Re: Re-encrypt on change of master key

2017-03-16 Thread Quanah Gibson-Mount
Everything's in git. You can fork your own repo and submit merge requests. That's what I do. --Quanah --On Thursday, March 16, 2017 1:47 PM -0700 "Henry B (Hank) Hotz, CISSP" wrote: Russ and I have submitted patches to the man pages in the past, much like code patches. I assume similar su

Re: Re-encrypt on change of master key

2017-03-16 Thread Henry B (Hank) Hotz, CISSP
Russ and I have submitted patches to the man pages in the past, much like code patches. I assume similar submissions for the web pages would be handled somehow? I would be more likely to do so if I had an account that allowed editing. > On Mar 16, 2017, at 12:07 PM, Adam Lewenberg wrote: > >

Re: Re-encrypt on change of master key

2017-03-16 Thread Adam Lewenberg
On 3/16/2017 12:03 PM, Henry B (Hank) Hotz, CISSP wrote: +1 On Mar 15, 2017, at 5:51 AM, Jeffrey Altman wrote: On 3/15/2017 5:17 AM, Lars-Johan Liman wrote: Hi! This whole thread contains a lot of really good information. Is this all documented in a good way (preferrably with examples) so

Re: Re-encrypt on change of master key

2017-03-16 Thread Henry B (Hank) Hotz, CISSP
+1 > On Mar 15, 2017, at 5:51 AM, Jeffrey Altman > wrote: > > On 3/15/2017 5:17 AM, Lars-Johan Liman wrote: >> Hi! >> >> This whole thread contains a lot of really good information. Is this all >> documented in a good way (preferrably with examples) somewhere? If so, >> pointer please. If not,

Re: Re-encrypt on change of master key

2017-03-15 Thread Jeffrey Altman
On 3/15/2017 5:17 AM, Lars-Johan Liman wrote: > Hi! > > This whole thread contains a lot of really good information. Is this all > documented in a good way (preferrably with examples) somewhere? If so, > pointer please. If not, can it please be? > It is not. Contributions are welcome. smi

Re: Re-encrypt on change of master key

2017-03-15 Thread Lars-Johan Liman
Hi! This whole thread contains a lot of really good information. Is this all documented in a good way (preferrably with examples) somewhere? If so, pointer please. If not, can it please be? Cheers, /Liman #-

Re: Re-encrypt on change of master key

2017-03-14 Thread Adam Lewenberg
On 3/14/2017 3:57 PM, Nico Williams wrote: On Tue, Mar 14, 2017 at 03:54:36PM -0700, Adam Lewenberg wrote: If you use a master key and you back up all your files _except_ the master key to some remote location, wouldn't that suffice to protect the database in that remote location? No. The p

Re: Re-encrypt on change of master key

2017-03-14 Thread Nico Williams
On Tue, Mar 14, 2017 at 03:54:36PM -0700, Adam Lewenberg wrote: > If you use a master key and you back up all your files _except_ the master > key to some remote location, wouldn't that suffice to protect the database > in that remote location? No. The problem is that the master key is not used t

Re: Re-encrypt on change of master key

2017-03-14 Thread Adam Lewenberg
On 3/14/2017 12:54 PM, Nico Williams wrote: On Tue, Mar 14, 2017 at 12:32:10PM -0700, Russ Allbery wrote: "Henry B (Hank) Hotz, CISSP" writes: Shut down all daemons on the master. hprop --decrypt --stdout | hpropd --stdin Restart all daemons. You probably also want to shut down incre

Re: Re-encrypt on change of master key

2017-03-14 Thread Nico Williams
On Tue, Mar 14, 2017 at 06:41:06PM -0400, Jeffrey Hutzelman wrote: > On March 14, 2017 6:32:13 PM EDT, Nico Williams wrote: > >On Tue, Mar 14, 2017 at 03:26:57PM -0700, Henry B (Hank) Hotz, CISSP > >wrote: > >> Probably, but encrypting the key material separately doesn’t seem > >like a bad thing.

Re: Re-encrypt on change of master key

2017-03-14 Thread Jeffrey Hutzelman
On March 14, 2017 6:32:13 PM EDT, Nico Williams wrote: >On Tue, Mar 14, 2017 at 03:26:57PM -0700, Henry B (Hank) Hotz, CISSP >wrote: >> Probably, but encrypting the key material separately doesn’t seem >like a bad thing. > >It's a waste of CPU cycles. It adds no real protection _by itself_ >unles

Re: Re-encrypt on change of master key

2017-03-14 Thread Nico Williams
On Tue, Mar 14, 2017 at 03:26:57PM -0700, Henry B (Hank) Hotz, CISSP wrote: > > On Mar 14, 2017, at 12:54 PM, Nico Williams wrote: > > Good point, but actually restarting the daemons does not force a full > > resync. You have to remove the iprop log file (on the master and/or the > > slaves -- ei

Re: Re-encrypt on change of master key

2017-03-14 Thread Henry B (Hank) Hotz, CISSP
> On Mar 14, 2017, at 12:54 PM, Nico Williams wrote: > > On Tue, Mar 14, 2017 at 12:32:10PM -0700, Russ Allbery wrote: >> "Henry B (Hank) Hotz, CISSP" writes: >>> Shut down all daemons on the master. >> >>> hprop --decrypt --stdout | hpropd --stdin >> >>> Restart all daemons. >> >> You proba

Re: Re-encrypt on change of master key

2017-03-14 Thread Nico Williams
On Tue, Mar 14, 2017 at 12:32:10PM -0700, Russ Allbery wrote: > "Henry B (Hank) Hotz, CISSP" writes: > > Shut down all daemons on the master. > > > hprop --decrypt --stdout | hpropd --stdin > > > Restart all daemons. > > You probably also want to shut down incremental propagation while you do >

Re: Re-encrypt on change of master key

2017-03-14 Thread Russ Allbery
"Henry B (Hank) Hotz, CISSP" writes: > Shut down all daemons on the master. > hprop --decrypt --stdout | hpropd --stdin > Restart all daemons. You probably also want to shut down incremental propagation while you do this. I think this should force a full resync when the slaves reconnect, but

Re: Re-encrypt on change of master key

2017-03-14 Thread Henry B (Hank) Hotz, CISSP
https://www.mail-archive.com/heimdal-discuss@sics.se/msg00334.html There’s also a long, historically-interesting, thread on migrating from MIT that includes an example. > On Mar 14, 2017, at 11:51 AM, Henry B (Hank) Hotz, CISSP > wrote: > >> On Mar 14, 2017, at 9:43 AM, Adam Lewenberg wrote:

Re: Re-encrypt on change of master key

2017-03-14 Thread Henry B (Hank) Hotz, CISSP
How’s the contract coming? > On Mar 14, 2017, at 9:43 AM, Adam Lewenberg wrote: > > How do I re-encrypt the entries of the Heimdal KDC database if I want to > change its master key? Shut down all daemons on the master. hprop --decrypt --stdout | hpropd --stdin Restart all daemons. That’s fr

Re-encrypt on change of master key

2017-03-14 Thread Adam Lewenberg
How do I re-encrypt the entries of the Heimdal KDC database if I want to change its master key?