Changes

Jump to: navigation, search

Sigul Signing Server Setup

146 bytes removed, 12:59, 14 May 2015
no edit summary
* login as sigul:
su -s /bin/bash sigul
* generate a new NSS database for the bridge at the location of the bridge_dir variable
bridge_dir=/var/lib/sigul certutil -d $bridge_dir -N [Be sure to remember your NSS Password]
2) Now generate the CA (Certificate Authority) certificate, to be used accross all sigul components
* be sure to replace '''my-ca''' with whatever your desire your CA to be named, such as '''sigul-ca''' for example:
certutil -d $bridge_dir -S -n my-ca -s 'CN=My CA' -t CT,, -x -v 120
3) Create a certificate for the bridge
* be sure to replace BRIDGE_HOSTNAME with the hostname of the machine it resides on:
certutil -d $bridge_dir -S -n sigul-bridge-cert -s 'CN=BRIDGE_HOSTNAME' -c my-ca -t u,, -v 120
4) Now it is time to configure the bridge, edit the config at ''/etc/sigul/bridge.conf'' * AS '''ROOT'''
* login as ROOT
* edit ''/etc/sigul/bridge.conf'':
#/etc/sigul/bridge.conf
[bridge] ... # You can leave most things at their default such as ports, or fas-account settings, if using FAS authentication. [daemon] ... # The default configuration assumes you set up a separate "sigul" user and group; # remove the [daemon] section if you want the bridge to run as the invoking user. # If you use a separate user and group issue: # chown sigul:sigul $bridge_dir/*.db [nss] nss-password: yournsspass # This will save you having to type it each time you start the bridge ...
5) After editing the config and setting up the certs, it is time for a test drive issue the following * AS '''ROOT''':
* start the bridge in DEBUG mode, and all information will be logged in ''/var/log/sigul_bridge.log'':
sigul_bridge -v -v
* check the log file after starting sigul, if there are no errors you are good to go.
** you should see the first log message in ''/var/log/sigul_bridge.log'':
2011-11-24 16:41:42,214 DEBUG: Waiting for the client to connect
* stop the sigul_bridge CRTL-C and start the service:
service systemctl start sigul_bridge start
=Sigul Server Setup=
Add bridge hostname to /etc/hosts:
[IP address of the bridge] sigul-bridge-hostname
1) Create the NSS database on the server, to hold the certificate information *AS user '''sigul''' issue the following
* login as sigul:
su -s /bin/bash sigul
* generate a new NSS database for the server at the location of the server_dir variable:
server_dir=/var/lib/sigul certutil -d $server_dir -N [Be sure to remember your NSS Password]
2) Now import the CA (Certificate Authority) certificate, generated earlier on the bridge
* issue ON THE BRIDGE as user '''sigul''':
pk12util -d $bridge_dir -o myca-server.p12 -n my-ca
* copy ''myca-server.p12'' over to the server and deleted from the bridge afterwards
* issue ON THE SERVER as user '''sigul''':
pk12util -d $server_dir -i myca-server.p12 rm myca-server.p12 certutil -d $server_dir -M -n my-ca -t CT,, <-- be sure to change my-ca to your CA name
* The sigul CA certs should now be imported
* be sure to replace SERVER_HOSTNAME with the hostname of the machine it resides on:
certutil -d $server_dir -S -n sigul-server-cert -s 'CN=SERVER_HOSTNAME' -c my-ca -t u,, -v 120
3) Now it is time to configure the server, edit the config at ''/etc/sigul/server.conf'' * AS '''ROOT'''
* login as ROOT
* edit ''/etc/sigul/server.conf''
#/etc/sigul/server.conf
[nss] bridge-hostname: # Put bridge hostname here ... [daemon] ... # The default configuration assumes you set up a separate "sigul" user and group; # remove the [daemon] section if you want the server to run as the invoking user.
4) Now to create the database for the server which will hold all user and key entries issue the following * AS '''ROOT'''
sigul_server_create_db
5) Next Add the initial administrator * AS '''ROOT'''
sigul_server_add_admin
6) After all is configured, it's time for a test drive * AS '''ROOT''':
* start the server in DEBUG mode, and all information will be logged in ''/var/log/sigul_server'':
