|
In this section, I will create the client key for bacula-fd. Please read the
official Bacula TLS
documentation. I am using Bacula/TLS
as previously mentioned.
First, I create the key for the client. The output from this process will be
stored in lists.example.org.key. By convention, I use the hostname in the
filename, just to keep things clear.
$ openssl genrsa -des3 -out lists.example.org.key 1024
Password:
Generating RSA private key, 1024 bit long modulus
.................++++++
.............++++++
e is 65537 (0x10001)
Enter pass phrase for lists.example.org.key:
Verifying - Enter pass phrase for lists.example.org.key:
$
You are asked to enter a passphrase. You will use that passphrase in subsequent
steps.
With that key, you create a certificate request. This goes to your certificate
issuer. Much of this process is beyond the scope of this article.
NOTE: It is important to use the hostname of the client using this certificate.
In this case, lists.example.org is the hostname of the client that runs bacula-fd.
See below as to where you must enter. The passphrase you are asked for in this
step is the one you used in the previous step.
$ openssl req -new -key lists.example.org.key -out lists.example.org.csr
Enter pass phrase for lists.example.org.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CA
State or Province Name (full name) [Some-State]:Ontario
Locality Name (eg, city) []:Ottawa
Organization Name (eg, company) [Internet Widgits Pty Ltd]:The FreeBSD Diary
Organizational Unit Name (eg, section) []:Backup Division
Common Name (eg, YOUR name) []:lists.example.org
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
The above process created lists.example.org.csr, and this file is what your
certificate authority will use to create your certificate.
In my case, I use CACert. I put the certificate from CACert into lists.example.org.cert. I now create a non-passworded version
of that certificate. You must supply the passphrase from the first step. This
is necessary because Bacula does not support supplying the passwords for these
certificates.
$ openssl rsa -in lists.example.org.key -out lists.example.org.nopassword.key
Enter pass phrase for lists.example.org.key:
writing RSA key
It is this file that you must copy to your Bacula client.
| 