Backups - Revision history

Adj: /* for data in motion */

2014-02-24T22:35:06Z

for data in motion

← Older revision		Revision as of 22:35, 24 February 2014
Line 147:		Line 147:
	The following section details a PKI using 8192 bit RSA keys. It turns out these don't work at run-time. Errors like		The following section details a PKI using 8192 bit RSA keys. It turns out these don't work at run-time. Errors like
	Feb 19 15:08:38 sacredchao bareos-dir: crypto_openssl.c:1475 Connect failure: ERR=error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size		Feb 19 15:08:38 sacredchao bareos-dir: crypto_openssl.c:1475 Connect failure: ERR=error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size
	will be seen in your logs. I'll be dialing back RSA key sizes until by 1024 until I find something that works at runtime. As of 20 Feb 2014, 7168 bit RSA keys do not appear to work, either. Nor do 6144 bit keys.		will be seen in your logs. I'll be dialing back RSA key sizes until by 1024 until I find something that works at runtime. As of 20 Feb 2014, 7168 bit RSA keys do not appear to work, either. Nor do 6144 bit keys. Nor 5120 bit keys. And reducing the size of the DH parameters used to 1024 bytes doesn't help, either.

	So let's create a two-level public key infrastructure, two certificate authorities (one root and a subordinate), for this:		So let's create a two-level public key infrastructure, two certificate authorities (one root and a subordinate), for this:

Adj: /* for data in motion */

2014-02-21T16:16:42Z

for data in motion

← Older revision		Revision as of 16:16, 21 February 2014
Line 144:		Line 144:
	=== for data in motion ===		=== for data in motion ===
	Bacula has provisions for [http://en.wikipedia.org/wiki/Transport_Layer_Security TLS]-ecapsulated communication between the various components. Bareos has kept these intact. This functionality allows the director, storage daemons, and file daemons to all be sure they are communicating with other components they '''should''' be communicating with, that a third party (hello, NSA) is unable to examine the content of the communication, and that the communications have survived the trip over the network without being tampered with.		Bacula has provisions for [http://en.wikipedia.org/wiki/Transport_Layer_Security TLS]-ecapsulated communication between the various components. Bareos has kept these intact. This functionality allows the director, storage daemons, and file daemons to all be sure they are communicating with other components they '''should''' be communicating with, that a third party (hello, NSA) is unable to examine the content of the communication, and that the communications have survived the trip over the network without being tampered with.

			The following section details a PKI using 8192 bit RSA keys. It turns out these don't work at run-time. Errors like
			Feb 19 15:08:38 sacredchao bareos-dir: crypto_openssl.c:1475 Connect failure: ERR=error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size
			will be seen in your logs. I'll be dialing back RSA key sizes until by 1024 until I find something that works at runtime. As of 20 Feb 2014, 7168 bit RSA keys do not appear to work, either. Nor do 6144 bit keys.

	So let's create a two-level public key infrastructure, two certificate authorities (one root and a subordinate), for this:		So let's create a two-level public key infrastructure, two certificate authorities (one root and a subordinate), for this:
	# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!		# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!
	# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.		# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.
	# <code>'''mkdir "Bareos PKI Root Certificate Authority"; cd $_'''</code> # this will be the root of our certificate authority's files		# <code>'''mkdir "Bareos PKI Root Certificate Authority"; cd "$_"'''</code> # this will be the root of our certificate authority's files
	# <code>'''touch ca.db.index; dd if=/dev/random bs=128 count=1 of=ca.db.rand; echo 01 > ca.db.serial; mkdir ca.db.certs'''</code> # our CA is going to keep files in here.		# <code>'''touch ca.db.index; dd if=/dev/random bs=128 count=1 of=ca.db.rand; echo 01 > ca.db.serial; mkdir ca.db.certs'''</code> # our CA is going to keep files in here.
	# <code>'''openssl genrsa -aes256 -out bareos-ca-signing-key.pem 8192'''</code> # This key will be signing all of our certificates. This allows the CA root to revoke this key (and all those it has signed) in case of a compromise. Treat the passphrase generated just as carefully as that created for the CA root private key.		# <code>'''openssl genrsa -aes256 -out bareos-ca-signing-key.pem 8192'''</code> # This key will be signing all of our certificates. This allows the CA root to revoke this key (and all those it has signed) in case of a compromise. Treat the passphrase generated just as carefully as that created for the CA root private key.

