Re: OpenLDAP replication 'credentials'

[Philip Guenther <guenther+ldapsoft@sendmail.com>]

On Wed, 7 May 2008, Emmanuel Dreyfus wrote:
> Michael Ströder <michael@stroeder.com> wrote:
>
> > Anyway either the private key has to be stored somewhere 1. in clear or
> > 2. password-protected. 2. would require manual admin interaction during
> > startup. (I don't know whether that's supported at all.)
>
> Sure, but it's not a shared secret.

I'm not sure what you mean by that.

In both cases--setups using passwords and setups using TLS client 
certs--the one end has enough info to verify authentications (but not to 
forge them) while the other has a file that contains enough data to 
generate (and forge) authentications.  The name of the file containing 
that data is different, and the size of that data is different, but if you 
can read that file, you can forge connections.


Philip Guenther