Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consolidate SSL setup and all service certs to ~/data/security/ssl #921

Closed
fnoop opened this issue Feb 24, 2020 · 4 comments
Closed

Consolidate SSL setup and all service certs to ~/data/security/ssl #921

fnoop opened this issue Feb 24, 2020 · 4 comments
Milestone

Comments

@fnoop
Copy link
Member

fnoop commented Feb 24, 2020

Currently maverick_web creates certs from CA and adds to ~/data/web/ssl. LDAP should create certs, and visiond as well. We should consolidate all the certs into ~/data/security/ssl.

@fnoop
Copy link
Member Author

fnoop commented Feb 24, 2020

Need to create docs around how to security setup ssl. Currently there is a default CA passphrase:
maverick_security::ssl::ca_passphrase

This should be set by each user in a secure environment and all the certs recreated, and documented.

@fnoop fnoop added this to the 1.2 milestone Feb 24, 2020
@fnoop
Copy link
Member Author

fnoop commented Feb 24, 2020

Re-enabled the SSL upgrade page in -web-legacy:
Screenshot 2020-02-24 at 20 17 21

@fnoop
Copy link
Member Author

fnoop commented Feb 24, 2020

Oh yeah I remember why ldap_server certs are out there on their own. OpenLDAP (slapd) expects it's config/ssl in /etc/ldap and database in /var/lib, and gets very upset if they're not (on debian/ubuntu this is down to apparmor, in no small part).
OLC which is the inband config for openldap (you config openldap using openldap) and is an absolute nightmare to deal with. It's extremely sensitive to SSL config.
OpenLDAP in general is just horrible to deal with. Hopefully we can replace with a more modern IAM alternative in the future. For now, leave it well alone.

@fnoop
Copy link
Member Author

fnoop commented Feb 24, 2020

For now, SSL setup is consolidated.

@fnoop fnoop closed this as completed Feb 24, 2020
fnoop added a commit that referenced this issue Feb 25, 2020
fnoop added a commit that referenced this issue Apr 15, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant