証明書検証サーバの概要

Size: px

Start display at page:

Download "証明書検証サーバの概要"

れいなおおふさ
5 years ago
Views:

2 OCSP RedHat Linux RedHat IP RPM OpenLDAP PostgreSQL...!.. AiCrypto Dumpasn PostgreSQL...6 rshd Cygwin Cygwin...8 Perl HOSTS OpenLDAP OCSP GCVS LDAP PostgreSQL rsh PostgreSQL DB... 20

3 PKI Linux Win32Cygwin IP Linux (RedHat7.3 ) (NIC) Win32 (Windows 2000,XP ) (NIC) LAN IP

4 PKI ( ) RedHat Linux 7.3 PostgreSQL 7 Apache Web Server 2.x Perl 5 OpenLDAP Server AiCrypto Library rsh gcc dumpasn1 RedHat Linux 7.3 GONEKDE (ipchains) DHCP IP RedHat PKI LDAP IP GPKI A-Sign2 for G-ID IP (NIC) IP IP OCSP GPKI (GCVS)

5 IP LDAP IP mmm1 NIC IP ( RedHat IP ) IP GPKI A-Sign2 OCSP G-ID GCVS /etc/hosts mmm1 localhost mmm1 ldap1 dmz-dir.gpki.go.jp ldap2 iso389.jcsinc.go.jp crca.moj.go.jp ocsp ldap3 repository.secomtrust.net cvs ldap4 IP IP /etc/sysconfig/network-scripts/ifcfg-eth0:1 /etc/sysconfig/network-scripts/ifcfg-eth0:2 /etc/sysconfig/network-scripts/ifcfg-eth0:3 /etc/sysconfig/network-scripts/ifcfg-eth0:1 DEVICE=eth0:1 BOOTPROTO=static IPADDR=' ' NETMASK= ONBOOT=yes /etc/sysconfig/network-scripts/ifcfg-eth0:2 DEVICE=eth0:2 BOOTPROTO=static IPADDR=' ' NETMASK= ONBOOT=yes /etc/sysconfig/network-scripts/ifcfg-eth0:3 DEVICE=eth0:2 BOOTPROTO=static IPADDR=' ' NETMASK= ONBOOT=yes

6 mmm1ldap1ldap2ldap3 ldap4 ping PKI RedHat (RPM) () apache apache-devel apache-manual apacheconf db Distutils gcc perl perl-dbd-pg perl-dbi postgresql postgresql-libs rsh rsh-server xinetd $ rpm qa sort RPM $ rpm ivh [RPM ] OpenLDAP RPM --enebale-referrals LDAP v2 GPKI OpenLDAP $ tar xvfz openldap tgz $ cd openldap / $./configure --enable-referrals --enable-ldbm --disable-bdb $ make depend $ make $ su # make install

7 PKI AiCrypto aicrypto21.tar.gz /usr/local/aica Dumpasn1 Peter Gutmann ASN.1 dumpasn1.c dumpasn1.cfg $ gcc -o dumpasn1 dumpasn1.c dumpasn1 dumpasn1.cfg /usr/local/bin

8 1. /etc/profile.d/postgres.sh export PGLIB=/usr/lib/pgsql export PGDATA=/var/lib/pgsql/data export LD_LIBRARY_PATH="$LD_LIBRARY_PATH":"$PGLIB" 2. PostgreSQL # su - postgres $ initdb -D $PGDATA 3. $PGDATA/pg_hba.conf IP-ADDRESS IP-MASK # TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD local all all trust host all all trust host all all trust 4. PostgreSQL usernameapache root PostgreSQL $ su # /etc/rc.d/init.d/postgresql start # /sbin/chkconfig --add postgres # su - postgres $ createuser username Shall the new user be allowed to create databases? (y/n) y Shall the new user be allowed to create more new users? (y/n) y CREATE USER # createuser apache Shall the new user be allowed to create databases? (y/n) n Shall the new user be allowed to create more new users? (y/n) n CREATE USER # createuser root Shall the new user be allowed to create databases? (y/n) y Shall the new user be allowed to create more new users? (y/n) n CREATE USER

