hints:rpki
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| hints:rpki [2024/09/09 13:34] – [FORT] philip | hints:rpki [2025/05/04 23:24] (current) – [Building rpki-client] philip | ||
|---|---|---|---|
| Line 19: | Line 19: | ||
| * [[rpki# | * [[rpki# | ||
| - | The tips and tricks for the validator builds discussed below all are for Ubuntu | + | The tips and tricks for the validator builds discussed below all are for Ubuntu |
| ===== AS0 TALs ===== | ===== AS0 TALs ===== | ||
| Line 32: | Line 32: | ||
| ===== NLnetLabs Routinator ===== | ===== NLnetLabs Routinator ===== | ||
| - | Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.14.0, at time of writing. | + | Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.14.2, at time of writing. |
| If using Debian/ | If using Debian/ | ||
| Line 86: | Line 86: | ||
| ===== FORT ===== | ===== FORT ===== | ||
| - | FORT is the validator developed by NIC Mexico. More about it is on the [[https:// | + | FORT is the validator developed by NIC Mexico. More about it is on the [[https:// |
| - | FORT is available as part of Ubuntu 22.04 packaging, but it is an older version (1.5.3-1), so for this reason we use the latest NIC Mexico produced package. | + | FORT is available as part of Ubuntu 22.04 packaging, but it is an older version (1.5.3-1). Likewise |
| FORT is not quite so easy to install, but still relatively simple as long as you follow the instructions on their [[https:// | FORT is not quite so easy to install, but still relatively simple as long as you follow the instructions on their [[https:// | ||
| Line 95: | Line 95: | ||
| < | < | ||
| - | wget https:// | + | wget https:// |
| </ | </ | ||
| and then install it: | and then install it: | ||
| < | < | ||
| - | sudo apt install ./fort_1.6.3-1_amd64.deb | + | sudo apt install ./fort_1.6.6-1_amd64.deb |
| </ | </ | ||
| Line 151: | Line 151: | ||
| and it should run successfully. You should see something like this when you run **systemctl status fort**: | and it should run successfully. You should see something like this when you run **systemctl status fort**: | ||
| < | < | ||
| - | * fort.service - FORT RPKI validator | + | ● fort.service - FORT RPKI validator |
| - | | + | |
| - | Drop-In: / | + | |
| - | | + | |
| - | | + | |
| Docs: man:fort(8) | Docs: man:fort(8) | ||
| | | ||
| - | Main PID: 3100 (fort) | + | Main PID: 148150 |
| - | Tasks: | + | Tasks: |
| - | | + | |
| + | CPU: 27.801s | ||
| | | ||
| - | | + | |
| + | |||
| + | Oct 07 22:58:03 fort systemd[1]: Started fort.service - FORT RPKI validator. | ||
| </ | </ | ||
| You can check by using **ps ax** to get: | You can check by using **ps ax** to get: | ||
| Line 259: | Line 260: | ||
| sudo make install | sudo make install | ||
| </ | </ | ||
| - | which will install the client in **/ | + | which will install the client in **/ |
| - | < | + | |
| - | wget https://www.arin.net/resources/ | + | |
| - | sudo mv arin.tal /etc/rpki | + | |
| - | </ | + | |
| Now the client can be run. There is no daemon option, it simply runs at the command line, and when it has finished downloading all the VRPs (around 10-15 minutes depending on bandwidth) it exits. But that's okay. Try running the client: | Now the client can be run. There is no daemon option, it simply runs at the command line, and when it has finished downloading all the VRPs (around 10-15 minutes depending on bandwidth) it exits. But that's okay. Try running the client: | ||
| < | < | ||
| Line 281: | Line 279: | ||
| </ | </ | ||
| and that's it. Every hour, cron will run **rpki-client** which will produce JSON output of all the VRPs it has collected. As noted above, JSON output is what is used by StayRTR and GoRTR as their input sources. Make sure that the **/ | and that's it. Every hour, cron will run **rpki-client** which will produce JSON output of all the VRPs it has collected. As noted above, JSON output is what is used by StayRTR and GoRTR as their input sources. Make sure that the **/ | ||
| + | |||
| + | If you would like to include the [[https:// | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| It's a good idea to check the log file in case **rpki-client** reports issues trying to write local files etc. But mostly what you'll see there are all the transactions with the various CAs, and the problems encountered (there will be lots, unfortunately). | It's a good idea to check the log file in case **rpki-client** reports issues trying to write local files etc. But mostly what you'll see there are all the transactions with the various CAs, and the problems encountered (there will be lots, unfortunately). | ||
| Line 289: | Line 292: | ||
| StayRTR is a hard fork of GoRTR (which is no longer maintained by Cloudflare and is badly out of date). For this reason, I **strongly** recommend you use StayRTR rather than GoRTR. If you have an existing GoRTR install, simply replace it with StayRTR. | StayRTR is a hard fork of GoRTR (which is no longer maintained by Cloudflare and is badly out of date). For this reason, I **strongly** recommend you use StayRTR rather than GoRTR. If you have an existing GoRTR install, simply replace it with StayRTR. | ||
| - | StayRTR has now been packaged and is available as part of the Ubuntu 22.04 distribution. However, the packaged version is old (version | + | StayRTR has now been packaged and is available as part of the Ubuntu 22.04 distribution |
| So for this reason, and to stay up to date, at least on Ubuntu, we have to build it ourselves. A pity that the **StayRTR** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator. | So for this reason, and to stay up to date, at least on Ubuntu, we have to build it ourselves. A pity that the **StayRTR** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator. | ||
| Line 297: | Line 300: | ||
| First you will need a working Go environment. Full instructions are at [[https:// | First you will need a working Go environment. Full instructions are at [[https:// | ||
| - | First off, download the latest Go package (1.23.0 at time of writing): | + | First off, download the latest Go package (1.24.1 at time of writing): |
| < | < | ||
| - | wget https:// | + | wget https:// |
| </ | </ | ||
| If you have an existing Go environment, | If you have an existing Go environment, | ||
| Line 309: | Line 312: | ||
| cd /usr/local | cd /usr/local | ||
| sudo chmod 777 . | sudo chmod 777 . | ||
| - | tar xzf ~/go1.23.0.linux-amd64.tar.gz | + | tar xzf ~/go1.24.1.linux-amd64.tar.gz |
| sudo chmod 755 . | sudo chmod 755 . | ||
| </ | </ | ||
| Line 339: | Line 342: | ||
| < | < | ||
| cd dist | cd dist | ||
| - | sudo cp -p stayrtr-v0.5.1-70-g353d1a5-linux-x86_64 / | + | sudo cp -p stayrtr-v0.6.2-linux-x86_64 / |
| - | sudo cp -p rtrdump-v0.5.1-70-g353d1a5-linux-x86_64 / | + | sudo cp -p rtrdump-v0.6.2-linux-x86_64 / |
| - | sudo cp -p rtrmon-v0.5.1-70-g353d1a5-linux-x86_64 / | + | sudo cp -p rtrmon-v0.6.2-linux-x86_64 / |
| </ | </ | ||
hints/rpki.1725888899.txt.gz · Last modified: by philip