213 lines
5.3 KiB
Markdown
213 lines
5.3 KiB
Markdown
# Package Verification CA Configuration
|
|
|
|
## Overview
|
|
|
|
This directory contains the Certificate Authority (CA) configuration for package verification.
|
|
|
|
## Files
|
|
|
|
```
|
|
package-verification/ca/
|
|
├── ca.crt # CA certificate (PLACEHOLDER - you must add your own)
|
|
├── ca.key # CA private key (PLACEHOLDER - NEVER include this in the ISO)
|
|
├── crl.pem # Certificate Revocation List (PLACEHOLDER)
|
|
└── README.md # This file
|
|
```
|
|
|
|
## CA Certificate
|
|
|
|
### What is a CA Certificate?
|
|
|
|
A CA (Certificate Authority) certificate is used to sign and verify packages. It ensures:
|
|
|
|
1. **Integrity** - Packages haven't been modified
|
|
2. **Authenticity** - Packages come from your trusted source
|
|
3. **Non-repudiation** - Can prove who signed the package
|
|
|
|
### Creating Your CA Certificate
|
|
|
|
```bash
|
|
# Generate CA private key
|
|
openssl genrsa -out ca.key 4096
|
|
|
|
# Generate CA certificate
|
|
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt
|
|
|
|
# Verify certificate
|
|
openssl x509 -in ca.crt -text -noout
|
|
```
|
|
|
|
### Installing CA Certificate
|
|
|
|
The CA certificate should be:
|
|
|
|
1. **Embedded in ISO** - During ISO build
|
|
2. **Installed to system** - `/etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca`
|
|
3. **Imported into RPM database** - `rpm --import`
|
|
4. **Added to CA trust** - `update-ca-trust`
|
|
|
|
## CA Private Key
|
|
|
|
### Security Requirements
|
|
|
|
The CA private key is **CRITICAL** to protect:
|
|
|
|
1. **Never include in ISO** - Only use on signing machine
|
|
2. **Store offline** - USB drive or air-gapped system
|
|
3. **Use strong encryption** - AES-256 with passphrase
|
|
4. **Back up securely** - Multiple encrypted backups
|
|
5. **Use hardware token** - HSM for maximum security
|
|
|
|
### Signing Packages
|
|
|
|
```bash
|
|
# Sign RPM packages
|
|
rpm --define "%_gpg_name Your CA Name" --addsign package.rpm
|
|
|
|
# Sign with specific key
|
|
rpm --define "%_gpg_name Your CA Name" --addsign --define '_gpg_transport_key YOUR_KEY_ID' package.rpm
|
|
|
|
# Verify signature
|
|
rpm --checksig package.rpm
|
|
```
|
|
|
|
## Certificate Revocation List (CRL)
|
|
|
|
### What is a CRL?
|
|
|
|
A CRL is a list of certificates that have been revoked before their expiration date. It's used to:
|
|
|
|
1. **Detect compromised certificates**
|
|
2. **Block revoked packages**
|
|
3. **Respond to security incidents**
|
|
4. **Maintain trust**
|
|
|
|
### Creating a CRL
|
|
|
|
```bash
|
|
# Create a certificate to revoke (for testing)
|
|
openssl req -new -nodes -out test.csr
|
|
openssl ca -in test.csr -out test.crt
|
|
|
|
# Revoke the certificate
|
|
openssl ca -revoke test.crt
|
|
|
|
# Generate CRL
|
|
openssl ca -gencrl -out crl.pem
|
|
|
|
# Verify CRL
|
|
openssl crl -in crl.pem -noout -text
|
|
```
|
|
|
|
### CRL Distribution
|
|
|
|
The CRL should be:
|
|
|
|
1. **Hosted on secure server** - HTTPS with authentication
|
|
2. **Signed by CA** - Ensure CRL authenticity
|
|
3. **Updated regularly** - Daily recommended
|
|
4. **Cached locally** - For offline verification
|
|
|
|
## Package Signing
|
|
|
|
### Creating Signed Packages
|
|
|
|
1. **Create package** - Build your RPM package
|
|
2. **Sign package** - Use CA private key to sign
|
|
3. **Distribute** - Share signed package
|
|
4. **Verify** - Recipients verify signature
|
|
|
|
### Example Package Signing Workflow
|
|
|
|
```bash
|
|
# Step 1: Build package
|
|
rpmbuild -bb your-package.spec
|
|
|
|
# Step 2: Sign package
|
|
rpm --define "%_gpg_name Your CA Name" --addsign ~/rpmbuild/RPMS/x86_64/your-package.rpm
|
|
|
|
# Step 3: Verify signature
|
|
rpm --checksig ~/rpmbuild/RPMS/x86_64/your-package.rpm
|
|
```
|
|
|
|
## Security Best Practices
|
|
|
|
### CA Key Management
|
|
|
|
1. **Generate on air-gapped system**
|
|
2. **Store in encrypted storage**
|
|
3. **Use hardware security module (HSM)**
|
|
4. **Implement key rotation**
|
|
5. **Maintain audit trail**
|
|
|
|
### Certificate Management
|
|
|
|
1. **Set appropriate validity period** - 1-3 years for CA
|
|
2. **Use strong algorithms** - RSA 4096, ECDSA P-256
|
|
3. **Implement certificate policies**
|
|
4. **Maintain certificate registry**
|
|
5. **Track certificate lifecycle**
|
|
|
|
### CRL Management
|
|
|
|
1. **Update daily** - Ensure current revocation status
|
|
2. **Sign CRL** - Use CA key for authenticity
|
|
3. **Cache CRL** - For offline verification
|
|
4. **Monitor expiration** - Renew before expiration
|
|
5. **Test revocation** - Verify revocation works
|
|
|
|
### Package Signing
|
|
|
|
1. **Sign all packages** - No unsigned packages
|
|
2. **Verify before install** - Always check signature
|
|
3. **Log all operations** - Audit trail
|
|
4. **Use separate signing keys** - For different purposes
|
|
5. **Implement key rotation** - Regularly rotate keys
|
|
|
|
## Troubleshooting
|
|
|
|
### CA Certificate Not Found
|
|
|
|
```bash
|
|
# Verify certificate exists
|
|
ls -la /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca
|
|
|
|
# Check certificate format
|
|
openssl x509 -in /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca -text -noout
|
|
```
|
|
|
|
### Package Signature Verification Failed
|
|
|
|
```bash
|
|
# Verify package signature
|
|
rpm --checksig package.rpm
|
|
|
|
# Check CA key is imported
|
|
rpm -q gpg-pubkey
|
|
|
|
# Re-import CA key
|
|
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca
|
|
```
|
|
|
|
### CRL Verification Failed
|
|
|
|
```bash
|
|
# Verify CRL format
|
|
openssl crl -in crl.pem -noout -text
|
|
|
|
# Check CRL signature
|
|
openssl crl -in crl.pem -CAfile ca.crt -noout
|
|
|
|
# Verify CRL dates
|
|
openssl crl -in crl.pem -noout -text | grep -E "(Last Update|Next Update)"
|
|
```
|
|
|
|
## References
|
|
|
|
- [OpenSSL Documentation](https://www.openssl.org/docs/)
|
|
- [RPM Signature Documentation](https://docs.fedoraproject.org/en-US/fedora-coreos/security-verification/)
|
|
- [Certificate Management Best Practices](https://csrc.nist.gov/publications)
|
|
|
|
## Contact
|
|
|
|
For questions about CA configuration, contact your security administrator. |