Key Escrow Service

config.xml

The Linux client and server both use an XML configuration file. In the next few steps, we will create a complete configuration file. The following is a template you can cut and paste to get started. Name this file /usr/local/wfu/template.xml

mkdir -p /usr/local/wfu
cat >/usr/local/wfu/template.xml<<EOF

  <ESCROW>

    <TCP_PORT>    </TCP_PORT>
    <SERVER_NAME>    </SERVER_NAME>
    <ADMIN_SUBNET_MASK>    </ADMIN_SUBNET_MASK>


    <RSA_MODULUS> 
    </RSA_MODULUS>

    <RSA_PUBLIC> 
    </RSA_PUBLIC>

    <RSA_PRIVATE> 
    </RSA_PRIVATE>


    <SSL_CLIENT_CERT>
    </SSL_CLIENT_CERT>
    
    <SSL_PRIVATE_KEY>
    </SSL_PRIVATE_KEY>

    <SSL_SERVER_CERT>
    </SSL_SERVER_CERT>


    <LDAP_URI>    </LDAP_URI>
    <LDAP_DN>    </LDAP_DN>


    <MYSQL_DB>    </MYSQL_DB>
    <MYSQL_USER>    </MYSQL_USER>
    <MYSQL_PASS>    </MYSQL_PASS>
    <MYSQL_HOST>    </MYSQL_HOST>
    <MYSQL_PORT>    </MYSQL_PORT>

  </ESCROW>

EOF

Server Identification

The first set of parameters identify the server and the administrative network. The following is an example of what this section might look like.

    Follow this link for an explanation of these parameters

    <TCP_PORT> 1111 </TCP_PORT>
    <SERVER_NAME> scrow.wfu.edu </SERVER_NAME>
    <ADMIN_SUBNET_MASK> 192.168.255.255 </ADMIN_SUBNET_MASK>

RSA Public/Private Keys

The next set of parameters define the RSA public and private keys. These paramters are divided into the modulus, public exponent and private exponent. This page will explain how to derive these values. The following is an example of what this section might look like.

    Follow this link for an explanation of these parameters and how to derive them

    <RSA_MODULUS>
        00:ad:49:5a:7e:c8:6f:bc:6b:1d:61:c7:45:fa:3c:
        d9:ff:bf:8c:e0:6c:0e:16:c8:d4:7f:d3:e2:3e:05:
        13:ca:f0:39:46:f3:50:9d:6e:ca:d3:49:08:a8:c5:
        e6:e0:07:76:36:63:e0:ba:2f:70:90:ec:bf:8c:0a:
        ed:5c:22:9a:8b
    </RSA_MODULUS>

    <RSA_PUBLIC>
        10001
    </RSA_PUBLIC>

    <RSA_PRIVATE>
        00:82:93:8b:c5:8d:73:e5:1f:31:fc:c4:14:4f:04:
        1b:a1:43:cd:fc:2e:70:4f:6a:f5:f5:7c:cc:36:bf:
        cc:b2:56:24:dc:e0:67:5d:c9:b4:d7:3c:c6:da:bd:
        77:e2:c5:3c:87:09:c9:0a:98:05:4f:9f:2a:01:4e:
        05:87:2a:31:01
    </RSA_PRIVATE>

SSL Certificates and the Certificate Authority

The following section will explain how to create a Certificate Authority (CA), and how to use this CA to sign a certificate. Our goal is to populate the SSL tags in our configuration template. But, first we will have to set up OpenSSL. This page will explain how to setup OpenSSL and generate the certificates.

    Follow this link for an information on OpenSSL and how to generate the certificates.

    <SSL_CLIENT_CERT>
        /usr/local/wfu/CA/cacert.pem
    </SSL_CLIENT_CERT>

    <SSL_PRIVATE_KEY>
        /usr/local/wfu/CA/server.key
    </SSL_PRIVATE_KEY>

    <SSL_SERVER_CERT>
        /usr/local/wfu/CA/server.crt
    </SSL_SERVER_CERT>

LDAP

The LDAP configuration is fairly standard. You can skip this section if you are not going to use LDAP. Other options for authentication are /etc/passwd and /etc/shadow.

    Follow this link for an explanation of these parameters

    <LDAP_URI>  ldaps://ldap.wfu.edu/ </LDAP_URI>
    <LDAP_DN>   o=WFU,c=US            </LDAP_DN>

MySQL

You will need to create a MySQL database. Here is an explanation of these parameters and the SQL code to create the tables.

    Follow this link for an explanation of these parameters

    <MYSQL_DB>   wfu_db        </MYSQL_DB>
    <MYSQL_USER> wfu_user      </MYSQL_USER>
    <MYSQL_PASS> wfu_passwd    </MYSQL_PASS>
    <MYSQL_HOST> localhost     </MYSQL_HOST>
    <MYSQL_PORT> 3306          </MYSQL_PORT>

Summary

Here is an example of a complete config.xml file.