Detailed approach to sign and install any AIX Licensed Program Product package

IBM AIX uses Licensed Program Products to deliver system updates and software in a standardized format. To maintain security and integrity, packages can be digitally signed and verified before installation. This tutorial provides a concise, step-by-step approach to sign, verify, and install any AIX Licensed Program Product packages, ensuring package authenticity, integrity, and compliance with AIX security standards.

This tutorial highlights the importance of securing AIX installp packages through digital signing and verification. By applying Rivest–Shamir–Adleman (RSA)-based signatures and leveraging AIX’s native installation tools, administrators can ensure package authenticity, integrity, and safe distribution across environments. This strengthens overall system security and builds trust in the software deployment process.

To digitally sign, verify, and install packages, follow this step-by-step process:

1. Create or use an existing installp package.
2. Generate a private/public key pair using the Rivest–Shamir–Adleman (RSA) algorithm.
3. Use the private key to digitally sign an AIX installp package (.bff file).
4. Sign the package and create the signature block.
5. Enable the signature policy.
6. Install the signed package using the installp command.

Stage-wise workflow

To make sure installp packages are verified and trusted, there is a step-by-step process that needs to be followed. The process of signing and installing an installp package involves generating cryptographic keys, creating a digital signature, and enforcing validation policies. This ensures that only authenticated and untampered packages are accepted by the AIX system. The following steps ensure that installp packages are verified and trusted:

Step 1. Create or use an existing installp package

If you already have a package (such as clean.1.0.0.0.bff), you can skip this step. Otherwise, you can follow IBM's official guide to build one. Use the following link to access the guide:

How to build AIX installp packages

Step 2. Generate a private/public key pair using the RSA algorithm

To enable secure signing, generate a 4096-bit RSA key pair using OpenSSL command. This key pair includes a private key and a corresponding public key for signing and verification.

1. Create the private key (4096-bit).

   First, create the private key. This will be used later for signing the installp package.

   mkdir -p /Sign_Script_keys
   cd /Sign_Script_keys
   openssl genrsa -out AIX_PSIRT_privkey_4K 4096
   

   A key size is 4096 (4K). Use 2048 if you want a smaller 2K key.

2. Generate the corresponding public key.

   The next step is to generate a corresponding public key from the private key created earlier. This public key is used to verify the signed installp package.

   openssl rsa -in AIX_PSIRT_privkey_4K -pubout >
   AIX_PSIRT_pubkey_4K
   

Step 3. Use the private key to digitally sign an AIX installp package (.bff file)

To enable automatic signature validation during installation, copy the public key to the system certificate path. The installp command looks for the required key from the system certificate path, which is:

/etc/security/certificates

cp AIX_PSIRT_pubkey_4K
/etc/security/certificates/new_731.pem

The filename new_731.pem should reflect the environment or version. For a 2K key, you can use new_73.pem as the key file name. Note: It is possible to use the same key to sign multiple packages.

Step 4. Sign the package and create the signature block

At this stage, the package is prepared (step 1), the RSA key pair is generated (step 2), and the public key is placed in the required location to enable automatic signature verification. The remaining task is to digitally sign the package and create a signature block.

1. Sign the .bff file using the private key.

   Use the OpenSSL command to sign the package. In this example, the command signs the file clean.1.0.0.0.bff by generating a SHA-512 hash and then applying the private RSA key /Sign_Script_keys/AIX_PSIRT_privkey_4K. The resulting digital signature is saved in sig.out.

   openssl dgst -sha512 -sign
   /Sign_Script_keys/AIX_PSIRT_privkey_4K -out sig.out
   clean.1.0.0.0.bff
   

   • -sha512: Use SHA-512 for 4K keys. Use -sha256 for 2K keys.

   • -out sig.out: Writes the digital signature of the input package named sig.out.

   • clean.1.0.0.0.bff: This is the input installp package file that is being signed.

2. Generate the digital signature block.

   After obtaining the package’s digital signature, combine it with the public key location to generate the final signature block.

   dsblkgen -f LOC sig.out
   /etc/security/certificates/new_731.pem
   clean.1.0.0.0.bff_sb
   

   clean.1.0.0.0.bff_sb: This is the digital signature block file.

3. Append the digital signature block to the .bff package.

   Append the digital signature block to the installp package to create the signed package.

    cat clean.1.0.0.0.bff_sb >> clean.1.0.0.0.bff
   

   This embeds the signature into the package so that installp can detect and validate it automatically.

Step 5. Enable the signature policy

To use signed packages, the signature policy must be enabled in AIX. It supports three levels of enforcement: low, medium, and high. Set the policy as needed.

Example:

chsignpolicy -s high

• Low: Signature checking is optional. If a package is signed, AIX will verify it, but unsigned packages are also allowed.

• Medium: Signature verification is enforced if a package is signed. Unsigned packages can still be installed, but signed ones must pass verification.

• High: Strict enforcement; only signed packages with a valid public key in the system are accepted.

Step 6. Install the signed package using the installp command

At this point, the package is digitally signed and the signature policy is configured on the system. Now you can proceed to install it using installp as usual.

installp -agXYDd . clean.rte

…..

…………………..

+ + /usr/bin/openssl dgst -sha512 -verify
/etc/security/certificates/new_731.pem \

  -signature //admin/tmp/.workdir.../pkg_file.sig \
  //admin/tmp/.workdir.../clean.1.0.0.0.bff

…

+ LANG=C

dsblk_out=Verified OK

+ [[ Verified OK = Verified OK ]]

+ echo dsblkchk:Signature validation is successful for pkg=clean.1.0.0.0.bff

……

…………..

+-----------------------------------------------------------------------------+
                              Summaries:
+-----------------------------------------------------------------------------+
Installation Summary
--------------------
Name                        Level           Part        Event       Result
-----------------------------------------------------------------------------
clean.rte                   1.0.0.0         USR         APPLY       SUCCESS

This confirms that the digital signature is successfully verified using the public key.

Summary

This tutorial outlined how AIX installp packages can be securely signed and verified using RSA keys. It also highlighted the role of digital signatures in ensuring authenticity and integrity and showed how AIX’s native tools support trusted software installation. This method ensures package authenticity, integrity, and compliance with AIX security standards, allowing administrators to confidently distribute and deploy software while maintaining a secure and reliable environment.