[OpenAFS] Thinking differently about configuration

[David Boyes]

On 5/17/09 12:36 PM, "Derrick Brashear" <shadow@gmail.com> wrote:
=20
> well, if you send the file over the network, i'd want to encrypt it.
> the chicken and egg problem is the obvious one, and matters from the
> standpoint of if, say, a kerberos principal used to encrypt
> configuration transfers can itself be configured in the file you're
> transferring.

You would probably want some kind of digital signature as well.

> in truth, if i were going to write a configuration service (which
> isn't a bad idea at all) i'd want it to not pass the file anyway; i'd
> pass options and let the other end add them to its config; if a client
> of this service wished to subscribe exclusively to the advertised
> options, fine; otherwise, it would have the option of accepting only
> changes.

There's been some work with signed objects delivered with a configuration
service in some of the OASIS working groups that might be interesting to
think about. The zeroconf folks have also been doing some work in this area
for various Unixen that might be attractive as well (totally eliminating
local configuration files for most system services).