[Date Prev][Date Next]
Re: Storing TLS credentials in the directory
- To: Turbo Fredriksson <firstname.lastname@example.org>, OpenLDAPemail@example.com
- Subject: Re: Storing TLS credentials in the directory
- From: Howard Chu <firstname.lastname@example.org>
- Date: Sun, 9 Apr 2017 11:29:55 +0100
- In-reply-to: <WMemail@example.com>
- References: <E1cx31W-0005aD-M5@euler.openldap.org> <WMfirstname.lastname@example.org> <email@example.com> <9444E7C8-A0A8-464B-9BAA-B057162CF14F@bayour.com> <BE9CD1C3-B433-453A-92EE-258046EA3796@bayour.com> <WMfirstname.lastname@example.org>
- User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0 SeaMonkey/2.46a2
Turbo Fredriksson wrote:
On 9 Apr 2017, at 04:06, Howard Chu <email@example.com> wrote:
It's clear that nobody in the standards organizations considers storing private keys in the directory to be a safe thing to do. IMO this is just a matter of password security and good ACLs, and the standards should not preclude the option. It is no worse than storing userPassword.
I agree (fwiw).
It needs to be stored SOMEWHERE. Usually it’s in/on the filesystem. And the only two (?)
things that protect it there is:
1) The access permissions on the file. I.e., “ACLs".
2) No/limited users allowed on the system. I.e., "password security" (?)
So using “ACLs" and "password security" on the filesystem or in the directory, shouldn’t be
Only difference might be that the local FS isn’t available _outside_ the host, a directory
As soon as a host offers something like ssh, then that distinction is gone too.
Moreover, a secure mechanism for distributing private keys to users is
required but nobody ever specifies how to do that. Certainly LDAP/TLS is more
manageable than sneakernet and this is more bootstrappable.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/