Re: Replicate through an VPN ?

[Howard Chu <hyc@symas.com>]

Su Tam Nguyen wrote:
> Hi all,
> I intend to make the synchronization between master and slave server through
> an VPN built before, and after this work complete, the VPN will be disable
> too. So, this VPN is just active on demand.
> I want to know when the synchronization starts, and stop. Before the
> begining of this, the master will create an VPN and signal to the slave to
> do the same thing. After exchange information on this VPN, the VPN will
> collapse.
> I have started slapd and slurpd with the highest debug mode (-d 65535) and
> got some information when the replication happen, but it seems not enough
> for me.
> Could anyone tell me about where the concerned code is , or suggest another
> way to do so ?
> Thanks in advance !
> Su Tam Nguyen
>   
Why tear down the VPN at all, what resource cost is associated with 
keeping it up all the time? Using a VPN implies at least some concern 
about malicious users on the intervening networks. What if a malicious 
user intercepts the message from the master that signals the slave to 
create the VPN?

Why use a VPN at all, why not just use TLS?

--
 -- Howard Chu
 Chief Architect, Symas Corp.  http://www.symas.com
 Director, Highland Sun        http://highlandsun.com/hyc
 OpenLDAP Core Team            http://www.openldap.org/project/