Document the HSM Daemon#802
Conversation
sharidas
left a comment
sharidas
left a comment
There was a problem hiding this comment.
This document looks excellent 👍 One small comment added regarding the PR mentioned.
|
Not everyone is aware about the term |
settermjd
force-pushed
the
document-hsmdaemon
branch
2 times, most recently
from
7a6dde4 to
7642b88
Compare
|
Before merging, pls see my comment #802 (comment) Update: solved |
settermjd
force-pushed
the
document-hsmdaemon
branch
from
80b6577 to
320f297
Compare
Further updated the documentation based on [feedback](#802 (comment)) from @butonic.
|
@settermjd one more thing:
When using hsmdaemon with an HSM, the keys can be stored on a different physical machine as ownCloud. Sorry for nitpicking: the keys may actually land on the same machine. The HSM might only be used to decrypt them. I think rephrasing with can is a good way to describe the situation. |
|
@butonic, with respect to #802 (comment), please do nit-pick. I'm all for it to ensure 100% accuracy and quality of the documentation. However, that change likely invalidates the two sentences that follow after. |
|
@settermjd hm that sounds confusing ... why point out that there is still insecurity left ... When using hsmdaemon with an HSM, the keys can be stored on a different physical machine as ownCloud. Sounds more positive, doesn't it? I feel that it conveys the idea of moving the keys elsewhere. If it really happens depends on the implementation details of the HSM. We shouldn't bother going into that, otherwise we might have to go into the details of individual HSM modules and how and where they store key material. I think it still makes sense to give SoftHSM2 as an example later, together with the corresponding threat model. |
|
Okay. That sounds fair to me. |
settermjd
force-pushed
the
document-hsmdaemon
branch
from
605db58 to
7f511d8
Compare
|
@butonic, change made. |
settermjd
force-pushed
the
document-hsmdaemon
branch
from
705083a to
7bcc417
Compare
* Document the HSM Daemon * Heavily reworked the hsmdaemon documentation - Provide installation instructions on all supported distributions - Remove duplicate content - Provide configuration file and binary path information - Add admonitions to make the content clearer and simpler - Add in-page navigation lists to make movement more efficient This fixes #586.
6 participants
I'm not quite sure if this is what you want, but I've done my best to take the existing hsmdaemon documentation, to work through it and revise it, where necessary; after which I've integrated it into the ownCloud docs.
@sharidas, can you let me know if it goes far enough, or if something is missing?
This fixes #586.