keylime_server

Ansible role for configuring and deploying the server components for Keylime Remote Attestation.

Supported Distributions

Requirements

See below

Collection requirements

If you want to manage rpm-ostree systems with this role, you will need to install additional collections. Please run the following command line to install the collection.

ansible-galaxy collection install -vv -r meta/collection-requirements.yml

Role Variables

These are the variables that can be passed to the role. NOTE: Use Ansible Vault to encrypt passwords, keys, and other secrets.

Variable Default/Choices Description
keylime_server_verifier_ip 127.0.0.1 The IP address of the verifier
keylime_server_verifier_port 8881 The port of the verifier
keylime_server_verifier_database_url sqlite / empty string (legacy Keylime) The URL connection for the verifier database. If set to sqlite, it will use the configuration set by the file located at /var/lib/keylime/cv_data.sqlite. See https://keylime.readthedocs.io/en/latest/installation.html#database-support for instructions on using different database configurations. When using When using systems with legacy Keylime, e.g. Fedora 36 and/or Fedora 37, this should be set to an empty string, if one wants to use default sqlite configuration
keylime_server_verifier_tls_dir generate This option defines the directory where the keys and certificates are stored. If set to generate, it will automatically generate a CA, keys and certificates for the client and server in the /var/lib/keylime/cv_ca directory, if they are not yet present. If set as default, the /var/lib/keylime/cv_ca directory is used, and it should contain the files indicated by keylime_server_verifier_server_key, keylime_server_verifier_server_cert, keylime_server_verifier_client_key, keylime_server_verifier_client_cert, keylime_server_verifier_trusted_client_ca and keylime_server_verifier_trusted_server_ca options keylime_server_verifier_server_key
keylime_server_verifier_server_key_passphrase default Set the password used to decrypt the server private key file. If keylime_server_verifier_tls_dir is set to generate, this password will also be used to protect the generated server private key. If left empty, the private key will not be encrypted
keylime_server_verifier_server_cert default The name of the file containing the Keylime verifier server certificate. The file should be stored in the directory set in the keylime_server_verifier_tls_dir option. If set as default, the value server-cert.crt is used
keylime_server_verifier_trusted_client_ca default The list of trusted client CA certificates. The files in the list should be stored in the directory set in the keylime_server_verifier_tls_dir option. If set as default, the value is set as [cacert.crt]
keylime_server_verifier_client_key default The name of the file containing the Keylime verifier client private key. The file should be stored in the directory set in the keylime_server_verifier_tls_dir option. This private key is used by the Keylime verifier to connect to the other services using TLS. If set as default, the client-private.pem value is used
keylime_server_verifier_client_key_passphrase default Set the password used to decrypt the client private key file. If keylime_server_verifier_tls_dir is set to generate, this password will also be used to protect the generated client private key. If left empty, the private key will not be encrypted
keylime_server_verifier_client_cert default The name of the file containing the Keylime verifier client certificate, which should be stored in the directory set in the keylime_server_verifier_tls_dir option. This certificate is used by the Keylime verifier to connect to the other services using TLS. If set as default, the value client-cert.crt value is used
keylime_server_verifier_trusted_server_ca default The list of trusted server CA certificates. The files in the list should be stored in the directory set in the keylime_server_verifier_tls_dir option. If set as default, the value is set as [cacert.crt]
keylime_server_registrar_ip 127.0.0.1 The IP address of the registrar
keylime_server_registrar_port 8891 The port of the registrar
keylime_server_registrar_database_url sqlite / empty string (legacy Keylime) The URL connection for the registrar database. If set to sqlite, it will the configuration set by the file located at /var/lib/keylime/reg_data.sqlite. See https://keylime.readthedocs.io/en/latest/installation.html#database-support for instructions on using different database configurations. When using When using systems with legacy Keylime, e.g. Fedora 36 and/or Fedora 37, this should be set to an empty string, if one wants to use default sqlite configuration
keylime_server_registrar_tls_dir default Similarly to keylime_server_verifier_tls_dir, the keylime_server_registrar_tls_dir option defines the directory where the keys and certificates are stored. If set as generate, it will automatically generate a CA, keys, and certificates for the registrar server in the /var/lib/keylime/reg_ca directory, if they are not yet present. The options keylime_server_registrar_server_key, keylime_server_registrar_server_cert and keylime_server_registrar_trusted_client_ca should all be set to default, when generate is used for the keylime_server_registrar_tls_dir option. If set as default, it shares files with the verifier by using the var/lib/keylime/cv_ca directory, which should contain the files indicated by the keylime_server_registrar_server_key, keylime_server_registrar_server_cert and keylime_server_registrar_trusted_client_ca options
keylime_server_registrar_server_key default The name of the file containing the Keylime registrar server private key, and it should be stored in the directory set in the keylime_server_registrar_tls_dir option. If set as default, the value server-private.pem is used
keylime_server_registrar_server_key_passphrase default This option sets the password used to decrypt the private key file. If keylime_server_registrar_tls_dir is set to generate, this password will also be used to protect the generated server private key. If left empty, the private key will not be encrypted
keylime_server_registrar_server_cert default The name of the file containing the Keylime registrar server certificate, and this file should be stored in the directory specified in the keylime_server_registrar_tls_dir option. If set as default, the value server-cert.crt is used
keylime_server_registrar_trusted_client_ca default The list of trusted client CA certificates. The files in the list should be stored in the directory set in the keylime_server_registrar_tls_dir option. If set as default, the value is set as [cacert.crt]
keylime_server_transactional_update_reboot_ok null This variable is used to handle reboots required by transactional updates. If a transactional update requires a reboot, the role will proceed with the reboot if set to true. If set to false, the role will notify the user that a reboot is required, allowing for custom handling of the reboot requirement. If this variable is not set, the role will fail to ensure the reboot requirement is not overlooked. For non-transactional update systems, this variable is ignored.

Example Playbooks

- name: Manage keylime servers
  hosts: all

  vars:
    keylime_server_verifier_ip: "{{ ansible_host }}"
    keylime_server_registrar_ip: "{{ ansible_host }}"

  roles:
    - linux-system-roles.keylime_server

rpm-ostree

See README-ostree.md

License

MIT