amanda-auth-ssl7
Ssl communication/authentication methods between amanda server and client
Overview
This authenticate method use ssl certificate to authenticate host, all transfer over the network is encrypted.
Each amanda client/server must have its own certificate signed by the amanda CA certificate.
Compilation and general information
Amanda must be configure with --with-ssl-security
Server/client configuration
In amanda.conf and amanda-client.conf.
ssl-dir
The directoty where amanda store all the certificates. A good value is ~/amanda-ssl.
ssl-check-certificate-host
Check the peer hostname match the certificate host name.
ssl-check-fingerprint
Check the fingerprint of the certificate is the same as the fingerprint we already have for that host.
ssl-check-host
Do the bsd check, dns name of peer IP is the hostname we connect to.
Filesystem layout for certificates
$SSL_DIR/CA/crt.pem # CA certificate that signed
all certificates.
$SSL_DIR/CA/private/key.pem # CA private key
(on server only)
$SSL_DIR/me/crt.pem # public certificate of the host
$SSL_DIR/me/private/key.pem # private key of the host
$SSL_DIR/me/fingerprint # fingerprint of my certificate
$SSL_DIR/remote/HOSTNAME/fingerprint # fingerprint of the HOSTNAME
certificate
On the HOSTNAME host, $SSL_DIR/remote/HOSTNAME is a symbolic link to ../me.
Program to help configuration
The amssl program is a tool to manage the certificate.
Releases
4 releases since Debian 10 (Buster); the text changed 1 time.