keylime_server

Ansible role for configuring and deploying the server components for Keylime Remote Attestation.

Supported Distributions

Requirements

See below

Collection requirements

If you want to manage rpm-ostree systems with this role, you will need to install additional collections. Please run the following command line to install the collection.

ansible-galaxy collection install -vv -r meta/collection-requirements.yml

Role Variables

These are the variables that can be passed to the role. NOTE: Use Ansible Vault to encrypt passwords, keys, and other secrets.

Variable Default/Choices Description
keylime_server_verifier_ip 127.0.0.1 The IP address of the verifier
keylime_server_verifier_port 8881 The port of the verifier
keylime_server_verifier_database_url sqlite / empty string (legacy Keylime) The URL connection for the verifier database. If set to sqlite, it will use the configuration set by the file located at /var/lib/keylime/cv_data.sqlite. See https://keylime.readthedocs.io/en/latest/installation.html#database-support for instructions on using different database configurations. When using When using systems with legacy Keylime, e.g. Fedora 36 and/or Fedora 37, this should be set to an empty string, if one wants to use default sqlite configuration
keylime_server_verifier_tls_dir generate This option defines the directory where the keys and certificates are stored. If set to generate, it will automatically generate a CA, keys and certificates for the client and server in the /var/lib/keylime/cv_ca directory, if they are not yet present. If set as default, the /var/lib/keylime/cv_ca directory is used, and it should contain the files indicated by keylime_server_verifier_server_key, keylime_server_verifier_server_cert, keylime_server_verifier_client_key, keylime_server_verifier_client_cert, keylime_server_verifier_trusted_client_ca and keylime_server_verifier_trusted_server_ca options keylime_server_verifier_server_key
keylime_server_verifier_server_key_passphrase default Set the password used to decrypt the server private key file. If keylime_server_verifier_tls_dir is set to generate, this password will also be used to protect the generated server private key. If left empty, the private key will not be encrypted
keylime_server_verifier_server_cert default The name of the file containing the Keylime verifier server certificate. The file should be stored in the directory set in the keylime_server_verifier_tls_dir option. If set as default, the value server-cert.crt is used
keylime_server_verifier_trusted_client_ca default The list of trusted client CA certificates. The files in the list should be stored in the directory set in the keylime_server_verifier_tls_dir option. If set as default, the value is set as [cacert.crt]
keylime_server_verifier_client_key default The name of the file containing the Keylime verifier client private key. The file should be stored in the directory set in the keylime_server_verifier_tls_dir option. This private key is used by the Keylime verifier to connect to the other services using TLS. If set as default, the client-private.pem value is used
keylime_server_verifier_client_key_passphrase default Set the password used to decrypt the client private key file. If keylime_server_verifier_tls_dir is set to generate, this password will also be used to protect the generated client private key. If left empty, the private key will not be encrypted
keylime_server_verifier_client_cert default The name of the file containing the Keylime verifier client certificate, which should be stored in the directory set in the keylime_server_verifier_tls_dir option. This certificate is used by the Keylime verifier to connect to the other services using TLS. If set as default, the value client-cert.crt value is used
keylime_server_verifier_trusted_server_ca default The list of trusted server CA certificates. The files in the list should be stored in the directory set in the keylime_server_verifier_tls_dir option. If set as default, the value is set as [cacert.crt]
keylime_server_registrar_ip 127.0.0.1 The IP address of the registrar
keylime_server_registrar_port 8891 The port of the registrar
keylime_server_registrar_database_url sqlite / empty string (legacy Keylime) The URL connection for the registrar database. If set to sqlite, it will the configuration set by the file located at /var/lib/keylime/reg_data.sqlite. See https://keylime.readthedocs.io/en/latest/installation.html#database-support for instructions on using different database configurations. When using When using systems with legacy Keylime, e.g. Fedora 36 and/or Fedora 37, this should be set to an empty string, if one wants to use default sqlite configuration
keylime_server_registrar_tls_dir default Similarly to keylime_server_verifier_tls_dir, the keylime_server_registrar_tls_dir option defines the directory where the keys and certificates are stored. If set as generate, it will automatically generate a CA, keys, and certificates for the registrar server in the /var/lib/keylime/reg_ca directory, if they are not yet present. The options keylime_server_registrar_server_key, keylime_server_registrar_server_cert and keylime_server_registrar_trusted_client_ca should all be set to default, when generate is used for the keylime_server_registrar_tls_dir option. If set as default, it shares files with the verifier by using the var/lib/keylime/cv_ca directory, which should contain the files indicated by the keylime_server_registrar_server_key, keylime_server_registrar_server_cert and keylime_server_registrar_trusted_client_ca options
keylime_server_registrar_server_key default The name of the file containing the Keylime registrar server private key, and it should be stored in the directory set in the keylime_server_registrar_tls_dir option. If set as default, the value server-private.pem is used
keylime_server_registrar_server_key_passphrase default This option sets the password used to decrypt the private key file. If keylime_server_registrar_tls_dir is set to generate, this password will also be used to protect the generated server private key. If left empty, the private key will not be encrypted
keylime_server_registrar_server_cert default The name of the file containing the Keylime registrar server certificate, and this file should be stored in the directory specified in the keylime_server_registrar_tls_dir option. If set as default, the value server-cert.crt is used
keylime_server_registrar_trusted_client_ca default The list of trusted client CA certificates. The files in the list should be stored in the directory set in the keylime_server_registrar_tls_dir option. If set as default, the value is set as [cacert.crt]

Example Playbooks

- name: Manage keylime servers
  hosts: all

  vars:
    keylime_server_verifier_ip: "{{ ansible_host }}"
    keylime_server_registrar_ip: "{{ ansible_host }}"

  roles:
    - linux-system-roles.keylime_server

rpm-ostree

See README-ostree.md

License

MIT