Apparently there is a bug... I'll get back to you.
[EMAIL PROTECTED] wrote:
Self-linked entities :
I have NewPKI_Client-2.0.0-beta3.exe on Win2000 installed, which should be the latest.
Now I got 9 entities with 2 repositories. They are shown in the links management. I rearranged some links for test. Especially, I cut the standard link between REP_alpha and REP_dmz. Then I tried to relink the latter. But there is something buggy. The picture does not reflect the new link. Instead, on the right hand screen one repository links to itself. Each test added another self-link REP_alpha <> REP_alpha.
I can right-click the entities and the sub-menu pops up. The self-links REP_alpha <> REP_alpha cannot be deleted from that menu because the list of links is empty. Just the links from other (non-repository) entities are shown and managable.
Clickable links :
you gave advice “right-click to your link between the alpha maschine and the dmz machine ..” Sorry, on my NewPKI_Client-2.0.0-beta3.exe links cannot be clicked, since obviously no active items.
-----Ursprüngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Frédéric Giudicelli Gesendet: Donnerstag, 22. Januar 2004 20:03 An: [EMAIL PROTECTED] Betreff: Re: AW: RE : server-2.0.0-beta3 / trouble repository objects
[EMAIL PROTECTED] wrote:
Fredric,
CRL : the dmz machine runs in non-protected environment. The issue is how
to
read out the CRL, since CRL is needed in SSLCARevocationFile of my SSL secured apache. This parameter requires an up-to-date CRL file. The other alternative is accessing a CRL via LDAP along with configuring apache for dynamic CRL acccess - provided the CRL resides in LDAP, e.g. supplied from newpki. In the dmz I wanted local access to the CRL, either from selecting it from mysql or selecting it from LDAP. On what is recommened I'm in the dark since no white papers present. Is the CRL extractable from mysql at
all
(I saw some promising in table logs_hash) ? Can LDAP be loaded via newpki
to
contain the CRL ?
No problem, you create a Publication Entity on your DMZ machine. Right now there is a LDAP publication module. For apache you probably will want to develop a "File publication" module, that will copy the CRL to a file. Then you can add a little script in /etc/cron.hourly, that will reload the apache.
Pulling/pushing : I do not want to come too close to the synchronization concept and I can imagine side-effects which reach out far more. So eventually I should refrain. Anyway, I feel pulling data by the dmz from
the
alpha site is not a splendid idea. It implies open ports on the alpha machine and anyone after successfully breaking into the dmz could try it same way and to read out the entity conf info via mysql, e.g. via the open standard port 3306. So my favourite is pushing/publishing. Even if you say the config data is encrypted : the mysql server should not be regarded
safe.
No you didn't understand. Your DMZ machine will never connect to your alpha machine, but you need to let the repositories know, to do this: - go to the links management in the PKI GUI, - right click to your link between the alpha machine and the DMZ machine, uncheck the sentence "DMZ_rep can connect to DMZ_alpha" - now, only REP_alpha connects to REP_dmz, and it pushes/pulls datas to/from REP_dmz.
-- Frédéric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
_____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
-- Frédéric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
