Re: securing FAS certs

2008-08-26 Thread Stephen John Smoogen
2008/8/21 Toshio Kuratomi [EMAIL PROTECTED]: Hey bright idea bringers! The Fedora Certificates issued by FAS are currently set to be autogenerated if you have an account in FAS. This has one drawback. We have to keep the password for the CA keys that sign the FAS certificates in a file on

Re: securing FAS certs

2008-08-25 Thread Jesse Keating
On Sat, 2008-08-23 at 09:43 +0200, Mark Wormgoor wrote: Most of these cards work with OpenSSL just fine - though I'm not sure what additional hardware drivers are required to interface to the card. The crypto cards I'm aware of require a binary kernel driver. Not suitable for Fedora

Re: securing FAS certs

2008-08-23 Thread Mark Wormgoor
Toshio Kuratomi schreef: Mike McGrath wrote: On Thu, 21 Aug 2008, Ricky Zhou wrote: On 2008-08-21 02:21:34 PM, Mike McGrath wrote: I've never actually used a crypto card... Do they add additional security if they're sitting in a colo always plugged in? If so how do they do that? I might

Re: securing FAS certs

2008-08-22 Thread Mike McGrath
On Fri, 22 Aug 2008, David Lutterkort wrote: On Thu, 2008-08-21 at 14:18 -0500, Jeffrey Ollie wrote: What about using a crypto card like Jesse plans on using for Sigul? I wonder if a TPM can be (ab)used for this, too; they are pretty common on newer hardware, and store a key in HW that can

securing FAS certs

2008-08-21 Thread Toshio Kuratomi
Hey bright idea bringers! The Fedora Certificates issued by FAS are currently set to be autogenerated if you have an account in FAS. This has one drawback. We have to keep the password for the CA keys that sign the FAS certificates in a file on the filesystem so that the automatic signing

Re: securing FAS certs

2008-08-21 Thread Jeffrey Ollie
2008/8/21 Toshio Kuratomi [EMAIL PROTECTED]: The Fedora Certificates issued by FAS are currently set to be autogenerated if you have an account in FAS. This has one drawback. We have to keep the password for the CA keys that sign the FAS certificates in a file on the filesystem so that the

Re: securing FAS certs

2008-08-21 Thread Ricky Zhou
On 2008-08-21 02:21:34 PM, Mike McGrath wrote: I've never actually used a crypto card... Do they add additional security if they're sitting in a colo always plugged in? If so how do they do that? I might be wrong, but I think with such a card, encryption/signing takes place entirely on the

Re: securing FAS certs

2008-08-21 Thread Mike McGrath
On Thu, 21 Aug 2008, Ricky Zhou wrote: On 2008-08-21 02:21:34 PM, Mike McGrath wrote: I've never actually used a crypto card... Do they add additional security if they're sitting in a colo always plugged in? If so how do they do that? I might be wrong, but I think with such a card,

Re: securing FAS certs

2008-08-21 Thread Jeffrey Ollie
On Thu, Aug 21, 2008 at 2:21 PM, Mike McGrath [EMAIL PROTECTED] wrote: On Thu, 21 Aug 2008, Jeffrey Ollie wrote: What about using a crypto card like Jesse plans on using for Sigul? I've never actually used a crypto card... Do they add additional security if they're sitting in a colo always

Re: securing FAS certs

2008-08-21 Thread Toshio Kuratomi
Mike McGrath wrote: On Thu, 21 Aug 2008, Ricky Zhou wrote: On 2008-08-21 02:21:34 PM, Mike McGrath wrote: I've never actually used a crypto card... Do they add additional security if they're sitting in a colo always plugged in? If so how do they do that? I might be wrong, but I think with