Re: Urgent: remove password from server cert?

2001-05-02 Thread Paul
Forsake rebooting, use Unix! (-: LOL!! I'm with you, bud. But it *is* UNIX, just 10.2(only recently upgraded to that!) on an old T-500 machine. We just try to keep it clean. =o) __ Do You Yahoo!? Send instant messages get email alerts with

Re: Urgent: remove password from server cert?

2001-05-02 Thread James Treworgy
Add: SSLPassPhraseDialog exec:(path to SSLpassphrasefile) to httpd.conf SSLpassphrasefile is: #!/bin/sh echo (passphrase) Of course, this is a security risk, since you've got your pass phrase stored on the server itself in clear text. The consequences of that should be considered. You

Urgent: remove password from server cert?

2001-05-02 Thread Paul
In a sudden (and late) moment of epiphany, I just realized (while writing a note to our CSA to please put the new server's startup in the machines boot cycle) that when we reboot (*every* monday morning in the wee hours) it's not terribly likely that anyone's going to be around to feed the

Re: Urgent: remove password from server cert?

2001-05-02 Thread cfaber
Paul, if all else fails you can use 'expect' script, but im sure an rc script should do the job nicely. Paul wrote: In a sudden (and late) moment of epiphany, I just realized (while writing a note to our CSA to please put the new server's startup in the machines boot cycle) that when we

Re: Urgent: remove password from server cert?

2000-06-01 Thread Victor STANESCU
First question: Is there any logical reason to reboot every week? If you are speaking a real, production-environment server, it is stupid to do such a thing.. It should have months or years of uptime.. The only excuse for a reboot can be: - hardware upgrade / failure - operating system upgrade /

Re: Urgent: remove password from server cert?

2000-06-01 Thread Paul
Forsake rebooting, use Unix! (-: LOL!! I'm with you, bud. But it *is* UNIX, just 10.2(only recently upgraded to that!) on an old T-500 machine. We just try to keep it clean. =o) __ Do You Yahoo!? Send instant messages get email alerts with

Re: Urgent: remove password from server cert?

2000-06-01 Thread James Treworgy
Add: SSLPassPhraseDialog exec:(path to SSLpassphrasefile) to httpd.conf SSLpassphrasefile is: #!/bin/sh echo (passphrase) Of course, this is a security risk, since you've got your pass phrase stored on the server itself in clear text. The consequences of that should be considered. You

Re: Urgent: remove password from server cert?

2000-06-01 Thread Jacob Cohen
SSLpassphrasefile is: #!/bin/sh echo (passphrase) Write a program in C. First thing to check is to make sure that stdout is not a tty. There are various things you can do to make it harder and harder for a hacker to steal your key. But if the hacker has root on your machine, there's really

Re: Urgent: remove password from server cert?

2000-06-01 Thread Paul
--- Victor STANESCU [EMAIL PROTECTED] wrote: First question: Is there any logical reason to reboot every week? If you are speaking a real, production-environment server, it is stupid to do such a thing. It should have months or years of uptime.. The only excuse for a reboot can be: -

Re: Urgent: remove password from server cert?

2000-06-01 Thread James Lyon
machines boot cycle) that when we reboot (*every* monday morning in the wee hours) it's not terribly likely that anyone's going to be around to feed the password to the startup query. Why reboot every week? My web servers are never rebooted, save for hardware upgrades... This really needs

Urgent: remove password from server cert?

2000-05-31 Thread Paul
In a sudden (and late) moment of epiphany, I just realized (while writing a note to our CSA to please put the new server's startup in the machines boot cycle) that when we reboot (*every* monday morning in the wee hours) it's not terribly likely that anyone's going to be around to feed the

Re: Urgent: remove password from server cert?

2000-05-31 Thread Winged Wolf
(Ralf: Documentation bug, see below for details) This is addressed in the FAQ: http://www.modssl.org/docs/2.6/ssl_faq.html#ToC31 . "When you can be sure that your server is secure enough you perform two steps: 1. Remove the encryption from the RSA private key (while perserving the original