Red Hat Training

A Red Hat training course is available for Red Hat Satellite

3.2. Digital Signatures for RHN Packages

All packages distributed through RHN should have a digital signature. A digital signature is created with a unique private key and can be verified with the corresponding public key. After creating a package, the SRPM (Source RPM) and the RPM can be digitally signed with a GnuPG key. Before the package is installed, the public key is used to verify the package was signed by a trusted party and the package has not changed since it was signed.

3.2.1. Generating a GnuPG Keypair

A GnuPG keypair consists of the private and public keys. To generate a keypair type the following command as the root user on the shell prompt:
gpg --gen-key
If you execute this command as a non-root user, you see the following message:
gpg: Warning: using insecure memory!

This message appears because non-root users cannot lock memory pages. Since you do not want anyone else to have your private GnuPG key or your passphrase, you want to generate the keypair as root. The root user can lock memory pages, which means the information is never written to disk.
After executing the command to generate a keypair, you see an introductory screen containing key options similar to the following:
	gpg (GnuPG) 1.2.6; Copyright (C) 2004 Free Software
	Foundation, Inc.  This program comes with ABSOLUTELY NO
	WARRANTY. This is free software, and you are welcome to
	redistribute it under certain conditions. See the file COPYING
	for details. Please select what kind of key you want: (1) DSA
	and ElGamal (default) (2) DSA (sign only) (4) RSA (sign only)
	Your selection?

Accept the default option: (1) DSA and ElGamal. This option allows you to create a digital signature and encrypt/decrypt with two types of technologies. Type 1 and then press Enter.
Next, choose the key size, which is how long the key should be. The longer the key, the more resistant against attacks your messages are. Creating a key of at least 1024 bits in size is recommended.
The next option asks you to specify how long you want your key to be valid. If you do choose an expiration date, remember that anyone who is using your public key must also be informed of its expiration and supplied with a new public key. It is recommended that you select no expiration date. If you do not choose an expiration date, you are asked to confirm your decision:
Key does not expire at all Is this correct (y/n)?

Press y to confirm your decision.
Your next task is to provide a User-ID containing your name, your email address, and an optional comment. Each is requested individually. When you are finished, you are presented with a summary of the information you entered.
Once you accept your choices, you enter a passphrase.

Note

Like your account passwords, a good passphrase is essential for optimal security in GnuPG. Mix your passphrase with uppercase and lowercase letters, use numbers, and/or include punctuation marks.
Once you enter and verify your passphrase, your keys are generated. A message similar to the following appears:
We need to generate a lot of random bytes. It is a good idea to perform some
other action (type on the keyboard, move the mouse, utilize the disks) 
during the prime generation; this gives the random number generator a 
better chance to gain enough entropy. 

+++++.+++++.++++++++....++++++++++..+++++.+++++.+++++++.+++++++ +++.
++++++++++++++++++++++++++++++++++++++..........................++++

When the activity on the screen ceases, your new keys are placed in the directory .gnupg in root's home directory. This location is because you are ran the command as root. To list your root keys, use the command:
gpg --list-keys
The output is similar to the following:
/root/.gnupg/pubring.gpg ----------------  pub 1024D/B7085C8A 2002-02-18
 Your Name<you@example.com> 
sub 1024g/E12AF9C4 2002-02-18

To retrieve your public key, use the following command:
gpg --export -a 'Your Name' > public_key.txt

Your public key is written to the file public_key.txt.
This public key is quite important. It's the key that must be deployed to all client systems that receive custom software through up2date. Techniques for deploying this key across an organization are covered in the Red Hat Network Client Configuration Guide.