9 /etc/xinetd.d/{rsh,rexec} 2 disable = yes disable = noxinetd $ su # /etc/init.d/xinetd restart xinetd # /sbin/chkconfig -level=35 xinetd on rsh username$home/.rhosts mmm2mmm1 IP $ cd ~ $ vi.rhosts mmm1 mmm2 $ chmod 400.rhosts rsh.bashrc.bashrc my_name export PKITESTROOT=/home/my_name/pki14y export PKITESTDB=jnsaipa0833 PKITESTROOT /home/my_name/pki14y PKITESTDB jnsaipa0833 PKITESTDB_USER NULL PKITESTDB_PASSWD NULL

10 Windows Unix Cygwin cygwin default setup packages (bash, cp, mv, ) inetutils (rsh) perl5 gcc openssh(client) openssl(client) PostgreSQL(client) Perl DBI DBD::Pg ActivePerl Cygwin i. Cygwin RedHat URL Install now!setup.exe ii. setup.exe iii. Choose A Download Source (Install from Internet) iv. Select Root Install DirectoryRoot Directory Install For Cygwin (All Users)Default Text File Type (Unix) v. Select Local Package Directory vi. vii. Choose Download Site

11 ring.asahi-net.or.jpring.aist-net.or..jp viii. Select Packages View New Skip ix. Perl DBI DBD-Pg 2 i. CPAN URL DBI ii. (DBI-1.32) [Download]( DBI-1.32.tar.gz) iii. DBD-PgDBD-Pg( DBD-Pg-1.21.tar.gz) iv. DBD C: > bash bash% tar xvfz DBI-1.32.tar.gz bash% cd DBI-1.32 v. bash% perl Makefile.PL bash% make bash% make test bash% make install vi. DBD-PgDBD

12 IP HOSTS (. mmm2 ) mmm2 localhost mmm1 ldap1 dmz-dir.gpki.go.jp ldap2 iso389.jcsinc.go.jp crca.moj.go.jp ocsp ldap3 repository.secomtrust.net cvs ldap4 HOSTS Windows 2000 C: WINNT system32 drivers etc Windows XP C: WINDOWS system32 drivers etc /etc/profile.d/gpki.sh.bashrc PKITESTROOT PKITESTROOT PKITESTPROGRAM PKITESTDATA PKITESTRESULT Result PKIRHOST PKIREMOTEROOT PKITESTROOT RSH rsh /usr/bin/rsh cygwin PKITESTROOT PKITESTPROGRAM PKITESTDATA Windows ://.../

13 Linux.bashrc my_name export PKITESTROOT=/home/my_name/pki14y export PKITESTPROGRAM=/usr/local/ChallengePKI2002/gpkiverify export PKITESTDATA=$PKITESTROOT/Data export PKITESTRESULT=$PKITESTROOT/Result export PKIRHOST=mmm1 export PKIREMOTEROOT=/home/my_name/pki14y export RSH=/usr/bin/rsh Windows Cygwin.bashrc my_name export PKITESTROOT=c:/cygwin/home/my_name/pki14y export PKITESTPROGRAM=$HOME/pkiic/pkiicver.exe export PKITESTDATA=$PKITESTROOT/Data export PKITESTRESULT=$PKITESTROOT/Result export PKIRHOST=mmm1 export PKIREMOTEROOT=/home/my_name/pki14y export RSH=/usr/bin/rsh my_name # server settings export PKITESTROOT=/home/my_name/pki14y export PKITESTDB=jnsaipa0833 # client settings export PKITESTPROGRAM=/usr/local/ChallengePKI2002/gpkiverify export PKITESTDATA=$PKITESTROOT/Data export PKITESTRESULT=$PKITESTROOT/Result export PKIRHOST=mmm1 export PKIREMOTEROOT=/home/my_name/pki14y export RSH=/usr/bin/rsh

