[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Storing TLS credentials in the directory

Turbo Fredriksson wrote:
On 9 Apr 2017, at 04:06, Howard Chu <hyc@symas.com> wrote:

It's clear that nobody in the standards organizations considers storing private keys in the directory to be a safe thing to do. IMO this is just a matter of password security and good ACLs, and the standards should not preclude the option. It is no worse than storing userPassword.

I agree (fwiw).

It needs to be stored SOMEWHERE. Usually it’s in/on the filesystem. And the only two (?)
things that protect it there is:

   1) The access permissions on the file. I.e., “ACLs".
   2) No/limited users allowed on the system. I.e., "password security" (?)

So using “ACLs" and "password security" on the filesystem or in the directory, shouldn’t be
that different.

Only difference might be that the local FS isn’t available _outside_ the host, a directory

As soon as a host offers something like ssh, then that distinction is gone too.

Moreover, a secure mechanism for distributing private keys to users is required but nobody ever specifies how to do that. Certainly LDAP/TLS is more manageable than sneakernet and this is more bootstrappable.

  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/