diff options
Diffstat (limited to 'doc/wiki-dump/doc%2FRPKI%2FRRDPtestbed.md')
| -rw-r--r-- | doc/wiki-dump/doc%2FRPKI%2FRRDPtestbed.md | 455 |
1 files changed, 455 insertions, 0 deletions
diff --git a/doc/wiki-dump/doc%2FRPKI%2FRRDPtestbed.md b/doc/wiki-dump/doc%2FRPKI%2FRRDPtestbed.md new file mode 100644 index 00000000..954a19db --- /dev/null +++ b/doc/wiki-dump/doc%2FRPKI%2FRRDPtestbed.md @@ -0,0 +1,455 @@ +# Building a DRLng Certificate Authority on Ubuntu Xenial + +I wanted to build a DRLng (rrdp, integrated root CA, seriously reworked and +meaner and leaner) Certificate Authority. + + * I prefer Ubuntu these days. + * I wanted to build it on Ubuntu Xenial because Xenial has the upgraded TLS for rrdp. + +## System Requirements + +I built the following: + + * 32GB of hard disk, enough to leave headroom unless you plan a LOT of certificates, as in thousands; + * 2GB or RAM, as it still is a bit of a RAM hog; and + * One CPU should be enough to start. + * The server must not have an AAAA DNS RR unless it has working IPv6 connectivity. + +## Xenial Install + + * [16.04 Ubuntu Xenial LTS 64-bit server][1] + * I do a fairly basic install, OpenSSH, basic utilities, and grub + * apt update and apt dist-upgrade of course + * I install automatic updates, emacs-nox, ntp, ... with ansible. Note that ansible requires python2 and xenial installs python3. So I had to install python2.7 + +I am lazy and log in as root as pretty much everything I do is going to +require being root. If you like sudo, then just prefix a lot with it. + +## Install the Basic RPKI CA and RP Software + +You should only need to perform these steps once for any particular machine. + +Add the GPG public key for this repository (optional, but APT will whine +unless you do this): + + + + # wget -q -O - http://download.rpki.net/APTng/apt-gpg-key.asc | sudo apt-key add - + + +Configure APT to use this repository (for Ubuntu Trusty systems): + + + + # wget -q -O /etc/apt/sources.list.d/rpki.list http://download.rpki.net/APTng/rpki.trusty.list + + +Update available packages: + + + + # apt update + + +Install the software: + + + + # apt install rpki-rp rpki-ca + + +500kg of packages will be installed. The daemons should also be started. + + + + # /bin/ps axu | grep rpki | grep -v grep + rpki 5250 0.0 0.4 308040 8404 ? Sl 07:37 0:00 (wsgi:rpkigui) -k start + rpki 5436 0.0 0.4 45184 9380 ? Ss 07:37 0:00 /usr/bin/python /usr/lib/rpki/rpki-nanny --log-level warning --log-directory /var/log/rpki --log-rotating-file-hours 3 --log-backup-count 56 + rpki 5437 1.1 2.2 220204 45584 ? S 07:37 0:00 /usr/bin/python /usr/lib/rpki/irdbd --foreground --log-level warning --log-timed-rotating-file /var/log/rpki/irdbd.log 3 56 + rpki 5439 1.1 2.0 206428 42220 ? S 07:37 0:00 /usr/bin/python /usr/lib/rpki/pubd --foreground --log-level warning --log-timed-rotating-file /var/log/rpki/pubd.log 3 56 + postgres 5499 0.0 0.7 302016 15272 ? Ss 07:37 0:00 postgres: rpki rpki [local] idle + + +## Minimal Configuration + +This example install uses the server hostname `ca.rg.net`. Any use of that +hostname below will have to be replaced with your host's name, of course. + +### Relying Party - rcynic + +The RP (Relying Party) software should have installed and should be running. +You can test it by browsing to <https://ca.rg.net/rcynic/>. It uses a self- +signed TLS certificate; you can be lazy and decided to accept it as opposed to +installing a real one. If you want to use a Lets Encrypt certificate, you +might try [this homegrown recipe using acme_tiny.py][2], which will require a +bit of hacking as the rpki package puts apache credentials in an odd place. + +!!!!!!!!! THE RCYNIC PAGE IS EMPTY !!!!!! + +The rcynic web page has not populated yet because the cron job to populate is +generated for a socially polite cache which fetches once an hour. + + + + # crontab -l -u rpki + MAILTO=root + 41 * * * * exec /usr/bin/rcynic-cron + + +Do not change this now as it would place an asocial load on the global