All Questions(server)

Why are there two ways to setup SFTP with OpenSSH and when to use which? Is there any difference between them?

I mean the first one is using a lib from OpenSSH and the second one says "use the internal", so it is also OpenSSH?

Subsystem sftp /usr/lib/openssh/sftp-server

Subsystem sftp internal-sftp

All of my servers are currently flooded by salt water. Is it possible for each platter in a multi-platter drive to be separated, cleaned, imaged, and merged into a new virtual drive for data recovery?

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity period for the root CA certificate to 10 years. Since then, I have signed many certificates for OpenVPN tunnels, web sites and e-mail servers, all of which also have a validity period of 10 years (this may have been wrong, but I didn't know better at the time).

I have found many guides about setting up a CA, but only very little information about its management, and in particular, about what has to be done when the root CA certificate expires, which will happen some time in 2014. So I have the following questions:

• Will the certificates that have a validity period extending after the expiry of the root CA certificate become invalid as soon as the latter expires, or will they continue to be valid (because they were signed during the validity period of the CA certificate)?
• What operations are needed to renew the root CA certificate and ensure a smooth transition over its expiry?
  • Can I somehow re-sign the current root CA certificate with a different validity period, and upload the newly-signed cert to clients so that client certificates remain valid?
  • Or do I need to replace all client certificates with new ones signed by a new root CA certificate?
• When should the root CA certificate be renewed? Close to expiry, or a reasonable time before expiry?
• If the renewal of the root CA certificate becomes a major piece of work, what can I do better now to ensure a smoother transition at the next renewal (short of setting the validity period to 100 years, of course)?

The situation is made slightly more complicated by the fact that my only access to some of the clients is through an OpenVPN tunnel that uses a certificate signed by the current CA certificate, so if I have to replace all client certs, I will need to copy the new files to the client, restart the tunnel, cross my fingers and hope that it comes up afterwards.

I'd like to know if any certificates support a double wildcard like *.*.example.com? I've just been on the phone with my current SSL provider (register.com) and the girl there said they don't offer anything like that and that she didn't think it was possible anyway.

Can anyone tell me if this is possible, and if browsers support this?

Since Windows Explorer (since at least Windows XP) has some basic support for ZIP files, it seems like there should be a command-line equivalent, but I can't seem to find any sign of one.

Does Windows (XP, Vista, 7, 8, 2003, 2008, 2013) ship with a built-in command-line zip tool, or do I need to stick with third-party tools?