Fwd: Use glpi-project plugin to manage tinc keys...

[Rob Townley]

Comments at bottom:

--------- Forwarded message ----------
From: Guus Sliepen <guus at tinc-vpn.org>
Date: Wed, Apr 21, 2010 at 2:17 PM
Subject: Re: Use glpi-project plugin to manage tinc keys...
To: tinc at tinc-vpn.org


On Wed, Apr 21, 2010 at 08:12:49AM -0500, Rob Townley wrote:

> Anyone found a way to use glpi-project.org, ocsinventory-ng.org, or
> FusionInventory.org to manage tinc keys?

I hope you mean only the public keys? I have not heard about these projects
before today.

> These LinMacWin projects are used to manage an enterprise of machines.  So
> all the machine info is already there and  a plugin or api call could be used
> to handle tinc specifics. GLPI can store files pertaining to a particular
> machine.  The drawback would be that tinc would have to be modified to lookup
> keys from glpi.  Alternatively, use an ocs tinc installation package to pull
> down keys for a particular group and push a key back to the repository upon
> creation by tinc.

Someone who works with such projects would have to write such an installer.
Alternatively, have a look at ChaosVPN, which is a wrapper around tinc which
pulls keys and config files from a central repository:

https://wiki.hamburg.ccc.de/index.php/ChaosVPN

--
Met vriendelijke groet / with kind regards,
    Guus Sliepen <guus at tinc-vpn.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkvPTzwACgkQAxLow12M2nvrqACfYncLhJYRJV24GneoWsEbrHF6
NVUAn1UkBoxBXqSQ5HDPfp+iG/84cX6R
=M0X4
-----END PGP SIGNATURE-----

_______________________________________________
tinc mailing list
tinc at tinc-vpn.org
http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc


Yes, Guus, private keys should never leave a machine.  This would be a
repository for public keys, dynamic port numbers and dynamic
addresses.  Network grouping is sorta already done.  The specific
architecture mode could be kept in this inventory as well, but the 3
main management items are the public key, dynamic port number, and
dynamic ip address.   Key management being the priority.

i had not heard of ChaosVPN.  i will look at that right now.  i would
think the dynamic dns route would still be the ideal way, but other
ways may not need any development.

One use for ocsinventory-ng / fusion / glpi would be to have a fleet
of disparate machines scattered across the internet that you maintain
for your family or business.  tinc would provide a way to push
packages to its virtual ips in a more secure manner.  Nobody has to
login to a vpn.  AV monitoring.  Patch revision for Adobe Flash and
Adobe Reader ....
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20100421/2b8badff/attachment.pgp>