Adj: /* for data in motion */

2014-02-12T17:58:53Z

for data in motion

@@ Line 219: / Line 219: @@
          # TLS CA Certificate Dir =      /path/to/directory/of/trusted/signing/certificates
          TLS DH File =                   /etc/bareos/sacredchao-sd-dhparam4096.pem
 === for data at rest ===

Adj: /* for data in motion */

2014-02-11T19:17:44Z

for data in motion

← Older revision		Revision as of 19:17, 11 February 2014
Line 160:		Line 160:
	At this point, a second level certificate authority exists, ready to issue certificates requested by bareos directors, storage daemons, file daemons, and any friends they might have. So let's see if we can generate some and get the various components to authenticate each other:		At this point, a second level certificate authority exists, ready to issue certificates requested by bareos directors, storage daemons, file daemons, and any friends they might have. So let's see if we can generate some and get the various components to authenticate each other:

	# <code>'''openssl genrsa -out fnord-director-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Mallory's hands.		# <code>'''openssl genrsa -out fnord-director-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Eve's or Mallory's or Oscar's hands.
	# <code>'''openssl req -new -days $((10 * 365 +2)) -key fnord-director-key.pem -out fnord-director-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.		# <code>'''openssl req -new -days $((10 * 365 +2)) -key fnord-director-key.pem -out fnord-director-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.
	# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory		# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory
Line 182:		Line 182:
	This needs to be repeated for the file daemon (client) running on sacredchao:		This needs to be repeated for the file daemon (client) running on sacredchao:
	# <code>'''openssl genrsa -out sacredchao-fd-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Mallory's hands.		# <code>'''openssl genrsa -out sacredchao-fd-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Mallory's hands.
	# <code>'''openssl req -new -days $((10 * 365 +2)) -key sacrechao-fd-key.pem -out sacredchao-fd-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.		# <code>'''openssl req -new -days $((10 * 365 + 2)) -key sacrechao-fd-key.pem -out sacredchao-fd-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.
	# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory		# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory
	# <code>'''openssl ca -config openssl-bareos-signing-CA.conf -name Bareos_Signing_CA_default -days $((10 * 365 + 2)) -out sacredchao-fd-certificate.pem -infiles ../sacredchao-fd-csr.pem'''</code> # issue the file daemon's certificate		# <code>'''openssl ca -config openssl-bareos-signing-CA.conf -name Bareos_Signing_CA_default -days $((10 * 365 + 2)) -out sacredchao-fd-certificate.pem -infiles ../sacredchao-fd-csr.pem'''</code> # issue the file daemon's certificate
			# <code>'''openssl dhparam -out /etc/bareos/sacredchao-fd-dhparam4096.pem -5 4096'''</code> # generate a really long prime to be used in the creation of Diffie-Hellman ephemeral keys

			* Edit the file daemon's config file (/etc/bareos/bareos-fd.conf) placing the following in the FileDaemon section:
			# Network communications security
			TLS Enable = yes
			TLS Require = yes
			TLS Certificate = /etc/bareos/sacredchao-fd-certificate.pem
			TLS Key = /etc/bareos/sacredchao-fd-key.pem
			TLS Verify Peer = yes
			# TLS Allowed CN = # not using this
			TLS CA Certificate File = /etc/bareos/bareos-ca-root-certificate.pem
			# TLS CA Certificate Dir = /path/to/directory/of/trusted/signing/certificates
			# TLS DH File = /etc/bareos/sacredchao-fd-dhparam4096.pem

			It turns out that all those trillions of CPU cycles used to generate a DH parameters file were wasted. The file daemon does not use make use of it. :(

	And the storage daemon running on sacredchao:		And the storage daemon running on sacredchao:
	# <code>'''openssl genrsa -out sacredchao-sd-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Mallory's hands.		# <code>'''openssl genrsa -out sacredchao-sd-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Mallory's hands.
	# <code>'''openssl req -new -days $((10 * 365 +2)) -key sacredchao-sd-key.pem -out sacredchao-sd-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.		# <code>'''openssl req -new -days $((10 * 365 + 2)) -key sacredchao-sd-key.pem -out sacredchao-sd-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.
	# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory		# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory
	# <code>'''openssl ca -config openssl-bareos-signing-CA.conf -name Bareos_Signing_CA_default -days $((10 * 365 + 2)) -out sacredchao-sd-certificate.pem -infiles ../sacredchao-sd-csr.pem'''</code> # issue the stoage daemon's certificate		# <code>'''openssl ca -config openssl-bareos-signing-CA.conf -name Bareos_Signing_CA_default -days $((10 * 365 + 2)) -out sacredchao-sd-certificate.pem -infiles ../sacredchao-sd-csr.pem'''</code> # issue the stoage daemon's certificate
			# <code>'''openssl dhparam -out /etc/bareos/sacredchao-sd-dhparam4096.pem -5 4096'''</code> # generate a really long prime to be used in the creation of Diffie-Hellman ephemeral keys

