The following procedures explain how to add and remove signed packages by using the pkgadd command.
How to Import a Trusted Certificate From the Java Keystore (pkgadm addcert)
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Verify that the root certificate authority (CA) certificate exists in the Java ™ keystore.
#keytool -storepass
storepass
-list -keystore
certfile
Manages a Java keystore (database) of private keys and their associated X.509 certificate chains that authenticate the corresponding public keys. Also manages certificates from trusted entities. For more information on the keytool utility, see keytool-Key and Certificate Management Tool.
storepass
storepass
Specifies the password that protects the integrity of the keystore.
list
By default, prints the MD5 fingerprint of a certificate.
keystore
certfile
Specifies the name and location of the persistent keystore file.
Export the root CA certificate from the Java keystore to a temporary file.
#keytool -export -storepass
storepass
-alias gtecybertrustca -keystore gtecybertrustca -keystore
certfile
-filefilename
export
Exports the trusted certificate.
storepass
storepass
Specifies the password that protects the integrity of the Java keystore.
alias
gtecybertrustca
Identifies the alias of the trusted certificate.
keystore
certfile
Specifies the name and location of the keystore file.
file
filename
Identifies the file to hold the exported certificate.
Import a trusted certificate to the package keystore.
#pkgadm addcert -t -f
format
certfile
t
Indicates that the certificate is a trusted CA certificate. The output includes the details of the certificate, which the user is asked to verify.
f
format
Specifies the format of certificates and private keys. When you import a certificate, it must be encoded using PEM or binary DER format.
certfile
Specifies the file that contains the certificate.
Remove the temporary file.
# rm /tmp/file-name
For more information, see the pkgadm ( 1M ) man page.
Example 20.1. Importing a Trusted Certificate From the Java Keystore
The following example shows how to import a trusted certificate. In this example, Sun's root CA certificate is imported from the Java keystore into the package keystore by using the keytool command.
#keytool -export -storepass changeit -alias gtecybertrustca -keystore gtecybertrustca -keystore /usr/j2se/jre/lib/security/cacerts -file \ /tmp/root.crt
Certificate stored in file </tmp/root.crt> #pkgadm addcert -t -f der /tmp/root.crt
Keystore Alias: GTE CyberTrust Root Common Name: GTE CyberTrust Root Certificate Type: Trusted Certificate Issuer Common Name: GTE CyberTrust Root Validity Dates: <Feb 23 23:01:00 1996 GMT> - <Feb 23 23:59:00 2006 GMT> MD5 Fingerprint: C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58 SHA1 Fingerprint: 90:DE:DE:9E:4C:4E:9F:6F:D8:86:17:57:9D: D3:91:BC:65:A6:89:64 Are you sure you want to trust this certificate? yes Trusting certificate <GTE CyberTrust Root> Type a Keystore protection Password. Press ENTER for no protection password (not recommended): For Verification: Type a Keystore protection Password. Press ENTER for no protection password (not recommended): Certificate(s) from </tmp/root.crt> are now trusted #rm /tmp/root.crt
How to Display Certificate Information (pkgadm listcert)
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Display the contents of the package keystore.
# pkgadm listcert -p passarg
Example 20.2. Displaying Certificate Information
The following example shows how to display the details of a locally stored certificate.
# pkgadm listcert -P pass:test123
Keystore Alias: GTE CyberTrust Root
Common Name: GTE CyberTrust Root
Certificate Type: Trusted Certificate
Issuer Common Name: GTE CyberTrust Root
Validity Dates: <Feb 23 23:01:00 1996 GMT> - <Feb 23 23:59:00 2006 GMT>
MD5 Fingerprint: C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58
SHA1 Fingerprint: 90:DE:DE:9E:4C:4E:9F:6F:D8:86:17:57:9D:D3:91:
BC:65:A6:89:64
How to Remove a Certificate (pkgadm removecert)
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Remove the trusted certificate from the package keystore.
#pkgadm removecert -n "
certfile
"
The removecert
n
“certfile
” option specifies the alias of the user certificate/key pair
or the alias of the trusted certificate.
View the alias names for certificates by using the pkgadm listcert command.
Example 20.3. Removing a Certificate
The following example shows how to remove a certificate.
#pkgadm listcert
Keystore Alias: GTE CyberTrust Root Common Name: GTE CyberTrust Root Certificate Type: Trusted Certificate Issuer Common Name: GTE CyberTrust Root Validity Dates: <Feb 23 23:01:00 1996 GMT> - <Feb 23 23:59:00 2006 GMT> MD5 Fingerprint: C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58 SHA1 Fingerprint: 90:DE:DE:9E:4C:4E:9F:6F:D8:86:17:57:9D:D3:91:BC: 65:A6:89:64 #pkgadm removecert -n "GTE CyberTrust Root"
Enter Keystore Password:storepass
Successfully removed Certificate(s) with alias <GTE CyberTrust Root>
How to Set Up a Proxy Server (pkgadd)
If your system is behind a firewall with a proxy, you will need to set up a proxy server before you can add a package from an HTTP server by using the pkgadd command.
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Select one of the following methods to specify a proxy server.
Specify the proxy server by using the http_proxy
, HTTPPROXY
, or HTTPPROXYPORT
environment variable.
For example:
#setenv http_proxy http:
//mycache.domain:8080
Or, specify one of the following:
#setenv HTTPPROXY
mycache.domain
#setenv HTTPPROXYPORT
8080
Specify the proxy server on the pkgadd command line.
For example:
#pkgadd -x
mycache.domain:8080
-d http:
//myserver.com/pkg
SUNWpkg
Create an administration file that includes proxy server information.
For example:
#cat /tmp/admin
mail= instance=unique partial=ask runlevel=ask idepend=ask rdepend=ask space=ask setuid=ask conflict=ask action=ask networktimeout=60 networkretries=3 authentication=quit keystore=/var/sadm/security basedir=default proxy=mycache.domain:8080
Then, identify the administration file by using the pkgadd
a
command. For example:
#pkgadd -a
/tmp/admin
-d http:
//myserver.com/pkg SUNWpkg
How to Add a Signed Package (pkgadd)
This procedure assumes that you have imported Sun's root CA certificate. For more information, see How to Import a Trusted Certificate From the Java Keystore (pkgadm addcert).
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Add a signed package.
#pkgadd -d
/pathname/device-name
The
d
device-name
option specifies
the device from which the package is installed. The device can be a directory, tape,
diskette, or removable disk. The device can also be a data stream created by the pkgtrans command.
Example 20.4. Adding a Signed Package
The following example shows how to add a signed package that is stored on the system.
# # pkgadd -d /tmp/signed_pppd
The following packages are available:
1 SUNWpppd Solaris PPP Device Drivers
(sparc) 11.10.0,REV=2003.05.08.12.24
Select package(s) you wish to process (or 'all' to process
all packages). (default: all) [?,??,q]: all
Enter keystore password:
## Verifying signature for signer <User Cert 0>
.
.
.
The following example shows how to install a signed package using an HTTP
URL as the device name. The URL must point to a stream-formatted package.
# pkgadd -d http://install/signed-video.pkg
## Downloading...
..............25%..............50%..............75%..............100%
## Download Complete
.
.
.