RPKI. + +If you plan to use the rpki-rtr protocol to feed a router from the RP cache +you just installed, check `/etc/xinetd.d/rpki-rtr` to be sure the port number +is 323, the IANA assigned port, as opposed to some old hacks that were used +pre [RFC 6810][3]. + + + + # cat > /etc/xinetd.d/rpki-rtr << EOF + service rpki-rtr + { + type = UNLISTED + flags = IPv4 + socket_type = stream + protocol = tcp + port = 323 + wait = no + user = rpkirtr + server = /usr/bin/rpki-rtr + server_args = server /var/rcynic/rpki-rtr + } + EOF + + +If you have to change it, remember to + + + + # systemctl restart xinetd + + +The configuration for rcynic is in `/etc/rpki.conf`. Note that it says to use +the trust anchors in the directory `/etc/rpki/trust-anchors`. You may want to +change the set of trust anchors if you have unusual requirements. + +### CA Configuration - rpki.conf + +`/etc/rpki.conf` is the core configuration file for the CA. You need to make +very minimal changes. If you want an explanation for all the options, go to +<https://trac.rpki.net/wiki/doc/RPKI/CA/Configuration>. Get coffee first. + +`handle` is generated as `ca_rg_net` or whatever. You may want to change it to +something more intuitive such as `testCA` or whatever you like. You do not +really need to do this, but let's assume you do. I changed it to `RGnet`, as I +was creating a CA for RGnet's resources. + +The `handle` in rpkic.conf is a historical relic (dating back to the +`myrpki.xml` interface, circa 2008). It's become just the default for `-i` / +`--identity` / `select_identity` and may eventually go away completely. + +If you may offer publication services to other CAs, you will want to put the +contact email in `pubd_contact_info`. + +Observe that the `publication_base_directory` expands/decodes to +`/usr/share/rpki/publication`. Similarly, `bpki_servers_directory` decodes to +`/usr/share/rpki`. + +That is it for configuration of `/etc/rpki.conf`! + +### rsyncd Configuration + +Next, you want to get the rsync daemon working. First you need to tell the +rsync daemon what it should serve. So configure `/etc/rsyncd.conf` as follows: + + + + # cat > /etc/rsyncd.conf << EOF + uid = nobody + gid = rpki + + [rpki] + use chroot = no + read only = yes + transfer logging = yes + path = /usr/share/rpki/publication + comment = RPKI publication + + # the following is only of you plan to run a root CA + [tal] + use chroot = no + read only = yes + transfer logging = yes + path = /usr/share/rpki/rrdp-publication + comment = altCA TAL + EOF + + +Then tell xinetd to run the rsync deamon when asked and then to restart xinetd + + + + # cat > /etc/xinetd.d/rsync << EOF + service rsync + { + disable = no + socket_type = stream + port = 873 + protocol = tcp + wait = no + user = root + server = /usr/bin/rsync + server_args = --daemon + log_on_failure += USERID + } + EOF + + +Remember to + + + + # systemctl restart xinetd + + +## CA Data Initialization + +The remaining configuration is done using the RPKI software itself. + +### Starting Services + +Before configuring the CA daemon and database, you should first restart the +daemons. + + + + # systemctl restart rpki-ca + + +You should see the daemons running + + + + # /bin/ps axu | grep rpki | grep -v grep + rpki 5250 0.1 2.7 546316 57316 ? Sl 07:37 0:00 (wsgi:rpkigui) -k start + rpki 5597 0.0 0.3 25348 7132 ? Ss 07:42 0:00 /usr/bin/python /usr/bin/rcynic-cron + rpki 5598 25.6 5.7 287132 116880 ? R 07:42 1:44 /usr/bin/python /usr/bin/rcynic + postgres 5601 9.9 4.4 305024 91336 ? Rs 07:42 0:40 postgres: rpki rpki [local] idle + rpki 7183 0.0 0.4 45184 9440 ? Ss 07:48 0:00 /usr/bin/python /usr/lib/rpki/rpki-nanny --log-level warning --log-directory /var/log/rpki --log-rotating-file-hours 3 --log-backup-count 56 + rpki 7184 4.0 2.2 220140 45848 ? S 07:48 0:00 /usr/bin/python /usr/lib/rpki/irdbd --foreground --log-level warning --log-timed-rotating-file /var/log/rpki/irdbd.log 3 56 + rpki 7186 3.7 2.0 206424 42308 ? S 07:48 0:00 /usr/bin/python /usr/lib/rpki/pubd --foreground --log-level warning --log-timed-rotating-file /var/log/rpki/pubd.log 3 56 + postgres 7193 0.0 0.6 302016 13104 ? Ss 07:48 0:00 postgres: rpki rpki [local] idle + + +### Initializing the CA + +The command utility, `rpkic` is a CLI for dealing with the CA. This example +uses it instead of the GUI, especially for initial setup, as it is easier to +copy and paste into a wiki. The CLI has tab completion, and the other features +offered by readline(). + +It makes life easier if you do all this in a sub-directory to keep it all +together. Also, files are written and read from the current directory, often +with code running under the uid of rpki. So make the director writiable by +that uid. + + + + # mkdir CA-data + # chown rpki CA-data + # cd CA-data + + +rpkic has the concept of the current identity. Initially, it starts with the +identity from the handle in `/etc/rpki.conf`, RGnetCA in this example + + + + # rpkic + rpkic> + + +Before you do anything else, you need to initialize the CA. Note that we now +use `create_identity` as opposed to `initialize`. As mentioned previously, for +the moment the identity should be the same as the `handle` in /etc/rpki.conf. + + + + # rpkic + # rpkic create_identity RGnet + Wrote /root/CA-data/RGnet.identity.xml + This is the "identity" file you will need to send to your parent + + +For testing, copy the identity to the publication point. + + + + # rsync RGnet.identity.xml /usr/share/rpki/publication + + +As the publication point now has data, it is recommended that you test it from +a remote system + + + + % rsync rsync://ca.rg.net/rpki/RGnet.identity.xml + -rw-r--r-- 1175 2016/04/24 16:53:53 RGnet.identity.xml + + +## Identity and Publication + +You need to establish the BPKI relationship with your parent CA. In this case, +that was RIPE + +You may want to look below at the [Using the rpkic CLI in setup phase][4] for +a general description of the provisioning steps. + +### The Identity/Repository Handshake + +I browsed to [RIPE's provisioning page][5] and uploaded /root/CA- +data/RGnet.identity.xml and received back issuer-identity-20160513.xml + +I used that file to configure my server's view of its parent + + + + # rpkic configure_parent issuer-identity-20160513.xml + Parent calls itself '3336711f-25e1-4b5c-9748-e6c58bef82a5', we call it '3336711f-25e1-4b5c-9748-e6c58bef82a5' + Parent calls us 'f1400649-ab90-4332-b7e3-3da6b7e44cdb' + Wrote /root/CA-data/RGnet.3336711f-25e1-4b5c-9748-e6c58bef82a5.repository-request.xml + This is the file to send to the repository operator + + +The CA will need a repository, and we are assuming that we will also host it. +So it should accept its own offer made above + + + + # rpkic configure_publication_client RGnet.3336711f-25e1-4b5c-9748-e6c58bef82a5.repository-request.xml + This might be an offer, checking + We don't host this client's parent, so we didn't make an offer + Don't know where else to nest this client, so defaulting to top-level + Client calls itself 'RGnet', we call it 'RGnet' + Wrote /root/CA-data/RGnet.repository-response.xml + Send this file back to the publication client you just configured + + +And then I configured the repository using the response from above + + + + # rpkic configure_repository RGnet.repository-response.xml + Repository calls us 'RGnet' + No explicit parent_handle given, guessing parent 3336711f-25e1-4b5c-9748-e6c58bef82a5 + + +You can see if it is publishing, maybe using a bit of coercion + + + + # rpkic force_publication + # ls -l /usr/share/rpki/publication + total 8 + drwxr-xr-x 2 rpki rpki 4096 May 14 07:39 RGnet/ + -rw-r--r-- 1 root root 1175 May 14 07:10 RGnet.identity.xml + + +If the publication sub-directory is not there, go work on something else for a +while and come back. + +### The GUI Should Now Work + +One simple test is to try the GUI. But first you need to set up the GUI +superuser password. [ insert lecture on strong passwords ] + + + + # rpki-manage createsuperuser + Username (leave