			And add this block to the storage daemon's config file (/etc/bareos/bareos-sd.conf) Storage block:
			# Network communications security
			TLS Enable = yes
			TLS Require = yes
			TLS Certificate = /etc/bareos/sacredchao-sd-certificate.pem
			TLS Key = /etc/bareos/sacredchao-sd-key.pem
			TLS Verify Peer = yes
			# TLS Allowed CN = # not using this
			TLS CA Certificate File = /etc/bareos/bareos-ca-root-certificate.pem
			# TLS CA Certificate Dir = /path/to/directory/of/trusted/signing/certificates
			TLS DH File = /etc/bareos/sacredchao-sd-dhparam4096.pem

	=== for data at rest ===		=== for data at rest ===

Adj: /* for data in motion */

2014-02-11T06:37:21Z

for data in motion

← Older revision		Revision as of 06:37, 11 February 2014
Line 168:		Line 168:

	* edit /etc/bareos/bareos-dir.conf, add the following to the Director section:		* edit /etc/bareos/bareos-dir.conf, add the following to the Director section:

	# Network communications security		# Network communications security
	TLS Enable = yes		TLS Enable = yes
	TLS Require = yes		TLS Require = yes
	TLS Certificate = /etc/bareos/fnord-~~dir~~-certificate.pem		TLS Certificate = /etc/bareos/fnord-director-certificate.pem
	TLS Key = /etc/bareos/fnord-~~dir~~-key.pem		TLS Key = /etc/bareos/fnord-director-key.pem
	TLS Verify Peer = yes		TLS Verify Peer = yes
	# ~~TLA~~ Allowed CN = # not using this		# TLS Allowed CN = # not using this
	TLS CA Certificate File = /etc/bareos/bareos-ca-root-certificate.pem		TLS CA Certificate File = /etc/bareos/bareos-ca-root-certificate.pem
	# TLS CA Certificate Dir = /path/to/directory/of/trusted/signing/certificates		# TLS CA Certificate Dir = /path/to/directory/of/trusted/signing/certificates
	TLS DH File = /etc/bareos/fnord-~~dir~~-dhparam4096.pem		TLS DH File = /etc/bareos/fnord-director-dhparam4096.pem

			This needs to be repeated for the file daemon (client) running on sacredchao:
			# <code>'''openssl genrsa -out sacredchao-fd-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Mallory's hands.
			# <code>'''openssl req -new -days $((10 * 365 +2)) -key sacrechao-fd-key.pem -out sacredchao-fd-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.
			# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory
			# <code>'''openssl ca -config openssl-bareos-signing-CA.conf -name Bareos_Signing_CA_default -days $((10 * 365 + 2)) -out sacredchao-fd-certificate.pem -infiles ../sacredchao-fd-csr.pem'''</code> # issue the file daemon's certificate

			And the storage daemon running on sacredchao:
			# <code>'''openssl genrsa -out sacredchao-sd-key.pem 8192'''</code> # create an 8192 bit RSA private key, no passphrase on the file storing it. Take great care to be sure it doesn't fall into Mallory's hands.
			# <code>'''openssl req -new -days $((10 * 365 +2)) -key sacredchao-sd-key.pem -out sacredchao-sd-csr.pem -config ~/proj/bareos-PKI/"Bareos PKI Signing Certificate Authority"/openssl-bareos-signing-CA.conf'''</code> # generate a certificate request with this director's key, good for 10 years.
			# <code>'''cd "Bareos PKI Signing Certificate Authority"'''</code> # go to the Signing certificate authority directory
			# <code>'''openssl ca -config openssl-bareos-signing-CA.conf -name Bareos_Signing_CA_default -days $((10 * 365 + 2)) -out sacredchao-sd-certificate.pem -infiles ../sacredchao-sd-csr.pem'''</code> # issue the stoage daemon's certificate

