1"use strict";(globalThis.webpackChunkchaser_web_ui||=[]).push([[8163],{10860(e,i,t){t.r(i),t.d(i,{assets:()=>o,contentTitle:()=>c,default:()=>p,frontMatter:()=>s,metadata:()=>n,toc:()=>d});const n=JSON.parse('{"id":"how-to/tls-upgrade/debian-10","title":"Debian 10 apt HTTPS upgrade","description":"Step-by-step guidance for upgrading legacy TLS clients and servers while filtering outbound traffic with DiscrimiNAT OTF.","source":"@site/docs/how-to/tls-upgrade/debian-10.md","sourceDirName":"how-to/tls-upgrade","slug":"/how-to/tls-upgrade/debian-10","permalink":"/docs/how-to/tls-upgrade/debian-10","draft":false,"unlisted":false,"tags":[],"version":"current","frontMatter":{"title":"Debian 10 apt HTTPS upgrade","description":"Step-by-step guidance for upgrading legacy TLS clients and servers while filtering outbound traffic with DiscrimiNAT OTF.","sidebar_label":"Debian 10","pagination_prev":null,"pagination_next":null},"sidebar":"tutorialSidebar"}');var a=t(74848),r=t(28453);const s={title:"Debian 10 apt HTTPS upgrade",description:"Step-by-step guidance for upgrading legacy TLS clients and servers while filtering outbound traffic with DiscrimiNAT OTF.",sidebar_label:"Debian 10",pagination_prev:null,pagination_next:null},c=void 0,o={},d=[{value:"Virtual Machine",id:"virtual-machine",level:2},{value:"AWS User Data",id:"aws-user-data",level:3},{value:"GCP Startup Script",id:"gcp-startup-script",level:3},{value:"Container",id:"container",level:2},{value:"Dockerfile",id:"dockerfile",level:3},{value:"Allowlist",id:"allowlist",level:2},{value:"FQDNs",id:"fqdns",level:3},{value:"DiscrimiNAT Annotation",id:"discriminat-annotation",level:3}];function l(e){const i={a:"a",code:"code",em:"em",h2:"h2",h3:"h3",p:"p",pre:"pre",...(0,r.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsxs)(i.p,{children:["Upgrading package downloads from HTTP to HTTPS can help with meeting standards such as PCI DSS and NIST SP 800-53. Use of secure transport can also mitigate against future zero-day, remote code vulnerabilities with package managers themselves, such as ",(0,a.jsx)(i.a,{href:"https://security-tracker.debian.org/tracker/CVE-2019-3462",children:"CVE-2019-3462"}),", ",(0,a.jsx)(i.a,{href:"https://security-tracker.debian.org/tracker/CVE-2016-1252",children:"CVE-2016-1252"})," and ",(0,a.jsx)(i.a,{href:"https://security-tracker.debian.org/tracker/CVE-2014-6273",children:"CVE-2014-6273"})," in the past."]}),"\n",(0,a.jsx)(i.p,{children:"This short guide aims to help in upgrading the default repositories' URLs from plaintext to encrypted."}),"\n",(0,a.jsx)(i.h2,{id:"virtual-machine",children:"Virtual Machine"}),"\n",(0,a.jsxs)(i.p,{children:["The commands simply change the URL scheme from ",(0,a.jsx)(i.code,{children:"http"})," to ",(0,a.jsx)(i.code,{children:"https"}),", making a backup file (with extension ",(0,a.jsx)(i.em,{children:".orig"}),") in the process."]}),"\n",(0,a.jsx)(i.h3,{id:"aws-user-data",children:"AWS User Data"}),"\n",(0,a.jsx)(i.pre,{children:(0,a.jsx)(i.code,{className:"language-bash",children:"#!/bin/bash -ex\nsed --in-place=.orig --regexp-extended 's%http://(cdn-aws.)*(deb|security).debian.org%https://\\2.debian.org%g' /etc/apt/sources.list\n"})}),"\n",(0,a.jsx)(i.h3,{id:"gcp-startup-script",children:"GCP Startup Script"}),"\n",(0,a.jsx)(i.pre,{children:(0,a.jsx)(i.code,{className:"language-bash",children:"#!/bin/bash -ex\nsed --in-place=.orig --regexp-extended 's%http://(deb|security).debian.org%https://\\1.debian.org%g' /etc/apt/sources.list\nsed --in-place=.orig --regexp-extended 's%http://packages.cloud.google.com%https://packages.cloud.google.com%g' /etc/apt/sources.list.d/*.list\n"})}),"\n",(0,a.jsx)(i.h2,{id:"container",children:"Container"}),"\n",(0,a.jsx)(i.h3,{id:"dockerfile",children:"Dockerfile"}),"\n",(0,a.jsx)(i.pre,{children:(0,a.jsx)(i.code,{className:"language-Dockerfile",children:"FROM debian:10-slim\n\nRUN echo 'Acquire::https::Verify-Peer \"false\";' > /etc/apt/apt.conf.d/99_tmp_ssl-verify-off.conf && \\\n sed --in-place=.orig --regexp-extended 's%http://(deb|security).debian.org%https://\\1.debian.org%g' /etc/apt/sources.list && \\\n apt-get update && \\\n apt-get install --assume-yes ca-certificates && \\\n rm /etc/apt/apt.conf.d/99_tmp_ssl-verify-off.conf\n"})}),"\n",(0,a.jsxs)(i.p,{children:["These commands first turn off SSL certificate verification because (a) the container build process may be behind ",(0,a.jsx)(i.a,{href:"/discriminat/",children:"DiscrimiNAT"})," already and (b) the CA certificates bundle needs to be downloaded for the verification process to work. ",(0,a.jsx)(i.a,{href:"/discriminat/",children:"DiscrimiNAT"})," independently verifies each connection and will ensure ",(0,a.jsx)(i.em,{children:"apt"})," connected to the CDN specified in spite of not verifying the certificate. The configuration that turned the verification off is removed after the bundle is installed."]}),"\n",(0,a.jsx)(i.h2,{id:"allowlist",children:"Allowlist"}),"\n",(0,a.jsx)(i.h3,{id:"fqdns",children:"FQDNs"}
1),"\n",(0,a.jsx)(i.pre,{children:(0,a.jsx)(i.code,{children:"deb.debian.org,security.debian.org,packages.cloud.google.com\n"})}),"\n",(0,a.jsx)(i.h3,{id:"discriminat-annotation",children:"DiscrimiNAT Annotation"}),"\n",(0,a.jsx)(i.pre,{children:(0,a.jsx)(i.code,{children:"discriminat:tls:deb.debian.org,security.debian.org,packages.cloud.google.com\n"})})]})}function p(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,a.jsx)(i,{...e,children:(0,a.jsx)(l,{...e})}):l(e)}},28453(e,i,t){t.d(i,{R:()=>s,x:()=>c});var n=t(96540);const a={},r=n.createContext(a);function s(e){const i=n.useContext(r);return n.useMemo(function(){return"function"==typeof e?e(i):{...i,...e}},[i,e])}function c(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:s(e.components),n.createElement(r.Provider,{value:i},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.