PKCS11 interface on DNS
by Petr Menšík
Hello,
I am ISC BIND maintainer in Fedora. Maybe you know freeipa is using BIND
as secure DNS interface to LDAP. Freeipa is using special build of BIND
in Fedora, called bind-pkcs11. It uses native PKCS#11 interface instead
of built-in routines. It uses PKCS#11 not only for protected storage of
private keys, but also for any cryptography operation. It uses also
digest from pkcs11 modules.
ISC upstream asked some time ago on requirements on such interface [1].
I have to admit I do not know what features freeipa requires from it. I
would like to ask that here. Default pkcs11 interface is softhsm2
PKCS#11 module, software version linked to openssl.
Is pkcs11 used also as hardware crypto accelerator? It definitely can be
used from bind-pkcs11 to offload digest or verification to hardware
module. Do you know if that is used or wanted? Is it tested on any real
Hardware Security Module? Are there any requirements on HSM support from
freeipa?
Current code in BIND contains a lot of digest and crypto code
duplication. Upstream would like to reduce usage of PKCS#11 only to
secure storage of PKI (DNSSEC) keys. Other features should use openssl
for it. It would be useful also on Fedora. If acceleration via hardware
module should be used, OpenSSL engine could be used for it instead.
Because the way bind it built, it still depends on OpenSSL library
anyway, even in PKCS11 build.
I would like to use digest messages from OpenSSL in both bind and
bind-pkcs11 in upcoming releases. It would no longer use PKCS#11 module
for signature verification. Are there any objections to it? Would it
break something?
1. https://lists.isc.org/pipermail/bind-users/2018-June/100254.html
Best Regards,
Petr
--
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemensik(a)redhat.com PGP: 65C6C973
5 years, 9 months
Updating time&data servers system
by Andrey Bychkov
Hello!
I'm thinking of adding a separate modules, which will contain all the
functions for working with the time and date server. Namely:
1. Will be create a file ntpserverconf.py in the ipaserver/install/
directory. This file will contain configurations and methods for
configuring the time server and synchronization. The methods from this
file will be called when you install the server
(ipaserver/install/server/install.py).
2. Will be create the ntpclientconf.py file in the ipaclient/install/
directory. This file will contain methods for synchronizing the client
with the server, which will be called from ipaclient/install/client.py
3. Will be add support for ntpd and openntpd time servers
4. Will be add a mechanism for selecting the server configuration,
depending on what is present in the system
5. Also, can make packages for each time server with its dependencies.
This will ensure the operation of the freeipa on platforms with
different time servers and will simplify the addition of support for the
new servers.
What can you say about this?
5 years, 9 months
[freeipa PR#2160][opened] Fix KRA replica installation from CA master
by tiran
URL: https://github.com/freeipa/freeipa/pull/2160
Author: tiran
Title: #2160: Fix KRA replica installation from CA master
Action: opened
PR body:
"""
ipa-replica-install --kra-install can fail when the topology already has
a KRA, but replica is installed from a master with just CA. In that
case, Custodia may pick a machine that doesn't have the KRA auditing and
signing certs in its NSSDB.
Example:
* master with CA
* replica1 with CA and KRA
* new replica gets installed from master
The replica installer now always picks a KRA peer.
The change fixes test scenario TestInstallWithCA1::()::test_replica2_ipa_dns_install
Fixes: https://pagure.io/freeipa/issue/7518
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2160/head:pr2160
git checkout pr2160
5 years, 9 months
Consider the tree frozen
by Rob Crittenden
One final patch is going to be pushed this morning, Christian's KRA PR,
and then consider the tree to be frozen until I can do the release work.
thanks
rob
5 years, 9 months