	=== for data at rest ===		=== for data at rest ===

Adj: /* for data in motion */

2014-02-11T00:30:44Z

for data in motion

@@ Line 145: / Line 145: @@
 Bacula has provisions for [http://en.wikipedia.org/wiki/Transport_Layer_Security TLS]-ecapsulated communication between the various components.  Bareos has kept these intact.  This functionality allows the director, storage daemons, and file daemons to all be sure they are communicating with other components they '''should''' be communicating with, that a third party (hello, NSA) is unable to examine the content of the communication, and that the communications have survived the trip over the network without being tampered with.
-So let's create a two-level public key infrastructure, including a certificate authority, for this:
+So let's create a two-level public key infrastructure, two certificate authorities (one root and a subordinate), for this:
 # <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code>        # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase.  Don't lose the passphrase!
 # <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code>        # creates a self-signed CA certificate.  You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>.  Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.
@@ Line 158: / Line 158: @@
 # edit the conf file appropriately (change '''<code>default_ca</code>''' settings and add a section for the new signing certificate authority.
-At this point, a second level certificate authority exists, ready to issue certificates requested by bareos directors, storage daemons, file daemons, and any friends they might have.
+At this point, a second level certificate authority exists, ready to issue certificates requested by bareos directors, storage daemons, file daemons, and any friends they might have.  So let's see if we can generate some and get the various components to authenticate each other:
 === for data at rest ===

Adj: /* for data in motion */

2014-02-10T18:37:22Z

for data in motion

← Older revision		Revision as of 18:37, 10 February 2014
Line 145:		Line 145:
	Bacula has provisions for [http://en.wikipedia.org/wiki/Transport_Layer_Security TLS]-ecapsulated communication between the various components. Bareos has kept these intact. This functionality allows the director, storage daemons, and file daemons to all be sure they are communicating with other components they '''should''' be communicating with, that a third party (hello, NSA) is unable to examine the content of the communication, and that the communications have survived the trip over the network without being tampered with.		Bacula has provisions for [http://en.wikipedia.org/wiki/Transport_Layer_Security TLS]-ecapsulated communication between the various components. Bareos has kept these intact. This functionality allows the director, storage daemons, and file daemons to all be sure they are communicating with other components they '''should''' be communicating with, that a third party (hello, NSA) is unable to examine the content of the communication, and that the communications have survived the trip over the network without being tampered with.

	So let's create a public key infrastructure, including a certificate authority, for this:		So let's create a two-level public key infrastructure, including a certificate authority, for this:
	# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!		# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!
	# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.		# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.
Line 156:		Line 156:
	# <code>'''cp "$OLDPWD"/signingpem "$OLDPWD"/*.conf .'''</code> # Get our private key, certificate, and OpenSSL config file here.		# <code>'''cp "$OLDPWD"/signingpem "$OLDPWD"/*.conf .'''</code> # Get our private key, certificate, and OpenSSL config file here.
	# <code>'''mkdir certificates crl; echo 01 > signing.db.serial; echo 00 > signing.db.crlnumber; dd if=/dev/urandom if=signing.db.rand bs=128 count=1'''</code> # create us some handy directories and bookkeeping files.		# <code>'''mkdir certificates crl; echo 01 > signing.db.serial; echo 00 > signing.db.crlnumber; dd if=/dev/urandom if=signing.db.rand bs=128 count=1'''</code> # create us some handy directories and bookkeeping files.
			# edit the conf file appropriately (change '''<code>default_ca</code>''' settings and add a section for the new signing certificate authority.

			At this point, a second level certificate authority exists, ready to issue certificates requested by bareos directors, storage daemons, file daemons, and any friends they might have.

	=== for data at rest ===		=== for data at rest ===

Adj: /* for data in motion */

2014-02-09T07:43:21Z

for data in motion

← Older revision		Revision as of 07:43, 9 February 2014
Line 155:		Line 155:
	# <code>'''mkdir ../"Bareos PKI Signing Certificate Authority"; cd "$_"'''</code> # now that the root CA has issued the Signing CA's certificate, we'll move on to the working on the signing CA		# <code>'''mkdir ../"Bareos PKI Signing Certificate Authority"; cd "$_"'''</code> # now that the root CA has issued the Signing CA's certificate, we'll move on to the working on the signing CA
	# <code>'''cp "$OLDPWD"/signingpem "$OLDPWD"/*.conf .'''</code> # Get our private key, certificate, and OpenSSL config file here.		# <code>'''cp "$OLDPWD"/signingpem "$OLDPWD"/*.conf .'''</code> # Get our private key, certificate, and OpenSSL config file here.
			# <code>'''mkdir certificates crl; echo 01 > signing.db.serial; echo 00 > signing.db.crlnumber; dd if=/dev/urandom if=signing.db.rand bs=128 count=1'''</code> # create us some handy directories and bookkeeping files.

