Routinator User Manual
Total Page:16
File Type:pdf, Size:1020Kb
Routinator User Manual NLnet Labs Sep 20, 2021 GETTING STARTED 1 Installation 3 1.1 System Requirements..........................................3 1.2 Quick Start................................................3 1.3 Updating.................................................5 1.4 Installing Specific Versions.......................................6 1.5 Installing From Source..........................................7 1.6 Notes...................................................8 2 Installation Notes 9 2.1 Using Native TLS Instead of Rustls...................................9 2.2 Statically Linked Routinator.......................................9 2.3 Platform Specific Instructions...................................... 10 3 Initialisation 15 3.1 Trust Anchor Locators.......................................... 15 3.2 Performing a Test Run.......................................... 17 4 Data Processing 19 4.1 Fetching................................................. 19 4.2 Validating................................................. 20 4.3 Storing.................................................. 21 5 VRP Output Formats 23 6 Configuration 27 7 Local Exceptions 29 8 Logging 31 8.1 Interactive Mode............................................. 31 8.2 Detached Server Mode.......................................... 31 9 Running Interactively 33 10 Validity Checker 35 10.1 Reading Input From a File........................................ 36 11 Dumping Stored Data 39 12 Running as a Daemon 41 i 13 RTR Service 43 13.1 Secure Transports............................................ 43 14 HTTP Service 47 15 User Interface 49 15.1 Prefix Check............................................... 49 15.2 Reverse Proxy with NGINX....................................... 52 16 API Endpoints 53 17 Monitoring 55 17.1 Metrics.................................................. 55 17.2 Grafana.................................................. 56 18 Manual Page 57 18.1 Description................................................ 57 18.2 Options.................................................. 57 18.3 Commands................................................ 60 18.4 Trust Anchor Locators.......................................... 66 18.5 Configuration File............................................ 66 18.6 HTTP Service.............................................. 69 18.7 Logging.................................................. 70 18.8 Validation................................................. 70 18.9 Relaxed Decoding............................................ 71 18.10 Signals.................................................. 71 18.11 Exit Status................................................ 71 19 JSON Metrics 73 19.1 Publication Metrics............................................ 74 19.2 Rsync Update Metrics.......................................... 75 19.3 RRDP Update Metrics.......................................... 75 19.4 RTR Server Metrics........................................... 76 19.5 HTTP Server Metrics.......................................... 76 20 Prometheus Metrics 77 20.1 Publication Metrics............................................ 77 20.2 Rsync Update Metrics.......................................... 78 20.3 RRDP Update Metrics.......................................... 78 20.4 RTR Server Metrics........................................... 79 20.5 HTTP Server Metrics.......................................... 79 21 Glossary 81 Index 83 ii Routinator User Manual Routinator 3000 is free, open source RPKI (Resource Public Key Infrastructure) Relying Party software written by NLnet Labs in the Rust programming language. The application is designed to be secure and have great portability. It is a lightweight implementation that can run effortlessly on almost any operating system using minimalist hardware. Routinator connects to the Trust Anchors of the five Regional Internet Registries (RIRs) — APNIC, AFRINIC, ARIN, LACNIC and RIPE NCC — downloads all of the certificates and ROAS (Route Origin Attestations) in the various repositories, verifies the signatures and makes the result available for use in your BGP workflow. It is a full featured software package that can perform RPKI validation as a one-time operation and store the result on disk in formats such as CSV and JSON, or run as a service that periodically downloads and verifies RPKI data. Routers can connect to Routinator to fetch verified data via the RPKI-RTR (RPKI-to-Router) protocol. The built-in HTTP server offers a user interface and endpoints for the various file formats, as well as logging, status and Prometheus monitoring. If you run into a problem with Routinator or you have a feature request, please create an issue on Github. We are also happy to