Re: ssl certificate management

Le jeu 28/04/2005 à 06:16, Buchan Milne a écrit :
> >>Then some people proposed a full-blown PKI infrastructure. Oden just 
> > That is very interesting, but a bit overkill for the majority of desktop
> But what about the admin for a majority of desktop users?

I agree that a PKI infrastructure would be useful (hey, I'd be the first
one to use it ;-).

What I meant is that I think there are more immediate issues to
consider:

1) Right now, every server has a different certificate. This is bad,
because this means that every service has to be configured separately.
If the certificate and key was the same for all servers, a KDE user
would simply have to launch Konqueror, accept a master certificate, and
it would be accepted for smtp, pop and ldap.

2) Even worse than a different certificate is the fact that most
certificates are generated for localhost. This means that when you
accept a certificate for one server, you can't use it for others as they
conflict. I solved it for Apache, but other services have the same
problem

3) Many servers don't have ssl/tls enabled. For example, mod_ldap and
proftpd have to be recompiled, otherwise the only connection is LDAPv2
without ssl.

4) Many servers don't work with LDAP out of the box. Take ssh for
example, you have to add UsePAM=yes and
ChallengeResponseAuthentication=no to sshd_config. It would be great to
have this by default. And use pam_access instead of having both
pam_listfile and PermitRootLogins=no.

Even if we have no PKI infrastructure, if we could have just SSL
generate a CA by default, generate a single copy of certs that are used
across all servers, and have a simple way to regenerate them, that would
be a start.