Cloudflare's RPKI Toolkit
Danger
Cloudflare's RPKI toolkit has been deprecated and should not be used.
Cloudflare created their own RPKI toolkit which, similar to RIPE's, is split into two elements:
- GoRTR is the daemon that implements the RPKI-RTR protocol to distribute validated ROAs to your routers.
- OctoRPKI is the validator which pulls the signed ROAs from the trust anchors and validates them and then makes them available to GoRTR.
NB: Before you proceed further, you should read Cloudflare's own introduction to this toolkit.
We use a standard Ubuntu 20.04 installation (selecting the minimal virtual server option), 2 vCPUs, 2GB RAM, 20GB LVM hard drive.
Cloudflare provide pre-built packages for installation - visit the following URLs and download the appropriate packages for your operating system:
- https://github.com/cloudflare/cfrpki/releases
- https://github.com/cloudflare/gortr/releases
As of late November 2020, the following packages are available to install:
wget https://github.com/cloudflare/cfrpki/releases/download/v1.2.2/octorpki_1.2.2_amd64.deb
wget https://github.com/cloudflare/gortr/releases/download/v0.14.7/gortr_0.14.7_amd64.deb
dpkg -i octorpki_1.2.2_amd64.deb gortr_0.14.7_amd64.deb
OctoRPKI
You now need to install the ARIN file manually:
- Visit https://www.arin.net/resources/rpki/tal.html
- Download the TAL in RFC 7730 format
- Place it in
/usr/share/octorpki/tals/arin.tal
You can now run the validator via the following command:
# start the service:
systemctl start octorpki
# see and tail the logs
journalctl -fu octorpki
# enable to start on server boot:
systemctl enable octorpki.service
NB: OctoRPKI listens as a web service by default on port 8081. It's possible to change this port by adding OCTORPKI_ARGS=-http.addr :8080 to /etc/default/octorpki if required.
As it starts up, there is some info available as JSON under http://[hostname/ip address]:8081/infos and the ROAs can be seen as JSON via http://[hostname/ip address]:8081/output.json after ~5mins.
GoRTR
To start GoRTR (once OctoRPKI is configured and running), we first edit /etc/default/gortr:
GORTR_ARGS=-bind :3323 -verify=false -cache http://localhost:8081/output.json -metrics.addr :8082
You can now run the GoRTR daemon via the following command:
# start the service:
systemctl start gortr
# see and tail the logs
journalctl -fu gortr
# enable to start on server boot:
systemctl enable gortr.service
Once GoRTR starts up, metrics are available from http://[hostname/ip address]:8082/metrics.
Monitoring
We add Nagios http checks for ports 8081 (OctoRPKI) and 8082 (GoRTR) to our monitoring platform. We also add a check_tcp test for GoRTR port 3323.