is just a matter of
password security and good ACLs, and the standards should not preclude the
option. It is no worse than storing userPassword.
I agree (fwiw).
It needs to be stored SOMEWHERE. Usually it’s in/on the filesystem. And the
only two (?)
things that protect it there is:
1) The access permissions on the file. I.e., “ACLs".
2) No/limited users allowed on the system. I.e., "password security" (?)
So using “ACLs" and "password security" on the filesystem or in the directory,
shouldn’t be
that different.
Only difference might be that the local FS isn’t available _outside_ the host,
a directory
is.
As soon as a host offers something like ssh, then that distinction is gone too.
Moreover, a secure mechanism for distributing private keys to users is
required but nobody ever specifies how to do that. Certainly LDAP/TLS is more
manageable than sneakernet and this is more bootstrappable.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/