2020.9.6 第一次做業

一、在 CentOS7 中使用 gpg 建立 RSA 非對稱密鑰對

[root@centos7 .gnupg]#gpg --gen-key
# ...
[root@centos7 .gnupg]#gpg -k
/root/.gnupg/pubring.gpg
------------------------
pub   1024R/093CE9ED 2020-09-07
uid                  luuuu <lu@qq.com>
sub   1024R/02464834 2020-09-07

[root@centos7 .gnupg]#gpg -K
/root/.gnupg/secring.gpg
------------------------
sec   1024R/093CE9ED 2020-09-07
uid                  luuuu <lu@qq.com>
ssb   1024R/02464834 2020-09-07

二、將 CentOS7 導出的公鑰，拷貝到 CentOS8 中，在 CentOS8 中使用 CentOS7 的公鑰加密一個文件

# centos 7
[root@centos7 data]#gpg -o luuuu.pubkey --export luuuu
[root@centos7 data]#ll luuuu.pubkey 
-rw-r--r--. 1 root root 657 Sep  7 15:58 luuuu.pubkey
[root@centos7 data]#scp luuuu.pubkey root@10.0.0.8:~/data

# centos 8
[root@centos8 data]$gpg --import luuuu.pubkey
[root@centos8 data]$echo {0..9} > a.log
[root@centos8 data]$gpg -k
/root/.gnupg/pubring.kbx
------------------------
pub   rsa1024 2020-09-07 [SC]
      BB8783FC50D889780A27063B82131A7F093CE9ED
uid           [ unknown] luuuu <lu@qq.com>
sub   rsa1024 2020-09-07 [E]
[root@centos8 data]$gpg -r BB8783FC50D889780A27063B82131A7F093CE9ED -e a.log 
[root@centos8 data]$ll
total 12
-rw-r--r--. 1 root root  20 Sep  7 04:16 a.log
-rw-r--r--. 1 root root 228 Sep  7 04:17 a.log.gpg
-rw-r--r--. 1 root root 657 Sep  7 04:15 luuuu.pubkey

三、回到 CentOS7 服務器，遠程拷貝 file.txt.gpg 文件到本地，使用 CentOS7的私鑰解密文件

[root@centos7 data]#scp root@10.0.0.8:~/data/a.log.gpg ./
[root@centos7 data]#gpg -d a.log.gpg 

You need a passphrase to unlock the secret key for
user: "luuuu <lu@qq.com>"
1024-bit RSA key, ID 02464834, created 2020-09-07 (main key ID 093CE9ED)

gpg: encrypted with 1024-bit RSA key, ID 02464834, created 2020-09-07
      "luuuu <lu@qq.com>"
0 1 2 3 4 5 6 7 8 9

四、在 CentOS7 中使用 openssl 軟件建立 CA

[root@centos7 certs]#echo 01 > /etc/pki/CA/serial
[root@centos7 certs]#umask 066; openssl genrsa -out private/cakey.pem 2048
[root@centos7 certs]#openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 3650 -out /etc/pki/CA/cacert.pem

五、 在 CentOS7 中使用 openssl 軟件建立一個證書申請請求文件，並使用上面的跟證書對其進行簽署

[root@centos7 certs]#umask 066; openssl genrsa -out ~/data/test.key 2048
[root@centos7 certs]#openssl req -new -key ~/data/test.key -out ~/data/test.csr
[root@centos7 certs]#openssl ca -in ~/data/test.csr -out /etc/pki/CA/certs/test.crt -days 100

六、吊銷已經簽署成功的證書

[root@centos7 certs]#openssl x509 -in /etc/pki/CA/certs/test.crt -noout -serial -subject
serial=01
subject= /C=CN/ST=henan/O=Default Company Ltd/CN=ljk.cn/emailAddress=ljk@qq.com
[root@centos7 newcerts]#openssl ca -revoke /etc/pki/CA/newcerts/01.pem 
Using configuration from /etc/pki/tls/openssl.cnf
Revoking Certificate 01.
Data Base Updated
[root@centos7 CA]#echo 01 > /etc/pki/CA/crlnumber
[root@centos7 CA]#openssl ca -gencrl -out /etc/pki/CA/crl.pem