Philip Smith's Internet Development Site

User Tools

Site Tools

Trace:
hints:rpki

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
hints:rpki [2025/03/15 11:44] – [FORT] philiphints:rpki [2026/08/01 08:13] (current) – [FORT] philip
Line 19: Line 19:
   * [[rpki#frrouting_hints|FRR]]   * [[rpki#frrouting_hints|FRR]]
  
-The tips and tricks for the validator builds discussed below all are for Ubuntu 22.04. They should also work just fine on Ubuntu 18.04 (which is supported until April 2023) and on Ubuntu 20.04 (which is supported until April 2025).+The tips and tricks for the validator builds discussed below all are for Ubuntu 24.04. They should also work on Ubuntu 18.04 and Ubuntu 20.04 (neither of which is supported), and Ubuntu 22.04 (which is supported until April 2027). If you are installing a fresh container or VM, please use Ubuntu 24.04 (if you are wedded to the Ubuntu family).
  
 ===== AS0 TALs ===== ===== AS0 TALs =====
Line 32: Line 32:
 ===== NLnetLabs Routinator ===== ===== NLnetLabs Routinator =====
  
-Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.14.0, at time of writing.+Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.15.2, at time of writing.
  
-If using Debian/Ubuntu as I do, then just use the supplied package and your favourite package manager. Described in NLnetLabs's [[https://github.com/NLnetLabs/routinator#quick-start-with-debian-and-ubuntu-packages| Github]] repo. +If using Debian/Ubuntu as I do, then just use the supplied package and your favourite package manager. The instructions for how to install are in NLnetLabs excellent [[https://routinator.docs.nlnetlabs.nl/en/stable/installation.html| documentation]].
- +
-If the link to the supplied package is added to your package manager, for example **apt** on Ubuntu, then create an entry in **/etc/apt/sources.list.d** called **nlnetlabs.list** and put this in it (which is for Ubuntu 22.04): +
- +
-<code> +
-deb [arch=amd64] https://packages.nlnetlabs.nl/linux/ubuntu/ jammy main +
-</code> +
- +
-(Note: if you are trying this on Ubuntu 24.04, there is no package for ''noble'' as yet, but I found that using the 22.04 setup works fine.) +
- +
-Then run: +
- +
-<code> +
-wget -qO- https://packages.nlnetlabs.nl/aptkey.asc | sudo tee /etc/apt/trusted.gpg.d/nlnetlabs.asc +
-</code> +
- +
-And then finally: +
- +
-<code> +
-apt-get update +
-apt install routinator +
-</code> +
- +
-Easy!+
  
 The installer will set up the necessary **systemd** file so that Routinator starts automatically on boot. Remember to modify the **/etc/routinator/routinator.config** file so that Routinator listens on the IPv4 (and IPv6) ports of the system - and you can enable the default statistics pages which listen on port 8323. A working configuration file would look like this: The installer will set up the necessary **systemd** file so that Routinator starts automatically on boot. Remember to modify the **/etc/routinator/routinator.config** file so that Routinator listens on the IPv4 (and IPv6) ports of the system - and you can enable the default statistics pages which listen on port 8323. A working configuration file would look like this:
Line 86: Line 63:
 ===== FORT ===== ===== FORT =====
  
-FORT is the validator developed by NIC Mexico. More about it is on the [[https://fortproject.net/en/validator|Project page]]. At time of writing, version 1.6.6 has been released and fixes many issues present in previous versions. However from version 1.6.3, FORT requires Ubuntu 24.04 as it requires libjansson4 (>= 2.14). Ubuntu 22.04 only comes with libjansson4 2.13.1-1.1build3 will only support FORT version 1.6.2.+FORT is the validator developed by NIC Mexico. More about it is on the [[https://fortproject.net/en/validator|Project page]]. At time of writing, version 1.6.7 has been released and fixes many issues present in previous versions. However from version 1.6.3, FORT requires Ubuntu 24.04 as it requires libjansson4 (>= 2.14). Ubuntu 22.04 only comes with libjansson4 2.13.1-1.1build3 will only support FORT version 1.6.2.
  
-FORT is available as part of Ubuntu 22.04 packaging, but it is an older version (1.5.3-1). Likewise for Ubuntu 24.04, the FORT shipped is version 1.6.1-1build3. For this reason we use the latest NIC Mexico produced package.+FORT is available as part of Ubuntu 22.04 packaging, but it is an older version (1.5.3-1). Likewise for Ubuntu 24.04, the FORT shipped is version 1.6.1-1build3. Ubuntu 26.04 ships with version 1.6.7-1. For this reason we use the latest NIC Mexico produced package.
  
