Pacman Configuration Security Hardening (paranoid level)

heyom · 2014-09-10 17:07:37

Hello,

Since I'm a paranoid user, I really care a lot about Arch Linux security especially when it comes to its package manager, Pacman.

From pacman.conf file, I'm wondering if [core], [extra] and [community] databases are fully signed or not.

I couldn't find any good sources and I did search a lot by using Google, Youtube to see other's pacman.conf file and even Arch Linux form. None of them provide an ultimate way to harden pacman configurations.

I get error message saying:

error: core: missing required signature
error: extra: missing required signature
error: community: missing required signature

and each of them has the error message:

error: database 'core/extra/community' is not valid (invalid or corrupted database (PGP signature))

Noting that my configuration pacman.conf file like this at [options]:

SigLevel = Required DatabaseRequired TrustedOnly

Is there something wrong with my configuration or is it the databases haven't signed yet?

Thank you in advance and I'm looking forward to hearing from you guys

ewaller · 2014-09-10 17:34:21

Sounds like you have not signed the keys as trusted yet.
https://wiki.archlinux.org/index.php/Pacman-key

heyom · 2014-09-10 17:59:41

ewaller wrote:

Sounds like you have not signed the keys as trusted yet.
https://wiki.archlinux.org/index.php/Pacman-key

I did sign the keys as trusted and the problem is still existed...

Trilby · 2014-09-10 18:04:57

The note in that wiki page is a bit old - but it hasn't been revised yet:

wiki wrote:

Note: Although all official packages are now signed, as of June 2012 signing of the databases is a work in progress. If Required is set then DatabaseOptional should also be set.

So if that wiki page is still correct, database signing has not been completed yet.

EDIT: perhaps that note should be revised either way. If this has been implemented, the note should go. If it hasn't been implemented maybe it should - instead - be called a "work not in progress"

Last edited by Trilby (2014-09-10 18:06:29)

heyom · 2014-09-10 18:51:11

My goal is having ALL my packages that I download/install from either [core], [extra] or [community] databases are signed however I couldn't achieve that .. unless of course not ALL packages are signed...

I'm wondering if there is any better way..

Trilby · 2014-09-10 18:52:03

Packages should all be signed. The databases are not. Your errors are coming from requiring databases be signed to.

heyom · 2014-09-10 18:56:30

No worries about packages. I'm just worrying about the database itself. Noting that I meant that packages signed with signatures.

I would be very appreciated if you could share any methods on maximizing my pacman.conf security

Trilby · 2014-09-10 19:04:51

You lost me. How are these not contradictory:

heyom wrote:

My goal is having ALL my packages ... signed however I couldn't achieve that

heyom wrote:

No worries about packages. I'm just worrying about the database itself.

If the databases are not signed, there is no magic you can do on your end - they just aren't signed. Packages are signed, and you can require that these signatures are valid.

Last edited by Trilby (2014-09-10 19:06:05)

karol · 2014-09-10 19:10:17

What exactly are you worried about?

https://pierre-schmitz.com/trust-the-master-keys/

heyom · 2014-09-10 19:18:07

Trilby wrote:

You lost me. How are these not contradictory:
heyom wrote:
My goal is having ALL my packages ... signed however I couldn't achieve that
heyom wrote:
No worries about packages. I'm just worrying about the database itself.
If the databases are not signed, there is no magic you can do on your end - they just aren't signed. Packages are signed, and you can require that these signatures are valid.

Yeah I'm sorry about that. I'm just lost to the level that I couldn't figure out what is the maximum level of security that pacman can be configured.

As I said at my 1st post, I don't know why I get the errors about databases and I though it can be possible to solve that..

I may have lack of information but I'm still confused on how to configure pacman.conf well enough..

Last edited by heyom (2014-09-10 19:18:27)

heyom · 2014-09-10 19:19:40

karol wrote:

What exactly are you worried about?
https://pierre-schmitz.com/trust-the-master-keys/

I'll check it out.

heyom · 2014-09-10 20:44:13

According to what Allan says:

"We are still in a transition period so not all Developer and Trusted User keys are fully signed yet by the master keys yet, but we are not too far off. In the future we might provide a pacman-keyring package that streamlines this process a bit, or at least will save the individual downloading of each packager’s key.

That just leaves the signing of the databases, but that is a story for another day!"

I guess I have to leave my signing level in [options]:

SigLevel = PackageRequired TrustedOnly

Any better options would be appreciated.

heyom · 2014-09-13 12:56:04

Could someone clarify to me in details this section and provide some examples?

Thank you in advance.

falconindy · 2014-09-13 13:51:34

heyom wrote:

Could someone clarify to me in details this section and provide some examples?

It's poorly worded, and not important for 99% of users. I've clarified that section to mention the word "debugging", which is the only likely reason you'd want to play around with gpg directly.

heyom · 2014-09-13 13:58:35

Any other detailed explanation would be appreciate.

falconindy · 2014-09-13 14:05:07

I'm really not sure what you're expecting. It's an ordinary gpg keyring... pacman-key exists to wrap the common use cases for the keyring. For everything else, there's master^H^H^H^H^H^Hgpg.

Arch Linux

#1 2014-09-10 17:07:37

Pacman Configuration Security Hardening (paranoid level)

#2 2014-09-10 17:34:21

Re: Pacman Configuration Security Hardening (paranoid level)

#3 2014-09-10 17:59:41

Re: Pacman Configuration Security Hardening (paranoid level)

#4 2014-09-10 18:04:57

Re: Pacman Configuration Security Hardening (paranoid level)

#5 2014-09-10 18:51:11

Re: Pacman Configuration Security Hardening (paranoid level)

#6 2014-09-10 18:52:03

Re: Pacman Configuration Security Hardening (paranoid level)

#7 2014-09-10 18:56:30

Re: Pacman Configuration Security Hardening (paranoid level)

#8 2014-09-10 19:04:51

Re: Pacman Configuration Security Hardening (paranoid level)

#9 2014-09-10 19:10:17

Re: Pacman Configuration Security Hardening (paranoid level)

#10 2014-09-10 19:18:07

Re: Pacman Configuration Security Hardening (paranoid level)

#11 2014-09-10 19:19:40

Re: Pacman Configuration Security Hardening (paranoid level)

#12 2014-09-10 20:44:13

Re: Pacman Configuration Security Hardening (paranoid level)

#13 2014-09-13 12:56:04

Re: Pacman Configuration Security Hardening (paranoid level)

#14 2014-09-13 13:51:34

Re: Pacman Configuration Security Hardening (paranoid level)

#15 2014-09-13 13:58:35

Re: Pacman Configuration Security Hardening (paranoid level)

#16 2014-09-13 14:05:07

Re: Pacman Configuration Security Hardening (paranoid level)

Board footer