doc/32.RPKI.CA.UI.GUI.Configuring.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83


Configuring the Web Portal
Also see doc/RPKI/CA/Configuration for documentation on the /etc/rpki.conf
configuration file.
Creating Users
See doc/RPKI/CA/UI/GUI/UserModel
Configuring Apache
In order to use the web portal, Apache must be installed and configured to
serve the application. See doc/RPKI/CA/UI/GUI/Configuring/Apache.
Error Notifications via Email
If an exception is generated while the web portal is processing a request, by
default will be logged to the apache log file, and an email will be set to
root@localhost. If you wish to change where email is sent, you can edit
/etc/rpki/local_settings.py and add the following lines:
ADMINS = (('YOUR NAME', 'YOUR EMAIL ADDRESS'),)


For example,
ADMINS = (('Joe User', 'joe@example.com'),)


Cron Jobs
The web portal makes use of some external data sources to display the
validation status of routing entries. Therefore, it is necessary to run some
background jobs periodically to refresh this data. The web portal software
makes use of the cron facility present in POSIX operating systems to perform
these tasks.
Importing Routing Table Snapshot
In order for the web portal to display the validation status of routes covered
by a resource holder's RPKI certificates, it needs a source of the currently
announced global routing table. The web portal includes a script which can
parse the output of the RouteViews full
snapshot (warning: links to very large file!).
When the software is installed, there will be a /usr/local/sbin/rpkigui-
import-routes script that should be invoked periodically. Routeviews.org
updates the snapshot every two hours, so it does not make sense to run it more
frequently than two hours. How often to run it depends on how often the routes
you are interested in are changing.
Create an entry in root's crontab such as
30  */2 *   *   *      /usr/local/sbin/rpkigui-import-routes


Importing ROAs
If you want the GUI's "routes" page to see ROAs when you click those buttons,
you will need to run rcynic. see the instructions for setting up rcynic.
This data is imported by the rcynic-cron script. If you have not already set
up that cron job, you should do so now. Note that by default, rcynic-cron is
run once an hour. What this means is that the routes view in the GUI will
not immediately update as you create/destroy ROAs. You may wish to run
rcynic-cron more frequently, or configure rcynic.conf to only include the
TAL that is the root of your resources, and run the script more frequently
(perhaps every 2-5 minutes).
If you are running rootd, you may want to run with only your local trust
anchor. In this case, to have the GUI be fairly responsive to changes, you may
want to run the rcynic often. In this case, you may want to look at the value
of jitter in rcynic.conf.
Expiration Checking
The web portal can notify users when it detects that RPKI certificates will
expire in the near future. Run the following script as a cron job, perhaps
once a night:
/usr/local/sbin/rpkigui-check-expired


By default it will warn of expiration 14 days in advance, but this may be
changed by using the -t command line option and specifying how many days in
advance to check.