Michael's Daemonic Doodles

Install pkgng (master)

Make sure to install pkgng from ports, since it always has the latest version.

cd /usr/ports/ports-mgmt/pkg
make install clean
cd /var/tmp
pkg_create -b pkg-\*
pkg2ng
echo 'WITH_PKGNG=yes' >> /etc/make.conf

Install nginx (master)

Make sure to enable the HTTP_SSL option in its configuration dialog.

cd /usr/ports/www/nginx
make config
make install clean
echo 'nginx_enable="YES"' >> /etc/rc.conf

Create nginx server certificate (master)

There is no real reason why the server certificate should be issued by the same CA as client certificates (unless you have already have an elaborate PKI in place). So for the sake of this tutorial we'll just create a self- signed certificate clients will trust.

For the sake of example this is called pm01.example.org (for package master 1), since we might want to add additional package hosts to our setup later on.

cd /usr/local/etc/nginx
openssl req -x509 -nodes -days 3650 \
-subj '/C=DE/ST=BY/L=Munich/O=Example Ltd/CN=pm01.example.org' \
-newkey rsa:2048 -keyout pm01.example.org.key -out pm01.example.org.crt
chmod 400 *.key *.crt

Create simple CA (ca)

Best case, the CA should be on a dedicated device (e.g. laptop not connected to a network). For most setups a separate server or even placing it on the master should be acceptable.

OpenSSL will ask you for a password for the CA key.

mkdir /usr/local/etc/pkgca
chown 700 /usr/local/etc/pkgca
cd /usr/local/etc/pkgca
openssl req -x509 -days 3650 \
-subj '/C=DE/ST=BY/L=Munich/O=Example Ltd/OU=pkgng/CN=PackageCA' \
-newkey rsa:2048 -keyout pkgca.key -out pkgca.crt
echo "01" > serial
chmod 400 *.key *.crt

Configure and start nginx (master)

Copy pkgca.crt from ca host to the master to /usr/local/etc/nginx/pkgca.crt.

Create a custom nginx.conf:

cat >/usr/local/etc/nginx/nginx.conf <<"EOF"
worker_processes  1;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;
    keepalive_timeout  65;

    ssl                  on;
    ssl_certificate      pm01.example.org.crt;
    ssl_certificate_key  pm01.example.org.key;

    ssl_session_timeout  5m;

    ssl_protocols  SSLv3 TLSv1;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;
    ssl_client_certificate pkgca.crt;
    ssl_verify_client on;
    ssl_verify_depth 1;

    map $ssl_client_s_dn $ssl_client_s_dn_cn {
        default "";
        ~/CN=(?<CN>[^/]+) $CN;
    }

    log_format  main  '$remote_addr - $ssl_client_s_dn_cn [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx-access.log  main;

    server {
        listen       443 ssl default_server;
        server_name  pm01.example.org;
        root   /usr/local/www/nginx;

        # redundant check
        if ($ssl_client_verify != SUCCESS) {
            return 496;
        }

        # make sure there are no fishy characters in cn
        if ($ssl_client_s_dn_cn !~ "^[a-z0-9]{1,10}$") {
            return 496;
        }

        location / {
            root   /usr/local/www/pkg/$ssl_client_s_dn_cn;
        }
    }
}
EOF
service nginx start

This configuration ensures only trusted clients (read: clients using a certificate signed by the package CA) are allowed to access the server. The CN part of the certificate is used as the user name and will show up in nginx-access.log.

Each package repository is stored in /usr/local/www/pkg/<CN>. You can use symbolic links to group clients.

Create default repository (master)

The next step is to create a default repository that will contain the basic package repository most hosts will access. Typically most hosts will just need a simple vanilla set of packages.

mkdir -p /usr/local/www/pkg/default
cd /usr/local/www/pkg/default
pkg create -a
pkg repo .

