Linux install apt key

Содержание

Introduction to Apt Authentication
How to Validate a Key
The Web of Trust
External Links
Further Information
How To Install add-apt-key on Ubuntu 22.04
What is add-apt-key
Install add-apt-key Using apt-get
Install add-apt-key Using apt
Install add-apt-key Using aptitude
How To Uninstall add-apt-key on Ubuntu 22.04
Uninstall add-apt-key And Its Dependencies
Remove add-apt-key Configurations and Data
Remove add-apt-key configuration, data, and all of its dependencies
References
Summary
How To Add An APT GPG Key

Introduction to Apt Authentication

Apt-get package management uses public key cryptography to authenticate downloaded packages.

» width=»16″ height=»16″/> Debian does an excellent job of explaining Secure apt on this wiki page.

What follows is a short summary of the key acquisition and verification process gleaned from Debian’s wiki page.

Basic Concepts

Public key cryptography is based on pairs of keys, a public key and a private key. The public key is given out to the world; the private key must be kept a secret. Anyone possessing the public key can encrypt a message so that it can only be read by someone possessing the private key. It’s also possible to use a private key to sign a file, not encrypt it. If a private key is used to sign a file, then anyone who has the public key can check that the file was signed by that key. No one who doesn’t have the private key can forge such a signature.

gpg (GNU Privacy Guard) is the tool used in secure apt to sign files and check their signatures.

apt-key is a program that is used to manage a keyring of gpg keys for secure apt. The keyring is kept in the file ‘/etc/apt/trusted.gpg’ (not to be confused with the related but not very interesting /etc/apt/trustdb.gpg). apt-key can be used to show the keys in the keyring, and to add or remove a key.

Each time you add another apt repository to /etc/apt/sources.list, you’ll also have to give apt its key if you want apt to trust it. Once you have obtained the key, you can validate it by checking the key’s fingerprint and then signing this public key with your private key. You can then add the key to apt’s keyring with apt-key add

How to Find a Key

There is not yet a standard location where you can find the key for a given apt repository. You will most likely find the key on the repository’s web page or as a file in the repository itself.

gpg itself has a standard way to distribute keys, using keyservers that gpg can download a key from and add to its keyring. For example:

joey@dragon:~>gpg --keyserver pgpkeys.mit.edu --recv-key 2D230C5F gpg: requesting key 2D230C5F from hkp server pgpkeys.mit.edu gpg: key 2D230C5F: public key "debian archive automatic signing key (2006) aster@debian.org>" imported gpg: Total number processed: 1 gpg: imported: 1

How to Validate a Key

Once a key is imported it should be validated. GnuPG uses a powerful and flexible trust model that does not require you to personally validate each key you import. Some keys may need to be personally validated, however. A key is validated by verifying the key’s fingerprint and then signing the key to certify it as a valid key. A key’s fingerprint can be quickly viewed with the --fingerprint command-line option, but in order to certify the key you must edit it.

alice% gpg --edit-key blake@cyb.org pub 1024D/9E98BC16 created: 1999-06-04 expires: never trust: -/q sub 1024g/5C8CBD41 created: 1999-06-04 expires: never (1) Blake (Executioner) Command> fpr pub 1024D/9E98BC16 1999-06-04 Blake (Executioner) Fingerprint: 268F 448F CCD7 AF34 183E 52D8 9BDE 1A08 9E98 BC16

A key’s fingerprint is verified with the key’s owner. This may be done in person or over the phone or through any other means as long as you can guarantee that you are communicating with the key’s true owner. If the fingerprint you get is the same as the fingerprint the key’s owner gets, then you can be sure that you have a correct copy of the key.

After checking the fingerprint, you may sign the key to validate it. Since key verification is a weak point in public-key cryptography, you should be extremely careful and always check a key’s fingerprint with the owner before signing the key.

The Web of Trust

How do you verify the authenticity of the key if you don’t know the key’s owner? It’s good to be paranoid in security, but verifying things from here is harder. gpg has the concept of the web of trust, a chain of key signatures that start with someone you trust, who signs someone’s key, who signs some other key, until you get to the key you would like to validate. In other words, if you’re sufficiently concerned you’ll want to check that the repository key is signed by a key that you can trust, with a trust chain that goes back to someone you know personally. If you want to do this, visit an Ubuntu conference or perhaps a local Linux Users Group for a key signing party.

For more, see this blog post about checking the trust path from your personal key to at least one of the keys used to sign the archive/repo key.