 FORT is not quite so easy to install, but still relatively simple as long as you follow the instructions on their [[https://nicmx.github.io/FORT-validator/installation.html| Github]] repo closely. FORT is not quite so easy to install, but still relatively simple as long as you follow the instructions on their [[https://nicmx.github.io/FORT-validator/installation.html| Github]] repo closely.
Line 95: Line 72:
  
 <code> <code>
-wget https://github.com/NICMx/FORT-validator/releases/download/1.6.6/fort_1.6.6-1_amd64.deb+https://github.com/NICMx/FORT-validator/releases/download/1.7.0.experimental/fort_1.7.0.experimental-1_amd64.deb
 </code> </code>
 and then install it: and then install it:
 <code> <code>
-sudo apt install ./fort_1.6.6-1_amd64.deb+sudo apt install ./fort_1.7.0.experimental-1_amd64.deb
 </code> </code>
  
Line 190: Line 167:
 **rpki-client** is just a validator - it does not have the functionality to accept connections from a router. We'll come to that later on (we'll need to use [[rpki#stayrtr|StayRTR]], which is a fork of Cloudflare's now unmaintained GoRTR). **rpki-client** is just a validator - it does not have the functionality to accept connections from a router. We'll come to that later on (we'll need to use [[rpki#stayrtr|StayRTR]], which is a fork of Cloudflare's now unmaintained GoRTR).
  
-**rpki-client** has now been packaged and is available as part of the Ubuntu 22.04 distribution. However, the packaged version is old (version 7.6). At the time of writing, the current release of **rpki-client** is version 8.7.+**rpki-client** has now been packaged and is available across most mainstream Linux/Unix-based platforms. Including as part of the Ubuntu 22.04 and later distributions. However, the packaged version in Ubuntu is old (version 7.6 on 22.04, 9.0 on 24.04). At the time of writing, the current release of **rpki-client** is version 9.8. There is a current version of **rpki-client** on the Ubuntu Snap Store, but not every sysadm wishes to use yet another package manager on Ubuntu.
  
-So for this reason, and to stay up to date, at least on Ubuntu, we have to build it ourselves. A pity that the **rpki-client** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator. Oh well.+My preference is to stay up to date on Ubuntu, and so we have to build it ourselves. A pity that the **rpki-client** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator, given that Ubuntu maintainers seem to be unable to keep the software current. Oh well.
  
-==== Initial Preparation ==== 
  
-Before you attempt to download and build it, the **rpki-client** instructions note that you need a few other packages in place. These include **automake**, **autoconf**, **make**, **git** itself, **libtool** and **expat**. This is all quite easy using the Ubuntu package manager. 
-<code> 
-sudo apt install automake autoconf make git libtool libexpat1-dev 
-</code> 
-The other required package noted in the instructions is **tls** from LibreSSL. LibreSSL is a branch of OpenSSL and is used on OpenBSD - not found on Linux, but seems to be appearing in the latest Debian/Ubuntu beta builds. So we need to download the bits we need and install. The **rpki-client** instructions don't say anything about how to do that. 
  
-First we go to [[https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/|https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/]] and select the latest package, which is libressl-3.9.2.tar.gz at time of writing +==== Initial Preparation ====
-<code> +
-wget https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.9.2.tar.gz +
-</code> +
-We then unpack it: +
-<code> +
-tar zxf libressl-3.9.2.tar.gz +
-</code> +
-and then build it: +
-<code> +
-cd libressl-3.9.2 +
-./configure --enable-libtls-only +
-make +
-sudo make install +
-</code> +
-Note the option to only build **libtls** - we don't need the rest of LibreSSL and it could well interfere with OpenSSL which will already be on the system. Now that **libtls** is built, the **install** action will put the libraries in **/usr/local/lib** like this: +
-<code> +
--rw-r--r-- 1 root root 18679208 Jul 14 10:11 libtls.a +
--rw-r--r-- 1 root root      923 Jul 14 10:11 libtls.la +
-lrwxrwxrwx 1 root root       16 Jul 14 10:11 libtls.so -> libtls.so.29.0.0 +
-lrwxrwxrwx 1 root root       16 Jul 14 10:11 libtls.so.29 -> libtls.so.29.0.0 +
--rw-r--r-- 1 root root  8721528 Jul 14 10:11 libtls.so.29.0.0 +
-</code> +
-Run **sudo ldconfig** so that the system knows about the new libraries.+
  
-Next we need to get some packages that **rpki-client** needs. These are **libssl-dev**, **rsync** and **zlib1g-dev**.+Before you attempt to download and build it, the **rpki-client** instructions note that you need a few other packages in place. These include **automake**, **autoconf**, **make**, **git** itself, **libtool**, **expat**, **libssl-dev**, **libtls-dev**, **rsync** and **zlib1g-dev**. This is all quite easy using the Ubuntu package manager (and some of these packages may already be installed by default).
 <code> <code>
-sudo apt install libssl-dev rsync zlib1g-dev+sudo apt install automake autoconf make git libtool libexpat1-dev libssl-dev libtls-dev zlib1g-dev
 </code> </code>
  
