Self-linked entities : I have NewPKI_Client-2.0.0-beta3.exe on Win2000 installed, which should be the latest.
Now I got 9 entities with 2 repositories. They are shown in the links management. I rearranged some links for test. Especially, I cut the standard link between REP_alpha and REP_dmz. Then I tried to relink the latter. But there is something buggy. The picture does not reflect the new link. Instead, on the right hand screen one repository links to itself. Each test added another self-link REP_alpha <> REP_alpha. I can right-click the entities and the sub-menu pops up. The self-links REP_alpha <> REP_alpha cannot be deleted from that menu because the list of links is empty. Just the links from other (non-repository) entities are shown and managable. Clickable links : you gave advice �right-click to your link between the alpha maschine and the dmz machine ..� Sorry, on my NewPKI_Client-2.0.0-beta3.exe links cannot be clicked, since obviously no active items. -----Urspr�ngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Fr�d�ric Giudicelli Gesendet: Donnerstag, 22. Januar 2004 20:03 An: [EMAIL PROTECTED] Betreff: Re: AW: RE : server-2.0.0-beta3 / trouble repository objects [EMAIL PROTECTED] wrote: > Fredric, > > CRL : the dmz machine runs in non-protected environment. The issue is how to > read out the CRL, since CRL is needed in SSLCARevocationFile of my SSL > secured apache. This parameter requires an up-to-date CRL file. The other > alternative is accessing a CRL via LDAP along with configuring apache for > dynamic CRL acccess - provided the CRL resides in LDAP, e.g. supplied from > newpki. In the dmz I wanted local access to the CRL, either from selecting > it from mysql or selecting it from LDAP. On what is recommened I'm in the > dark since no white papers present. Is the CRL extractable from mysql at all > (I saw some promising in table logs_hash) ? Can LDAP be loaded via newpki to > contain the CRL ? No problem, you create a Publication Entity on your DMZ machine. Right now there is a LDAP publication module. For apache you probably will want to develop a "File publication" module, that will copy the CRL to a file. Then you can add a little script in /etc/cron.hourly, that will reload the apache. > Pulling/pushing : I do not want to come too close to the synchronization > concept and I can imagine side-effects which reach out far more. So > eventually I should refrain. Anyway, I feel pulling data by the dmz from the > alpha site is not a splendid idea. It implies open ports on the alpha > machine and anyone after successfully breaking into the dmz could try it > same way and to read out the entity conf info via mysql, e.g. via the open > standard port 3306. So my favourite is pushing/publishing. Even if you say > the config data is encrypted : the mysql server should not be regarded safe. No you didn't understand. Your DMZ machine will never connect to your alpha machine, but you need to let the repositories know, to do this: - go to the links management in the PKI GUI, - right click to your link between the alpha machine and the DMZ machine, uncheck the sentence "DMZ_rep can connect to DMZ_alpha" - now, only REP_alpha connects to REP_dmz, and it pushes/pulls datas to/from REP_dmz. -- Fr�d�ric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
