From owner-freebsd-security@FreeBSD.ORG Tue May 27 12:05:34 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7B38637B401 for ; Tue, 27 May 2003 12:05:34 -0700 (PDT) Received: from otter3.centtech.com (moat3.centtech.com [207.200.51.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id AC0AE43F85 for ; Tue, 27 May 2003 12:05:33 -0700 (PDT) (envelope-from anderson@centtech.com) Received: from centtech.com (dhcp-218.centtech.com [204.177.173.218]) by otter3.centtech.com (8.12.3/8.12.3) with ESMTP id h4RJ5X56061556; Tue, 27 May 2003 14:05:33 -0500 (CDT) (envelope-from anderson@centtech.com) Message-ID: <3ED3B6D8.8000103@centtech.com> Date: Tue, 27 May 2003 14:04:56 -0500 From: Eric Anderson User-Agent: Mozilla/5.0 (X11; U; Linux i386; en-US; rv:1.0.1) Gecko/20020823 Netscape/7.0 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Michael Collette References: <200305271201.40742.metrol@metrol.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: FreeBSD Security Subject: Re: multihost master.passwd sync X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2003 19:05:34 -0000 Michael Collette wrote: > On Tuesday 27 May 2003 11:30 am, Andy Harrison wrote: [..snip..] >>>NIS [yp(8)] ? >> >>Lord no... even if you setup a backup nis server, an ailing master server >>can really screw up your day. >> >>I think I thought of a solution though. root cronjob to pgp encrypt the >>file, change perms so that it can be accessed by a user that is allowed to >>copy the file to the target host. The file is in encrypted using the >>public key of root the target machine, so only root on the target will be >>able to pgp extract the file. > > > Why not just preconfigure SSH keys between the boxes and scp the file across? > Seems like a lot of extra work to bring PGP into the mix. > > Personally, I'm real curious about utilizing an LDAP backend to replace NIS. > Read a bit about it, but haven't had a chance to play with it just yet. It > sounds like a far more elegant solution for what you're looking to do as > well. Assuming it all works as advertised that is. I've started this exact process - replacing my NIS gunk with LDAP.. Not too far through yet, but I'll try to keep good notes for anyone else who may want them.. Eric -- ------------------------------------------------------------------ Eric Anderson Systems Administrator Centaur Technology Attitudes are contagious, is yours worth catching? ------------------------------------------------------------------