 |
Right now Bareos has two protocol modes to operate in. The legacy one is what we inherited from the predecessor project. It uses CRAM-MD5 on plaintext connnections (even if you have TLS enabled). The modernized protocol does immediate TLS and then authenticates using CRAM-MD5 inside that TLS-session. While this is still obviously legacy, we chose to keep it for a few reasons: - the legacy clients require that type of authentication - in Bareos context it isn't worse than sending a plain password - it is still considered safe when used via a TLS connection (which is the default nowadays) Having said that, the document from 2008 that you're referencing is a draft and was never made a standard. If we decide to implement another incompatible protocol change, we will definitely get rid of CRAM. We will probably not get rid of the shared secrets, so password stretching won't work. Concerning PKI we decided against it, as PSK seems to be sufficient for our use-case. |
- Anonymous