14 PKI ( pki14y tar.gz ) i. $ mv pki14y tar.gz /tmp $ cd /tmp $ tar xvfz pki14y tar.gz $ cd pki14y ii. configure configure --help --prefix= /usr/local/pki14y /usr/local/pki14y --enable-setwwwdoc=apache Apache Web Server /var/www/htdocs /var/www/html /var/www/htdocs /var/www/html --enable-setwwwcgi=apache CGI Apache Web Server CGI /var/www/cgi-bin /var/www/cgi-bin --enable-setaica=aicrpyto AiCrypto /usr/local/aica /usr/local/aica --enable-testdb jnsaipa enable-distdb jnsaipa0833 configure $./configure $./configure --prefix=/usr/local/pki14y --enable-setwwwdoc=/usr/local/apache/htdocs --enable-setwwwcgi=/usr/local/apache/cgi-bin --enable-setaica=/usr/share/aica

15 iii. $ make iv. $ su # make install /usr/local/pki14y my_name $ cd $ cp -r /usr/local/pki14y./pki14y /home/my_name/pki14y PKITESTROOT PKIREMOTEROOT

16 OpenLDAP /usr/local/pki14y/sample.config/usr/local/etc/openldap openldap slapd1.conf slapd2.conf slapd3.conf slapd4.conf schema/ GPKI A-Sign2 for G-ID /usr/local/etc/openldap # cp r /usr/local/pki14y/sample.config/usr/local/etc/openldap/* /usr/local/etc/openldap # chmod 640 /usr/local/etc/openldap/slapd?.conf # chmod 444 /usr/local/etc/openldap/schema/* ldap # mkdir /var/lib/ldap1 /var/lib/ldap2 /var/lib/ldap3 /var/lib/ldap4 # mkdir /var/run/openldap # chown ldap:ldap /var/lib/ldap? # chown ldap:ldap /var/run/openldap # chmod 755 /var/run/openldap ldap /usr/local/pki14y/sample.config/etc/init.d/ldap /etc/rc.d/init.d # cp /usr/local/pki14y/sample.config/etc/init.d/ldap /etc/rc.d/init.d # chmod 755 /etc/rc.d/init.d/ldap # /etc/rc.d/init.d/ldap status slapd /etc/rc.d/init.d/ldap start slapd : [ OK ] ldap chkconfig # /sbin/chkconfig --add ldap

17 OCSP GCVS GPKI CGI apache apache httpd.conf httpd.conf /usr/local/pki14y/sample.config/etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf OCSP GCVS i ServerName 450 ServerName ServerName mmm1 ii. Listen httpd.conf 180 IP IP : Listen :2401 Listen :2402 Listen :2403 Listen :2404 Listen :2405 Listen :2406 Listen :2407 Listen :2408 Listen :2409 iii cgi-bin cgi-bin /var/www/cgi-bin iv. VirtualHost 1232 IP

18 IP <VirtualHost :80> ServerAdmin DocumentRoot /var/www/cgi-bin/ocsp ServerName ocsp <Directory /var/www/cgi-bin/ocsp> AddHandler cgi-script.cgi.confirm Options Indexes FollowSymLinks ExecCGI </Directory> </VirtualHost> <VirtualHost :2401> ServerAdmin DocumentRoot /var/www/cgi-bin/cvs ServerName cvs <Directory /var/www/cgi-bin/cvs> AddHandler cgi-script.cgi Options Indexes FollowSymLinks ExecCGI </Directory> </VirtualHost> <VirtualHost :2402> ServerAdmin DocumentRoot /var/www/cgi-bin/cvs ServerName cvs <Directory /var/www/cgi-bin/cvs> AddHandler cgi-script.cgi Options Indexes FollowSymLinks ExecCGI </Directory> </VirtualHost>... <VirtualHost :2409> ServerAdmin DocumentRoot /var/www/cgi-bin/cvs ServerName cvs <Directory /var/www/cgi-bin/cvs> AddHandler cgi-script.cgi Options Indexes FollowSymLinks ExecCGI </Directory> </VirtualHost> v. httpd.conf # mv /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.orig # cp /usr/local/pki14y/sample.config/etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf OCSP GCVS apache