Line 254: Line 202:
 <code> <code>
 sudo groupadd _rpki-client sudo groupadd _rpki-client
-sudo useradd –g _rpki-client –s /sbin/nologin –d /nonexistent –c "rpki-client user" _rpki-client+sudo useradd -g _rpki-client -s /sbin/nologin -d /nonexistent -c "rpki-client user" _rpki-client
 </code> </code>
 Now we can install RPKI-client: Now we can install RPKI-client:
Line 260: Line 208:
 sudo make install sudo make install
 </code> </code>
-which will install the client in **/usr/local/sbin** and the 4 TALs in **/etc/rpki**, as well as create the cache and output directories needed. Note that the ARIN TAL requires users to read the disclaimer first so is not provided by default. So you need to do this manually: +which will install the client in **/usr/local/sbin** and the 5 TALs in **/etc/rpki**, as well as create the cache and output directories needed. It will also copy the 5 RIR "constraints" files into **/etc/rpki**; these prevent [[https://datatracker.ietf.org/doc/draft-snijders-constraining-rpki-trust-anchors/|overclaiming of resources]] by the 5 RIRs. 
-<code> +
-wget https://www.arin.net/resources/manage/rpki/arin.tal +
-sudo mv arin.tal /etc/rpki +
-</code>+
 Now the client can be run. There is no daemon option, it simply runs at the command line, and when it has finished downloading all the VRPs (around 10-15 minutes depending on bandwidth) it exits. But that's okay. Try running the client: Now the client can be run. There is no daemon option, it simply runs at the command line, and when it has finished downloading all the VRPs (around 10-15 minutes depending on bandwidth) it exits. But that's okay. Try running the client:
 <code> <code>
Line 282: Line 227:
 </code> </code>
 and that's it. Every hour, cron will run **rpki-client** which will produce JSON output of all the VRPs it has collected. As noted above, JSON output is what is used by StayRTR and GoRTR as their input sources. Make sure that the **/etc/cron.hourly/rpki-client** is executable, otherwise it will not run. and that's it. Every hour, cron will run **rpki-client** which will produce JSON output of all the VRPs it has collected. As noted above, JSON output is what is used by StayRTR and GoRTR as their input sources. Make sure that the **/etc/cron.hourly/rpki-client** is executable, otherwise it will not run.
 +
 +If you would like to include the [[https://bgp4all.com/pfs/hints/rpki#as0_tals|AS0 TALs]] from APNIC and LACNIC it is not sufficient to just place them in your chosen TAL directory. You will also need to include the **-0** option in the command line, like this:
 +<code>
 +/usr/local/sbin/rpki-client -0j > /tmp/rpki-client.log 2>&1
 +</code>
  
 It's a good idea to check the log file in case **rpki-client** reports issues trying to write local files etc. But mostly what you'll see there are all the transactions with the various CAs, and the problems encountered (there will be lots, unfortunately). It's a good idea to check the log file in case **rpki-client** reports issues trying to write local files etc. But mostly what you'll see there are all the transactions with the various CAs, and the problems encountered (there will be lots, unfortunately).
Line 298: Line 248:
 First you will need a working Go environment. Full instructions are at [[https://go.dev/doc/install|https://go.dev/doc/install]], and I've reproduced the key pieces here to make it easy for installers. First you will need a working Go environment. Full instructions are at [[https://go.dev/doc/install|https://go.dev/doc/install]], and I've reproduced the key pieces here to make it easy for installers.
  
-First off, download the latest Go package (1.24.1 at time of writing):+First off, download the latest Go package (1.24.4 at time of writing):
 <code> <code>
-wget https://go.dev/dl/go1.24.1.linux-amd64.tar.gz+wget https://go.dev/dl/go1.24.4.linux-amd64.tar.gz
 </code> </code>
 If you have an existing Go environment, perhaps save it in case something goes wrong with the new version: If you have an existing Go environment, perhaps save it in case something goes wrong with the new version:
Line 310: Line 260:
 cd /usr/local cd /usr/local
 sudo chmod 777 . sudo chmod 777 .
-tar xzf ~/go1.24.1.linux-amd64.tar.gz+tar xzf ~/go1.24.4.linux-amd64.tar.gz
 sudo chmod 755 . sudo chmod 755 .
 </code> </code>
Line 340: Line 290:
 <code> <code>
 cd dist cd dist
-sudo cp -p stayrtr-v0.6.2-linux-x86_64 /usr/local/bin/stayrtr +sudo cp -p stayrtr-v0.6.4-1-g4bad963-linux-x86_64 /usr/local/bin/stayrtr 
-sudo cp -p rtrdump-v0.6.2-linux-x86_64 /usr/local/bin/rtrdump +sudo cp -p rtrdump-v0.6.4-1-g4bad963-linux-x86_64 /usr/local/bin/rtrdump 
-sudo cp -p rtrmon-v0.6.2-linux-x86_64 /usr/local/bin/rtrmon+sudo cp -p rtrmon-v0.6.4-1-g4bad963-linux-x86_64 /usr/local/bin/rtrmon
 </code> </code>
  
hints/rpki.1742039045.txt.gz · Last modified: by philip