Skip to content

Security

Jump to bottom Edit New page
Jason Charney edited this page Feb 10, 2015 · 7 revisions

Installing the security packages is a lot more complex than it should be. It became such a irksome chore to divide them up in to separate pages, that the instructions for installing them had to be put into a single page.

This is a job for source installation!

As much as everyone kept saying "install the apt-get packages, installing from source is too much work" this process really needs to be done in source. The reason: Last year's Heartbleed bug fiasco. The fact that the Transportation Security Layer (TLS) is mentioned is more than enough motivation to install GnuTLS from source rather than binary.

But there is just one problem, not everything that GnuTLS relies on seems to understand that anything that wasn't upgraded prior to April 2014 needed to be upgraded too.

So as I am writing this page, I'm caught between a rock and a hard place because GnuTLS, despite being upgrade in January 2015 won't support the latest stable version of Nettle (3.0), and Nettle (2.7.1) won't reconginze the latest stable version of GMP (6.0.0) and pass that information on to GnuTLS to know where the new libhogweed libraries are.

Basically, it's been a frustrating week here at the Rigel wiki trying to communicate the problem on the Odroid forum without having someone say "Install the binaries" which is a really bad idea considering the version of libhogweed is from 2012.

So what is OK to install using apt-get?

The usual stuff if you haven't installed it.

sudo apt-get install autogen bison yacc flex

And the rest from source

There was quite a bit of stuff to download and extract, so I did everyone a favor and made the dlxt script and put the list if files into security_packages.txt.

cd ~/Software
git clone https://github.com/jrcharney/rigel.git
cd rigel/
bash dlxt -f security_packages.txt

Now it's time to go through everything. For some reason, I don't seem to have as many problems installing these packages when inside of tmux. I'm looking into why that but for now, I'm content.

# Download extract our stuff first
$ cat security_packages.txt
ftp://ftp.gnutls.org/gcrypt/libgpg-error/libgpg-error-1.17.tar.bz2
ftp://ftp.gnutls.org/gcrypt/libgcrypt/libgcrypt-1.6.2.tar.bz2
ftp://ftp.gnutls.org/gcrypt/libassuan/libassuan-2.2.0.tar.bz2
ftp://ftp.gnutls.org/gcrypt/libksba/libksba-1.3.2.tar.bz2
ftp://ftp.gnutls.org/gcrypt/npth/npth-1.1.tar.bz2
ftp://ftp.gnutls.org/gcrypt/pinentry/pinentry-0.9.0.tar.bz2
ftp://ftp.gnutls.org/gcrypt/gnupg/gnupg-2.1.1.tar.bz2
# ftp://ftp.gnutls.org/gcrypt/gpgme/gpgme-1.5.3.tar.bz2   # I had some trouble with this. Not installing it.
https://gmplib.org/download/gmp/gmp-6.0.0a.tar.bz2
https://unbound.net/downloads/unbound-1.5.1.tar.gz
http://ftp.gnu.org/gnu/libtasn1/libtasn1-4.2.tar.gz
http://p11-glue.freedesktop.org/releases/p11-kit-0.22.1.tar.gz
https://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gz
ftp://ftp.gnutls.org/gcrypt/gnutls/v3.3/gnutls-3.3.12.tar.xz
# All those files should be in the security_packages.txt

# TODO: What if we modified the gmp-6.0.0/config.guess file first?
# TODO: Can we not do 'make check' for gmp?

libgpg-error-1.17/
./configure && make && sudo make install && sudo ldconfig
cd ../libcrypt-1.6.2/
./configure && make && sudo make install && sudo ldconfig
cd ../libassuan-2.2.0/
./configure && make && sudo make install && sudo ldconfig
cd ../libksba-1.3.2/
./configure && make && sudo make install && sudo ldconfig
cd ../npth-1.1/
./configure && make && sudo make install && sudo ldconfig
cd ../pinentry-0.9.0/
./configure && make && sudo make install && sudo ldconfig
cd ../gnupg-2.1.1/
./configure && make && sudo make install && sudo ldconfig #this would like gnutls
cd ../gmp-6.0.0/
# These next four lines are for the Odroid U3 only, because /proc/cpuinfo says all four cpus are the same.
cp config.guess config.guess.backup                    # In case we screw up.
sed -i '176s/\(null\)/\1 | sort -u/' config.guess      # append 'sort -u' after the word 'null'
sed -i '203s/\(null\)/\1 | sort -u/' config.guess      # append 'sort -u' after the word 'null'
rm config.guess.backup                                 # When we succeed
./configure
make # -j5 tp use all four processors. When not in tmux, assembly problems occur. Probably terminal settings.
make check
sudo make install
cd ../unbound-1.5.1/
./configure && make && sudo make install
cd ../libtasn1-4.2/
./configure && make && sudo make install
cd ../p11-kit-0.22.1/
./configure && make && sudo make install
cd ../nettle-2.7.1/      # We can't install nettle 3.0 yet, gnutls won't accept it.
./configure && make && sudo make install
cd ../gnutls-3.3.12/
./configure
make   # for some reason "../lib/.libs/libgnutls.so: undefined reference to `...'" after CCLD psktool. Stuck
sudo make install

libdane

External Links

Add a custom footer
Add a custom sidebar

Clone this wiki locally