PGP Corporation Tech Note

Netscape Directory Server 4.1:
Setting up for use as a PGP keyserver

Copyright © 2002 by PGP Corporation. All Rights Reserved.


This Tech Note describes how to set up Netscape Directory Server 4.1 for use as a PGP keyserver.

  1. Install Netscape Directory Server 4.1.

    Note: Netscape's servers have some problems with pathnames with spaces in them, so PGP Corporation recommend sagainst using "Program Files". The default is "C:\Netscape\Server4". Use the default.

    For the examples in this document, we assume that you chose "o=PGP" for your suffix.

  2. Install the PGP schema for Netscape DS (Directory Server).

    Assuming that you've installed DS into C:\Netscape\Server4, copy the file pgp-keyserver-schema.conf into C:\Netscape\Server4\slapd-<instancename>\config.

    Edit ns-schema.conf in this directory and add one more include line for this new schema file.

  3. Restart Netscape DS.

    On the "Tasks" page of the Netscape DS Console, click the Restart the Directory Server button.

  4. Create space to store the PGP keys.

    Right click on the tree item for the suffix you chose when you installed DS (o=PGP, etc. The tree doesn't display the "o=", just the value) and select New --> Organizational Unit. For the "Name" attribute, enter something descriptive, such as "PGP Keys" or "PGP Keyspace". The exact value of this attribute doesn't matter.

    Let's call this new object the "PGP keyspace".

  5. Set the access permissions.

    Right click on the new item you just created and select Set Access Permissions. Click New. Click View/Edit Syntax and change the ACI to:

    (target="ldap:///ou=<PGP Keyspace>, o=NAI")(targetattr="*")(version 3.0;
    acl "PGP Keys"; allow (all) (userdn="ldap:///anyone"); )
    

    Changing the "target=" according to the name you chose to call the PGP keyspace.

    Double click on the cell in the "Rights" column. The following table lists which permissions must be turned on in order to perform the listed functions:

    Keyserver operation Rights
    Searches Read, Search
    Adds (not updating existing key on server) Add
    Adds (updating existing key on server) Write
    Deletes Delete
    Disables Write

    If you want to disable a certain function, unselect the rights needed to perform that function. Make sure you don't unselect a permission that is needed to perform a different function, lest the other function stop working.

  6. Add a PGPServerInfo entry to tell the client where the PGP keyspace is.

    Right click on the tree item for the suffix you chose when you installed DS (o=PGP, etc. The tree doesn't display the "o=", just the value) and select New --> Other. Select pgpserverinfo and click OK. For the "Full name" attribute, enter the text "PGPServerInfo". For the "pgpbasekeyspacedn" attribute, enter the DN of the PGP Keyspace you created for storage of the PGP keys.

    You may also optionally add the following attributes:

    • pgpSoftware: a descriptive name of the server software, such as "Netscape Directory Server for WinNT".
    • pgpVersion: the version of the server software, such as "4.11".

  7. Send some keys to the server and search for them.