diff --git a/README.md b/README.md index 2ec9336..374ae0f 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,19 @@ # csaf_distribution **WIP**: A prove of concept for a CSAF trusted provider, checker and aggregator. + + +## Setup + +- A recent version of **Go** (1.17+) should be installed. [Go installation](https://go.dev/doc/install) + +- Clone the repository `git clone https://github.com/csaf-poc/csaf_distribution.git ` + +- Build Go components + ``` bash + cd csaf_distribution + go build -v ./cmd/... +``` + +- [Install](http://nginx.org/en/docs/install.html) **nginx** +- To configure nginx see [docs/provider-setup.md](docs/provider-setup.md) diff --git a/docs/provider-setup.md b/docs/provider-setup.md new file mode 100644 index 0000000..da47fca --- /dev/null +++ b/docs/provider-setup.md @@ -0,0 +1,93 @@ +# Setup provider + +The provider is meant to run as an CGI program in an nginx enviroment. + +The following instructions are for an Debian 11 server setup. + +```(shell) +apt-get install nginx fcgiwrap +cp /usr/share/doc/fcgiwrap/examples/nginx.conf /etc/nginx/fcgiwrap.conf +systemctl status fcgiwrap.servic +systemctl status fcgiwrap.socket +systemctl is-enabled fcgiwrap.service +systemctl is-enabled fcgiwrap.socket +``` + +```(shell) +cd /var/www +chgrp -R www-data . +chmod -R g+w . +``` + +Content of `/etc/nginx/fcgiwrap.conf` + +``` +# Include this file on your nginx.conf to support debian cgi-bin scripts using +# fcgiwrap +location /cgi-bin/ { + # Disable gzip (it makes scripts feel slower since they have to complete + # before getting gzipped) + gzip off; + + # Set the root to /usr/lib (inside this location this means that we are + # giving access to the files under /usr/lib/cgi-bin) + root /usr/lib; + + # Fastcgi socket + fastcgi_pass unix:/var/run/fcgiwrap.socket; + + # Fastcgi parameters, include the standard ones + include /etc/nginx/fastcgi_params; + + fastcgi_split_path_info ^(.+\.go)(.*)$; + + # Adjust non standard parameters (SCRIPT_FILENAME) + fastcgi_param SCRIPT_FILENAME /usr/lib$fastcgi_script_name; + + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param CSAF_CONFIG /usr/lib/csaf/config.toml; +} +``` + +Add to `/etc/nginx/sites-enabled/default`: + +``` +server { + + location / { + # Other config + # ... + + # For atomic directory switches + disable_symlinks off; + + # directory listings + autoindex on; + } + + # enable CGI + + include fcgiwrap.conf; +} +``` + +Place the binary under `/usr/lib/cgi-bin/csaf_provider.go`. +Make sure `/usr/lib/cgi-bin/` exists. + +Create configuarion file under `/usr/lib/csaf/config.toml`: + +``` +# upload_signature = true +# key = "/usr/lib/csaf/public.asc" +key = "/usr/lib/csaf/private.asc" +#tlps = ["green", "red"] +domain = "http://192.168.56.102" +#no_passphrase = true +``` + +with suitable replacements. + +Create the folders: +```(shell) +curl http://192.168.56.102/cgi-bin/csaf_provider.go/create +```