Page tree
Skip to end of metadata
Go to start of metadata

Using FreePBX Signed Keys

After your key has been signed by the FreePBX Master Key, you will be able to sign modules using the 'sign.php' script in the Devtools repo.

[[email protected] devtools]# ./sign.php /var/www/html/admin/modules/paging
Signing /var/www/html/admin/modules/paging with 51F5B68D25155DCB
        Generating file list...
        Signing /var/www/html/admin/modules/paging/module.sig..
Done
[[email protected] devtools]# ls -al /var/www/html/admin/modules/paging/module.sig
-rw-r--r-- 1 root root 4625 Nov 17 12:51 /var/www/html/admin/modules/paging/module.sig

If you don't have a key signed by FreePBX, you will need to specify which key you want to use to sign the package. You may still sign your packages, but they will appear as a Warning on FreePBX as 'Invalid Key'

[[email protected] devtools]# ./sign.php /var/www/html/admin/modules/paging
Wasn't able to find a valid key. Sorry
[[email protected] devtools]# gpg --list-secret-keys
/root/.gnupg/secring.gpg
------------------------
sec   2048R/E407B7AB 2014-11-17 [expires: 2015-11-17]
uid                  Ed Led Ovum (Ovum.com FreePBX Module Signing Key) <[email protected]>
ssb   2048R/19663421 2014-11-17
[[email protected] devtools]# ./sign.php /var/www/html/admin/modules/paging E407B7AB
Signing /var/www/html/admin/modules/paging with E407B7AB
        Generating file list...
        Signing /var/www/html/admin/modules/paging/module.sig..
Done
[[email protected] devtools]#

To get the fingerprint keys:

gpg --fingerprint 
pub   2048R/28F9D098 2018-01-28
      Key fingerprint = 965F 09B9 50B5 0BD9 7BAA  0E0F 9687 8C74 28F9 D098
uid                  Franck Danard <[email protected]>
sub   2048R/18F01234 2018-01-28

The fingerprint key will be : 96878C7428F9D098

It is expected that you tar the module directory up and distribute as normal, with the module.sig file included.

Using Local Keys

If your key is not signed by the FreePBX Master Key, you can create a system-specific signature by running sign.php with the extra parameter '--local', as below:

[[email protected] devtools]# ./sign.php /var/www/html/admin/modules/gpgtest --local 4058826678A79FC4
Installing to local signing directory
Signing with 4058826678A79FC4
	Generating file list...
	Signing /etc/freepbx.secure/gpgtest.sig..
Done
Tagging module for local signing...
Done
[[email protected] devtools]# 
 

Create a shortcut to sign

If you want to make a cmd line to sign your module, you can create a new file (sign) in /usr/bin/ and put this code like this:


#!/bin/sh
module=$1;
key=$2;

/usr/src/devtools/sign.php /var/www/html/admin/modules/$module $key


Next, change privileges like this:

chmod 755 /usr/bin/sign

Next, you can use it like this.


# sign paging

or

# sign paging E407B7AB


Local Key Walkthrough

If you want to sign a module on your own system so it is protected against unauthorized tampering, here is an example of how to do it.

Note that these commands must be run as root on your machine. 

Key Generation

Generate a key as per GPG Key Generation HowTo, or use your own key. You only need to run the 'gpg --gen-key' command, there is no need to push it out to the Web Of Trust.

Toolkit

Download the 'devtools' toolkit from Git. This contains scripts and helpers that are used to sign modules. This should be placed in /usr/src/devtools

[[email protected] /]# cd /usr/src
[[email protected] src]# git clone http://git.freepbx.org/scm/freepbx/devtools.git
Cloning into 'devtools'...
remote: Counting objects: 11092, done.
remote: Compressing objects: 100% (7144/7144), done.
remote: Total 11092 (delta 4301), reused 10276 (delta 3763)
Receiving objects: 100% (11092/11092), 11.69 MiB | 600.00 KiB/s, done.
Resolving deltas: 100% (4301/4301), done.
[[email protected] src]#

Sign the module

As this key is NOT signed by the FreePBX Development Team, the signing tool can not automatically detect which key to use.  You need to specify the key on the command line.

[[email protected] ~]# /usr/src/devtools/sign.php /var/www/html/admin/modules/ponies --local 464742D0
Installing to local signing directory
Signing with 464742D0
        Generating file list...
        Signing /etc/freepbx.secure/ponies.sig..
Done
Tagging module for local signing...
Done
[[email protected] ~#]

Complete Session walkthrough

[[email protected] ~]# gpg --gen-key
gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: Test Key
Email address: [email protected]
Comment: Test key to demonstrate local signing
You selected this USER-ID:
    "Test Key (Test key to demonstrate local signing) <[email protected]>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.
You don't want a passphrase - this is probably a *bad* idea!
I will do it anyway.  You can change your passphrase at any time,
using this program with the option "--edit-key".
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key 464742D0 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   2  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
pub   2048R/464742D0 2016-11-29
      Key fingerprint = 0F5C ACDF 5BCA 939D 68CD  CAAC 1838 1192 4647 42D0
uid                  Test Key (Test key to demonstrate local signing) <[email protected]>
sub   2048R/7E11F49B 2016-11-29
[[email protected] ~]# cd /usr/src
[[email protected] src]# git clone http://git.freepbx.org/scm/freepbx/devtools.git
Cloning into 'devtools'...
remote: Counting objects: 11092, done.
remote: Compressing objects: 100% (7144/7144), done.
remote: Total 11092 (delta 4301), reused 10276 (delta 3763)
Receiving objects: 100% (11092/11092), 11.69 MiB | 600.00 KiB/s, done.
Resolving deltas: 100% (4301/4301), done.
[[email protected] src]# devtools/sign.php /var/www/html/admin/modules/ponies --local 464742D0
Installing to local signing directory
Signing with 464742D0
        Generating file list...
        Signing /etc/freepbx.secure/ponies.sig..
Done
Tagging module for local signing...
Done
[[email protected] src#]

As mentioned above, you must do this as root, and it will fail if you try to do this as another user. This is to ensure that non-root users can't tamper with modules that the root user has deemed safe.

 

 

  • No labels