Once you have validated and signed the public key, you export that key from your own keyring and feed it to apt-key:

joey@dragon:~>gpg -a --export 2D230C5F | sudo apt-key add - gpg: no ultimately trusted keys found OK

» width=»16″ height=»16″/> The Warning: «no ultimately trusted keys found» means that gpg was not configured to ultimately trust a specific key. Trust settings are part of OpenPGPs Web-of-Trust

Validation of Release File and Packages

Secure apt now verifies the Release file, which is updated each time any of the packages in the archive change. The Release file itself contains, among other things, md5 checksums of other files in the archive. If it cannot download the Release.gpg, or if the signature is bad, it will complain, and will make note that the Packages files that the Release file points to, and all the packages listed therein, are from an untrusted source.

Here’s what that looks like:

W: GPG error: http://ftp.us.debian.org testing Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 010908312D230C5F

If you ignore that warning and try to install a package later, apt will warn again:

WARNING: The following packages cannot be authenticated! libglib-perl libgtk2-perl Install these packages without verification [y/N]?

External Links

Further Information

SecureApt (последним исправлял пользователь BUSCO000DKVB01D 2010-03-12 21:30:49)

The material on this wiki is available under a free license, see Copyright / License for details
You can contribute to this wiki, see Wiki Guide for details

Источник

How To Install add-apt-key on Ubuntu 22.04

In this tutorial we learn how to install add-apt-key on Ubuntu 22.04.

What is add-apt-key

The command add-apt-key provides a convenient command line interface which will add a new GPG key to your APT keyring.

Those who are more graphically inclined may prefer the package gui-apt-key.

There are three ways to install add-apt-key on Ubuntu 22.04. We can use apt-get , apt and aptitude . In the following sections we will describe each method. You can choose one of them.

Install add-apt-key Using apt-get

Update apt database with apt-get using the following command.

After updating apt database, We can install add-apt-key using apt-get by running the following command:

sudo apt-get -y install add-apt-key

Install add-apt-key Using apt

Update apt database with apt using the following command.

After updating apt database, We can install add-apt-key using apt by running the following command:

sudo apt -y install add-apt-key

Install add-apt-key Using aptitude

If you want to follow this method, you might need to install aptitude first since aptitude is usually not installed by default on Ubuntu. Update apt database with aptitude using the following command.

Читайте также: L2tp ipsec linux centos

After updating apt database, We can install add-apt-key using aptitude by running the following command:

sudo aptitude -y install add-apt-key

How To Uninstall add-apt-key on Ubuntu 22.04

To uninstall only the add-apt-key package we can use the following command:

sudo apt-get remove add-apt-key

Uninstall add-apt-key And Its Dependencies

To uninstall add-apt-key and its dependencies that are no longer needed by Ubuntu 22.04, we can use the command below:

sudo apt-get -y autoremove add-apt-key

Remove add-apt-key Configurations and Data

To remove add-apt-key configuration and data from Ubuntu 22.04 we can use the following command:

sudo apt-get -y purge add-apt-key

Remove add-apt-key configuration, data, and all of its dependencies

We can use the following command to remove add-apt-key configurations, data and all of its dependencies, we can use the following command:

sudo apt-get -y autoremove --purge add-apt-key

References

Summary

In this tutorial we learn how to install add-apt-key package on Ubuntu 22.04 using different package management tools: apt, apt-get and aptitude.

Источник

How To Add An APT GPG Key

A common security measure implemented by APT repository maintainers is to sign the packages they distribute. This ensures that the packages you are installing are the authorized and unmodified packages issued by the package maintainers an no one else.

It can be a little confusing how to import the key into APT to install the new package in the first place. Here’s the easy way.

I just had to installed the excellent web log analyzer GoAccesss so I will use it as an example.

The first error was APT telling me that there was no GPG public key on my server for the GoAccess repository:

$ sudo apt update Get:5 http://deb.goaccess.io buster InRelease [2,336 B] Err:5 http://deb.goaccess.io buster InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 97BD1A0133449C3D Reading package lists. Done W: GPG error: http://deb.goaccess.io buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 97BD1A0133449C3D E: The repository 'http://deb.goaccess.io buster InRelease' is not signed. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details.

Your first step here is to find the public key for the repository. A search for “ public key” should get you the link you need. The GoAccess public key URL is https://deb.goaccess.io/gnugpg.key

Once you have the line use the following command to import the key:

Here with the GoAccess key URL:

wget -qO- https://deb.goaccess.io/gnugpg.key | sudo apt-key add -

You can now apt update and apt install the new package.

Источник