sigul_server -v -v
* check the log file after starting sigul, if there are no errors you are good to go.
* you should see the first log message in /var/log/sigul_server.log:
2011-11-24 16:36:42,154 DEBUG: Waiting for a request
* stop the sigul_server CRTL-C and start the service:
service systemctl start sigul_server start
=Sigul Client Setup=
Add hostnames to /etc/hosts:
[IP address of the bridge] sigul-bridge-hostname [IP address of the server] sigul-server-hostname
To begin setup, we have to follow a similar process to the bridge with NSS, except that we will import the CA cert generated on the bridge, not generate a new one.
* generate a new NSS database for the server at the location of the client_dir variable
client_dir=~/.sigul certutil -d $client_dir -N [Be sure to remember your NSS Password]
2) Now import the CA (Certificate Authority) certificate, generated earlier on the bridge
* issue ON THE BRIDGE as user '''sigul'''
pk12util -d $bridge_dir -o myca-client.p12 -n my-ca
* copy ''myca-client.p12'' over to the client and deleted from the bridge afterwards
* issue ON THE CLIENT as your own user
pk12util -d $client_dir -i myca-client.p12 rm myca.p12 certutil -d $client_dir -M -n my-ca -t CT,, <-- be sure to change my-ca to your CA name
3) Next we have to generate the authentication certificate for the client
* be sure to replace YOURUSERNAME with the user you are using on the client system
* OR set 'CN=YOUR FAS NAME' if using FAS authentication
certutil -d $client_dir -S -n sigul-client-cert -s 'CN=YOURUSERNAME' -c my-ca -t u,, -v 120
4) Now it is time to configure the client, edit the config at /etc/sigul/client.conf * AS '''ROOT'''
* login as ROOT
* edit ''/etc/sigul/client.conf''
# /etc/sigul/client.conf
[client] bridge-hostname: # Put bridge hostname here ... server-hostname: # Put server hostname here ... user-name: # Put administrator login name if it is different from your UNIX user ...
* if you wish to avoid entering an NSS password upon issuing each command, create/edit ''~/.sigul/client.conf'' and add the following lines:
[nss] nss-password: Your NSS PASS
5) After configuring your client, issue a test client command in DEBUG mode as follows:
sigul -v -v list-users
* This should return a list of users on the server, at this point it should only really display the one admin user created before
* Help on more commands:
sigul --help-commands
6) Create an initial key once you are able to issue commands to sigul, issue the following:
sigul new-key -h
* this will output the options that can be used with the key creation, use the ones you want, and generate the key.
* please note when generating the key, it requires alot of Entropy on the server, so issue some commands to keep server busy and help it generate faster, usually a simple find / will generate enough for it to take about 2 minutes to generate the key.
1) As ROOT on the sigul bridge, edit /etc/sigul/bridge.conf edit the koji section as follows:
[koji] koji-config: /path/to/koji/config/file <-- The config file should be that of koji web
2) The koji configuration file and certs can reside under any directory that sigul has atleast read privileges on. The kojiweb certificates that allow kojiweb to authenticate with koji must be copied to this directory, along with the config file which points to the koji instance, as well as the kojiweb certs needed for it to authenticate.
4) To test issue the following on the client, to download and RPM from koji - sign it - and store it locally - Just as a test for koji connectivity and authentication:
sigul sign-rpm -o signed.rpm key_name unsigned.rpm <-- key_name should be the name of the sigul key you setup previously. - If the above is successful, you will have an rpm named signed.rpm in the directory you are working in.
=Sigul Client Config Script=
Retrieved from "https://wiki.cdot.senecapolytechnic.ca/wiki/Special:MobileDiff/111018"

Navigation menu