Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

Tag: public

  • Yum: Under the Covers with GPG Keys

    Skeleton_key_1_keychain_sculpture_photo_cut_outs-r558fef9b275d4609b522ac07970a6af6_x7sa6_8byvr_324Hey look at this spooky key. Don't be frightened little one. Nothing scary is going to happen to you here. This is a safe place. As a matter of fact, if you stick around you might just learn a thing or two. A thing or two about GPG!

    First off do any of us really know what GPG stands for? Well yes we do! It stands for GNU Privacy Guard. RPM Package creators use GPG to apply a digital signature to their packages. If a package was tampered with, then its GPG signature will no longer match what was placed in the original package.

    First off to check what keys you have installed on your Linux server you can run the following rpm command as show in the example below.

    [root@ip-172-31-22-45 ~]# rpm -qa gpg-pubkey
    gpg-pubkey-0608b895-4bd22942
    gpg-pubkey-fd431d51-4ae0493b
    gpg-pubkey-2fa658e0-45700c69

     

    Neet I have three keys installed. But lets say want to install another one. Well I can do so with the command below. In this example I have navigated to /etc/pki/rpm-gpg and am going to install the redhat beta key on my server.

    [root@ip-172-31-22-45 rpm-gpg]# rpm –import RPM-GPG-KEY-redhat-beta

    Hey that was fun. Now lets get our hands a bit dirtier.

    Want to get more information on a specific key. Then this command is your huckleberry. Here you can see that this is the pubkey for the EPEL repo.

    [root@ip-172-31-22-45 rpm-gpg]# rpm -qi gpg-pubkey-0608b895-4bd22942
    Name        : gpg-pubkey                   Relocations: (not relocatable)
    Version     : 0608b895                          Vendor: (none)
    Release     : 4bd22942                      Build Date: Sat 14 Jun 2014 09:13:58 AM EDT
    Install Date: Sat 14 Jun 2014 09:13:58 AM EDT      Build Host: localhost
    Group       : Public Keys                   Source RPM: (none)
    Size        : 0                                License: pubkey
    Signature   : (none)
    Summary     : gpg(EPEL (6) <epel@fedoraproject.org>)
    Description :

     

    To verify signature of a downloaded package, use the rpm command as shown below. In this example I have highlighted the key that was used to sign this package.

    # rpm -vK nautilus-dropbox-1.6.0-1.fedora.i386.rpm
    nautilus-dropbox-1.6.0-1.fedora.i386.rpm:
        Header V3 RSA/SHA1 Signature, key ID 5044912e: OK
        Header SHA1 digest: OK (a4d51906633f92913db075ba33946f50999c245e)
        V3 RSA/SHA1 Signature, key ID 5044912e: OK
        MD5 digest: OK (1b8ff7abc18f68bf274e24fc57fd3a87)

     

    Using the bolded information in the example above, I can then use this information to track down the exact key that was used to sign the package.

    [root@localhost Downloads]# rpm -qa | grep 5044912e
    gpg-pubkey-5044912e-4b7489b1

     

    Is this awesome, well not really, but you never know when you might need to use this information. Like on a test. Wink Wink.
    Related articles

    Using Yum Update to Apply Security Patches Only
    How to Enable EPEL Repository on CentOs for Yum
    Signing rpm packages with GPG

  • RHEL6 – How to Setup an Anonymous Download Only FTP Server

    Sticker,375x360A while back I spit out a post on how to configure an anonymous ftp server that allowed uploads and downloads, which you can find here.

    Its a very exciting read and will tell you everything that you need to know to get you up and running with an anonymous ftp server. However those instructions are specifically for a server that allows anonymous uploads as well as downloads. So today we are going to go over only the steps for anonymous download, which is actually much easier.

    Basic Install & Configuration

    So first lets install vsftp.

    # yum -y install vsftpd && service vsftpd start && chkconfig vsftpd on

    Then edit /etc/vsftp/vsftpd.conf and make sure that the following line is uncommented.

    anonymous_enable=YES

    You should also be aware of the following configuration directive. By setting local enable to no in /etc/vsftp/vsftpd.conf, you disallow local Unix users access to ftp, which ensures that your ftp server is truly anonymous only.

    local_enable=no

    Now restart vsftpd and you should be in business

    Testing Anonymous Download

    To test ftp you need an ftp client, which can be installed via yum as seen below.

    yum -y install ftp

    Then you should be able to ftp to localhost like as seen below and get a file. Note that an anonymous login does not a password

    # ftp localhost
    Trying 127.0.0.1…
    Connected to localhost (127.0.0.1).
    220 (vsFTPd 2.2.2)
    Name (localhost:root): anonymous
    331 Please specify the password.
    Password:
    230 Login successful.
    Remote system type is UNIX.
    Using binary mode to transfer files.
    ftp> ls
    227 Entering Passive Mode (127,0,0,1,170,125).
    150 Here comes the directory listing.
    drwxr-xr-x    2 0        0            4096 Aug 30 15:37 pub
    -rw-r–r–    1 0        0               0 Aug 30 15:39 test2
    -rw-r–r–    1 0        0               0 Aug 30 15:38 testfile
    226 Directory send OK.
    ftp> get test2

    The same test executed as root ( a local user) should fail as seen below.

    # ftp localhost
    Trying 127.0.0.1…
    Connected to localhost (127.0.0.1).
    220 (vsFTPd 2.2.2)
    Name (localhost:root): root
    530 This FTP server is anonymous only.
    Login failed.
    ftp>

    Unix File Permissions and SELinux

    One of the things that can ruin your day when it comes to getting and ftp server up and running is SELinux. However when setting up an anonymous download ftp server using the default ftp root directory you don’t actually need to change anything.

    By default your ftp root directory is going to be /var/ftp/, and its SELinux context and default perms are going to be as seen below.

    drwxr-xr-x. root root system_u:object_r:public_content_t:s0 /var/ftp

    Here the default context is public_content_t which by allows reads but not writes, and the default Unix perms allow reads and not writes.

    Changing Default FTP Root Directory

    If you wanted to change anonymous vsftp to use a different root directory (other than /var/ftp) you would need to add the following line to /etc/vsftpd/vsftpd.conf. In the example below I am setting my new ftp root to /shared/ftp

    anon_root=/shared/ftp

    You are also going to need to asign the correct SELinux file context (public_content_t) to your new directory.

    # semanage fcontext -a -t public_content_t “/shared/ftp(/.*)?”

    # restorecon -vvFR /shared/ftp

    Configuration Differences Between Anon Upload and Download

    So as I stated above its actually a bit easier to configure an anonymous download only ftp server, than it is to configure it to allow uploads as well.  This section for reference only, my post on configuring anonymous upload and download ftp server can be reference here.

    First you will need to assign a different SELinux context. Its public_content_rw_t not public_content_t.

    # semanage fcontext -a -t public_content_rw_t ‘/var/ftp(/.*)’

    # restorecon -vvFR /var/ftp

    You will also need to fiddle with SELinux booleans

    # setsebool -P allow_ftpd_anon_write=1

    And we are also going to want to change the Unix permissions on our ftp root directory. Here we are changing group ownership to ftp and setting the setgid bit.

    # chgrp ftp /var/ftp/
    # chmod 2760 /var/ftp

    Good luck and try not to break anything.