	=== for data at rest ===		=== for data at rest ===

Adj: /* for data in motion */

2014-02-09T07:36:28Z

for data in motion

← Older revision		Revision as of 07:36, 9 February 2014
Line 145:		Line 145:
	Bacula has provisions for [http://en.wikipedia.org/wiki/Transport_Layer_Security TLS]-ecapsulated communication between the various components. Bareos has kept these intact. This functionality allows the director, storage daemons, and file daemons to all be sure they are communicating with other components they '''should''' be communicating with, that a third party (hello, NSA) is unable to examine the content of the communication, and that the communications have survived the trip over the network without being tampered with.		Bacula has provisions for [http://en.wikipedia.org/wiki/Transport_Layer_Security TLS]-ecapsulated communication between the various components. Bareos has kept these intact. This functionality allows the director, storage daemons, and file daemons to all be sure they are communicating with other components they '''should''' be communicating with, that a third party (hello, NSA) is unable to examine the content of the communication, and that the communications have survived the trip over the network without being tampered with.

	So let's create a public key infrastructure to for this:		So let's create a public key infrastructure, including a certificate authority, for this:
	# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!		# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!
	# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.		# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.
	# <code>'''mkdir "Bareos PKI Root Certificate Authority"; cd $_'''</code> # this will be the root of our certificate authority's files		# <code>'''mkdir "Bareos PKI Root Certificate Authority"; cd $_'''</code> # this will be the root of our certificate authority's files
	# <code>'''touch ca.db.index; ~~echo~~ ~~$(($RANDOM~~ % ~~90 + 10)) >~~ ca.db.rand; echo 01 > ca.db.serial; mkdir ca.db.certs'''</code> # our CA is going to keep files in here.		# <code>'''touch ca.db.index; dd if=/dev/random bs=128 count=1 of=ca.db.rand; echo 01 > ca.db.serial; mkdir ca.db.certs'''</code> # our CA is going to keep files in here.
			# <code>'''openssl genrsa -aes256 -out bareos-ca-signing-key.pem 8192'''</code> # This key will be signing all of our certificates. This allows the CA root to revoke this key (and all those it has signed) in case of a compromise. Treat the passphrase generated just as carefully as that created for the CA root private key.
			# <code>'''openssl req -new -days $((15 * 365 + 4)) -key bareos-ca-signing-key.pem -out bareos-ca-signing-csr.pem -config openssl-bareos-CA.conf'''</code> # generate a Certificate Signing request to be signed by the root.
			# <code>'''openssl ca -config openssl-bareos-CA.conf -name Bareos_CA_default -extensions v3_ca -days $((15 * 365 + 4)) -out bareos-ca-signing-certificate.pem -infiles bareos-ca-signing-csr.pem'''</code> # This uses the root CA's certificate to create the Signing CA's certificate, good for 15 years.
			# <code>'''mkdir ../"Bareos PKI Signing Certificate Authority"; cd "$_"'''</code> # now that the root CA has issued the Signing CA's certificate, we'll move on to the working on the signing CA
			# <code>'''cp "$OLDPWD"/signingpem "$OLDPWD"/*.conf .'''</code> # Get our private key, certificate, and OpenSSL config file here.

	=== for data at rest ===		=== for data at rest ===

Adj: /* for data in motion */

2014-02-07T05:57:22Z

for data in motion

← Older revision		Revision as of 05:57, 7 February 2014
Line 148:		Line 148:
	# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!		# <code>'''openssl genrsa -aes256 -out bareos-ca-root-key.pem 8192'''</code> # creates a private key for our root CA, and encrypts the PEM-encoded key with AES256-CBC using a user provided passphrase. Don't lose the passphrase!
	# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.		# <code>'''openssl req -x509 -sha512 -new -days $((365 * 20 + 5)) -key bareos-ca-root-key.pem -out bareos-ca-root-certificate.pem -config openssl-bareos-CA.conf'''</code> # creates a self-signed CA certificate. You will be asked for the passphrase for <code>bareos-ca-root-key.pem</code>. Ths CA certificate is good for 20 years (20 * 365 + 5 leap days) and is hashed with SHA512.
			# <code>'''mkdir "Bareos PKI Root Certificate Authority"; cd $_'''</code> # this will be the root of our certificate authority's files
			# <code>'''touch ca.db.index; echo $(($RANDOM % 90 + 10)) > ca.db.rand; echo 01 > ca.db.serial; mkdir ca.db.certs'''</code> # our CA is going to keep files in here.

	=== for data at rest ===		=== for data at rest ===