accept your pull requests. For general discussion and exchanging operational experiences we provide a mailing list and a Discord server. You can follow the adventures of Routinator on Twitter and listen to its favourite songs on Spotify. Tip: To learn more about Resource Public Key Infrastructure, please refer to the RPKI Community Documentation. GETTING STARTED 1 Routinator User Manual 2 GETTING STARTED CHAPTER ONE INSTALLATION 1.1 System Requirements Routinator has minimal system requirements. When choosing a system, make sure you have 1GB of available memory and 4GB of disk space for the application. This will give you ample margin for the RPKI repositories to grow over time, as adoption increases. A powerful CPU is not required. As new RPKI repositories can emerge in any IP address range and on any domain name, outbound traffic must not be blocked based on IP or DNS in any way. Routinator only needs to establish outbound connections via HTTPS and rsync, on ports 443 and 873, respectively. 1.2 Quick Start New in version 0.9: RPM packages Getting started with Routinator is really easy by either installing a binary package for Debian and Ubuntu or for Red Hat Enterprise Linux and CentOS. You can also run with Docker or build from Cargo, Rust’s build system and package manager. Debian Packages RPM Packages Docker Cargo If you have a machine with an amd64/x86_64 architecture running a recent Debian or Ubuntu distribution, you can install Routinator from our software package repository. To use this repository, add the line below that corresponds to your operating system to your /etc/apt/sources. list or /etc/apt/sources.list.d/: deb [arch=amd64] https://packages.nlnetlabs.nl/linux/debian/ stretch main deb [arch=amd64] https://packages.nlnetlabs.nl/linux/debian/ buster main deb [arch=amd64] https://packages.nlnetlabs.nl/linux/debian/ bullseye main deb [arch=amd64] https://packages.nlnetlabs.nl/linux/ubuntu/ xenial main deb [arch=amd64] https://packages.nlnetlabs.nl/linux/ubuntu/ bionic main deb [arch=amd64] https://packages.nlnetlabs.nl/linux/ubuntu/ focal main Then run the following commands to add the public key and update the repository list: wget -qO- https://packages.nlnetlabs.nl/aptkey.asc | sudo apt-key add - sudo apt update 3 Routinator User Manual You can then install, initialise, enable and start Routinator by running these commands. Note that routinator-init is slightly different than the command used with Cargo: sudo apt install routinator sudo routinator-init # Follow instructions provided sudo systemctl enable --now routinator By default, Routinator will start the RTR server on port 3323 and the HTTP server on port 8323. These, and other values can be changed in the configuration file located in /etc/routinator/routinator.conf. You can check the status of Routinator with: sudo systemctl status routinator You can view the logs with: sudo journalctl --unit=routinator If you have a machine with an amd64/x86_64 architecture running a RHEL (Red Hat Enterprise Linux)/CentOS 7 or 8 distribution, or a compatible OS such as Rocky Linux, you can install Routinator from our software package repository. To use this repository, create a file named /etc/yum.repos.d/nlnetlabs.repo, enter this configuration and save it: [nlnetlabs] name=NLnet Labs baseurl=https://packages.nlnetlabs.nl/linux/centos/$releasever/main/$basearch enabled=1 Then run the following command to add the public key: sudo rpm --import https://packages.nlnetlabs.nl/aptkey.asc You can then install, initialise, enable and start Routinator by running these commands. Note that routinator-init is slightly different than the command used with Cargo: sudo yum install -y routinator sudo routinator-init # Follow instructions provided sudo systemctl enable --now routinator By default, Routinator will start the RTR server on port 3323 and the HTTP server on port 8323. These, and other values can be changed in the configuration file located in /etc/routinator/routinator.conf. You can check the status of Routinator with: sudo systemctl status routinator You can view the logs with: sudo journalctl --unit=routinator Due to the impracticality of complying with the ARIN TAL distribution terms in an unsupervised Docker environment, before launching the container it is necessary to first review and agree to the ARIN Relying Party Agreement (RPA). If you agree to the terms, you can let the Routinator Docker image install the TALs into a mounted volume that is later reused for the server: 4 Chapter 1. Installation Routinator User Manual # Create a Docker volume to persist TALs in sudo docker volume create routinator-tals # Review the ARIN terms. # Run a disposable container to install TALs. sudo docker run --rm -v routinator-tals:/home/routinator/.rpki-cache/tals \ nlnetlabs/routinator init -f --accept-arin-rpa