Install pkgng (client)

First, copy the tbz file created on the master above (/var/tmp/pkg-version.tbz) to the client. Install it and make convert to pkgng:

pkg_add /path/to/pkg-x.y.tbz
pkg2ng
echo 'WITH_PKGNG=yes' >> /etc/make.conf

Patching libfetch (client)

pkgng uses libfetch (which is part of base and therefore doesn't add any additional dependencies to pkg). Libfetch's support for HTTPS is fairly minimal, so the first step was to implement proper SSL support for it.

I submitted a patch - and several improvements - as a PR to the FreeBSD project, which is still under review. This patch was created on FreeBSD 9.1-RELEASE, but should also apply for the most part on other recent versions of the OS.

So the first step is to patch libfetch:

1. Obtain the current version of patch
2. Apply the patch

cd /usr/src
patch < /path/to/patch
cd /usr/src/lib/libfetch
make obj && make depend && make && make install
cd /usr/src/usr.bin/fetch
make obj && make depend && make && make install

Create client CSR (client)

cd /etc/ssl
openssl req \
-subj "/C=DE/ST=BY/L=Munich/O=Example Ltd/OU=pkgng/CN=client01" \
-new -newkey rsa:2048 -out pkgclient01.csr \
-keyout pkgclient01.key -nodes
chmod 400 *.key

Sign the client CSR (ca)

Copy the certificate request created above to the ca host to /usr/local/etc/pkgca/pkgclient01.csr.

Sign it using openssl:

cd /usr/local/etc/pkgca
openssl x509 -req -days 3650 -in pkgclient01.csr -out pkgclient01.crt \
-CA pkgca.crt -CAkey pkgca.key -CAserial serial

Finish client configuration (client)

1. Copy pkgclient01.crt to /etc/ssl/pkgclient01.crt
2. Place the content of pm01.example.org.crt from master into /etc/ssl/pkgmaster.pem.
3. Make sure all files in /etc/ssl are only writable by root and key files are only readable by root.
4. Change packagesite to the example host (this overwrites your existing pkg.conf):

echo "packagesite: https://pm01.example.org" > /usr/local/etc/pkg.conf

5. In case you're not using official DNS names or working within a private network without access to DNS, add the host to /etc/hosts, e.g.

192.168.100.2 pm01.example.org

Grant access to client (master)

There are two different options:

1. The client should get access to our default set of packages:

cd /usr/local/www/pkg
ln -s default client01

2. The client should get access to a custom package repository (e.g. only containing dialog4ports):

mkdir /usr/local/www/pkg/client01
cd /usr/local/www/pkg/client01
pkg create dialog4ports
pkg repo .

To revoke access, simple remove the directory or symlink matching the client's CN.

Testing (client)

Before testing, issue the following command to create an alias for the pkg command:

alias pkg="SSL_CLIENT_KEY_FILE=/etc/ssl/pkgclient01.key \
SSL_CLIENT_CERT_FILE=/etc/ssl/pkgclient01.crt \
SSL_CA_CERT_FILE=/etc/ssl/pkgmaster.pem pkg"

It's best to add this to your/the root users .profile so you won't have to issue it every time you're using pkg.

Next, try to update the catalog and install dialog4ports:

pkg update
pkg install -y dialog4ports

Create a repository signing key (master)

For the sake of example we put the into root's home directory. The exact location depends on who's doing the actual signing.

OpenSSL will ask you for a password for the signing key.

openssl genrsa -aes256 -out /root/reposign.privkey 2048
chmod 400 /root/reposign.privkey
openssl rsa -in /root/reposign.privkey -pubout -out /root/reposign.pubkey

Sign the repository (master)

Signs the repository for client01. Apply the same procedure for default and all other repositories.

cd /usr/local/www/pkg/client01
pkg repo . /root/reposign.privkey

Configure client to verify signature (client)

On the client, copy reposign.pubkey to /etc/ssl/reposign.pubkey and add signature checking to the configuration file:

echo "pubkey: /etc/ssl/reposign.pubkey" >> /usr/local/etc/pkg.conf

Testing (client)

pkg update -f
pkg delete -y dialog4ports
pkg install -y dialog4ports

Feel free to play with this a little to make sure the signature gets actually checked.