blank to use 'rpki'): RGnet + Email address: randy@psg.com + Password: + Password (again): + Superuser created successfully. + + +and write it down somewhere safe. + +Then you can point your browser at `https://ca.rg.net`, and you should see the +login page. Enter the user 'RGnet' (per above) and the password from +createsuperuser above. This should take you to RGnet's dashboard. + +## Using the rpkic CLI in setup phase + +See the [introduction to the user interfaces][6] for an overview of how setup +phase works. The general structure of the setup phase in rpkic is as described +there, but here we provide the specific commands involved. The following +assumes that you have already installed the software and started the servers. + + * The rpkic "initialize" command writes out an "identity.xml" file in addition to all of its other tasks. + * A parent who is using rpkic runs the "configure_child" command to configure the child, giving this command the identity.xml file the child supplied as input. configure_child will write out a response XML file, which the parent sends back to the child. + * A child who is running rpkic runs the "configure_parent" command to process the parent's response, giving it the XML file sent back by the parent as input to this command. configure_parent will write out a publication request XML file, which the child sents to the repository operator. + * A repository operator who is using rpkic runs the "configure_publication_client" command to process a client's publication request. configure_publication_client generates a confirmation XML message which the repository operator sends back to the client. + * A publication client who is using rpkic runs the "configure_repository" command to process the repository's response. + +## Creating a New Root Authority + +If you also need to be a CA for private address space, legacy space ARIN will +not certify, etc. you will want to create a root CA. + + + + # rpkic configure_root + Generating root for resources ASN: 0-4294967295, V4: 0.0.0.0/0, V6: ::/0 + Wrote /root/CA-stuff/altCA.altCA.repository-request.xml + This is the file to send to the repository operator + + +creates a weird kind of parent object, gives you back the XML for repository +setup (same as it did before, difference is just the implementation). + +configure_root can take an optional --resources argument which configures the +set of resources for the root to hold. As you can see, by default it's +everything (0-4294967295,0.0.0.0/8,::/0). + +### Extract Root Certificate and TAL + +There are two new commands to extract root cert and TAL: + + + + # rpkic extract_root_certificate + # rpkic extract_root_tal + + +The latter is a bit iffy in the sense that it has no way of knowing how you +really set up all the things beyond its direct control: the TAL it generates +should be correct if you used the default setup, but if you did something +weird (eg, in your Apache or rsyncd configuration) it might have the wrong +URIs, and it has no real way of knowing what you did. + +Both certificate and TAL will be written to names derived from the g(SKI) of +the certificate, in the current directory (.). + +You can rename the TAL to anything you like, but you should preserve the +g(SKI) filename of the certificate, because that's what the TAL will be +expecting to find. + +Note that RRDP does *not* help with publication of the root certificate (the +root certificate is how the RP finds RRDP, not the other way around), so +you'll need to put a copy of the root certificate in the location named by the +HTTPS URI in the TAL (/usr/share/rpki/rrdp-publication/ in the default Ubuntu +setup). + + [1]: http://releases.ubuntu.com/16.04/ubuntu-16.04-server-amd64.iso + + [2]: https://wiki.rg.net/AcmeTinyUbuntu + + [3]: http://www.rfc-editor.org/rfc/rfc6810.txt + + [4]: +https://trac.rpki.net/wiki/doc/RPKI/RRDPtestbed#UsingtherpkicCLIinsetupphase + + [5]: https://my.ripe.net/#/provisioning/non-hosted + + [6]: #_.wiki.doc.RPKI + |