19 apache # /etc/rc.d/init.d/httpd restart URL OCSP CGI GCVS CGI URL IP (1) Welcome to OCSP responder simulatorocsp (2) URL : : : : : : : : :2409 URL Welcome to CVS Simulator(port xxxx) GCVS xxx

20 root ID # /etc/rc.d/init.d/ldap status slapd (pid )... # ps -wx grep slapd 6224? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd1.conf -h ldap://ldap1 -n slapd1 6229? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd1.conf -h ldap://ldap1 -n slapd1 6230? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd1.conf -h ldap://ldap1 -n slapd1 6231? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd2.conf -h ldap://ldap2 -n slapd2 6236? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd2.conf -h ldap://ldap2 -n slapd2 6237? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd2.conf -h ldap://ldap2 -n slapd2 6238? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd3.conf -h ldap://ldap3 -n slapd3 6243? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd3.conf -h ldap://ldap3 -n slapd3 6244? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd3.conf -h ldap://ldap3 -n slapd3 6245? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd4.conf -h ldap://ldap4 -n slapd4 6247? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd4.conf -h ldap://ldap4 -n slapd4 6248? S 0:00 /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd4.conf -h ldap://ldap4 -n slapd4 LDAP $ cd $PKITESTROOT/bin $./lflush.sh erasing all repositories... ldap_search: No such object Delete Result: No such object (32) ldap_search: No such object Delete Result: No such object (32) ldap_search: No such object Delete Result: No such object (32) ldap_search: No such object Delete Result: No such object (32) ldap_search: No such object Delete Result: No such object (32) contacting to ldap1... ldap_init( ldap1, 0 ) contacting to ldap2... ldap_init( ldap2, 0 ) contacting to ldap3... ldap_init( ldap3, 0 ) contacting to ldap4... ldap_init( ldap4, 0 ) <OK> No such object <OK>

21 ldapsearch GPKI (ldap1) $ ldapsearch -h ldap1 -x -b "c=jp" -LLL "o=*" dn: o=japanese Government,c=JP objectclass: top objectclass: organization o: Japanese Government # refldap://ldap2/o=japan%20certification%20services,c=jp??sub # refldap://ldap3/o=secom%20trust.net%20co.%5c2c%20ltd.,c=jp??sub A-Sign2 (ldap2) $ ldapsearch -h l dap2 -x -b "c=jp" -LLL "o=*" dn: o=japan Certification Services,c=JP objectclass: top objectclass: organization o: Japan Certification Services # refldap://ldap1/o=japanese%20government,c=jp??sub for G-ID (ldap3) $ ldapsearch -h ldap 3 -x -b "c=jp" -LLL "o=*" dn: o=secom Trust.net Co. 2C Ltd.,c=JP objectclass: top objectclass: organization o: SECOM Trust.net Co., Ltd. # refldap://ldap1/o=japanese%20government,c=jp??sub (ldap4) $ ldapsearch -h ldap 4 -x -b "c=jp" -LLL "o=*" dn: o=originaltest,c=jp objectclass: top objectclass: organization o: OriginalTest psql

22 $ su postgres $ psql jnsaipa0833 Welcome to psql, the PostgreSQL interactive terminal. Type: copyright for distribution terms h for help with SQL commands? for help on internal slash commands g or terminate with semicolon to execute query q to quit jnsaipa0833=# d List of relations Name Type Owner cert table postgres cert_path table postgres cert_value table postgres crl table postgres crl_value table postgres keypair table postgres ocsp table postgres ocsp_value table postgres test_case table postgres test_category table postgres test_object table postgres test_result table postgres test_result_detail table postgres (13 rows) postgres =# rsh $ rsh PostgreSQL URL CGI.

PostgreSQLによるデータベースサーバ構築技法

PostgreSQLによるデータベースサーバ構築技法 PostgreSQL PostgreSQL PostgreSQL (UCB) Unix/Linux/Windows LC2002 Copyright(C)2002 Tatsuo Ishii 1 PostgreSQL API C, C++, Java, Perl, Tcl/Tk, PHP, Ruby LC2002 Copyright(C)2002 Tatsuo Ishii 2 PostgreSQL (SQL)