linux-system-roles / nbde_server Goto Github PK

View Code? Open in Web Editor NEW

11.0 11.0 17.0 271 KB

Ansible role for configuring Network-Bound Disk Encryption servers (e.g. tang)

Home Page: https://linux-system-roles.github.io/nbde_server/

License: MIT License

Python 29.71% Jinja 3.03% JavaScript 6.21% HTML 54.02% Shell 7.03%

nbde_server's People

Contributors

Stargazers

Watchers

Forkers

zelenymartin sergio-correia richm nhosoi pcahyna msgpo i386x jharuda spetrosi global-localhost global19 global19-atlassian-net yuergen aditijadhav38 ukulekek lgtm-migrator

nbde_server's Issues

Conscious Language: Please rename master branch to main branch

As part of the conscious language project, the master branch is to be renamed to the main branch.

Here are the instructions.

Rename the master branch to main: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch
Check this to ensure the default branch has been changed to main: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/changing-the-default-branch - this should keep the github history, as well as updating the default branch configuration and updating any existing PRs

If you use the gh cli (highly recommended) you can use this to check which repos need to be updated:

gh repo list linux-system-roles -L 100 --json name,defaultBranchRef --source | \
  jq --raw-output '.[] | select(.defaultBranchRef.name == "master") | .name'

Thanks.

"Unable to create local directories(/var/db/tang/keys): [Errno 13] Permission denied: b'/var/db/tang'"

The variables I've set

nbde_server_provider: tang
nbde_server_service_state: started
nbde_server_rotate_keys: yes
nbde_server_fetch_keys: yes
nbde_server_deploy_keys: yes
nbde_server_keys_dir: /var/db/tang/keys

Playbook Error

PLAY [setup tang server] *********************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************
ok: [tang1.example.com]

TASK [debug] *********************************************************************************************************************************
ok: [tang1.example.com] => {
    "ansible_user_id": "root"
}

TASK [fedora.linux_system_roles.nbde_server : Set version specific variables] ****************************************************************
ok: [tang1.example.com]

TASK [fedora.linux_system_roles.nbde_server : Include the appropriate provider tasks] ********************************************************
included: /home/user/.ansible/collections/ansible_collections/fedora/linux_system_roles/roles/nbde_server/tasks/main-tang.yml for tang1.example.com

TASK [fedora.linux_system_roles.nbde_server : Ensure tang is installed] **********************************************************************
ok: [tang1.example.com]

TASK [fedora.linux_system_roles.nbde_server : Ensure keys are rotated] ***********************************************************************
changed: [tang1.example.com]

TASK [fedora.linux_system_roles.nbde_server : Ensure we have keys] ***************************************************************************
skipping: [tang1.example.com]

TASK [fedora.linux_system_roles.nbde_server : Perform key management (fetch/deploy) tasks] ***************************************************
included: /home/user/.ansible/collections/ansible_collections/fedora/linux_system_roles/roles/nbde_server/tasks/tang-key-management.yml for tang1.example.com

TASK [fedora.linux_system_roles.nbde_server : Make sure nbde_server_keys_dir is set] *********************************************************
skipping: [tang1.example.com]

TASK [fedora.linux_system_roles.nbde_server : Gather keys to be fetched] *********************************************************************
ok: [tang1.example.com]

TASK [fedora.linux_system_roles.nbde_server : Ensure we fetch the host keys] *****************************************************************
skipping: [tang1.example.com] => (item={'path': '/var/db/tang/.o9ptAL6CUJwXX2Y8wo-L7thFbOA.jwk', 'mode': '0400', 'isdir': False, 'ischr': False, 'isblk': False, 'isreg': True, 'isfifo': False, 'islnk': False, 'issock': False, 'uid': 994, 'gid': 990, 'size': 354, 'inode': 8687704, 'dev': 64768, 'nlink': 1, 'atime': 1620554679.1388829, 'mtime': 1620554597.2631066, 'ctime': 1620554719.4278374, 'gr_name': 'tang', 'pw_name': 'tang', 'wusr': False, 'rusr': True, 'xusr': False, 'wgrp': False, 'rgrp': False, 'xgrp': False, 'woth': False, 'roth': False, 'xoth': False, 'isuid': False, 'isgid': False}) 
skipping: [tang1.example.com] => (item={'path': '/var/db/tang/.bp-9iH0tfHhJq3i68kpirmp5iys.jwk', 'mode': '0400', 'isdir': False, 'ischr': False, 'isblk': False, 'isreg': True, 'isfifo': False, 'islnk': False, 'issock': False, 'uid': 994, 'gid': 990, 'size': 349, 'inode': 8687705, 'dev': 64768, 'nlink': 1, 'atime': 1620554597.2671065, 'mtime': 1620554597.2671065, 'ctime': 1620554719.4278374, 'gr_name': 'tang', 'pw_name': 'tang', 'wusr': False, 'rusr': True, 'xusr': False, 'wgrp': False, 'rgrp': False, 'xgrp': False, 'woth': False, 'roth': False, 'xoth': False, 'isuid': False, 'isgid': False}) 
skipping: [tang1.example.com] => (item={'path': '/var/db/tang/.2QzQXujEjDfy0VnJsVytrsgchRg.jwk', 'mode': '0400', 'isdir': False, 'ischr': False, 'isblk': False, 'isreg': True, 'isfifo': False, 'islnk': False, 'issock': False, 'uid': 994, 'gid': 990, 'size': 354, 'inode': 8687706, 'dev': 64768, 'nlink': 1, 'atime': 1620554678.668895, 'mtime': 1620554678.668895, 'ctime': 1620554719.4278374, 'gr_name': 'tang', 'pw_name': 'tang', 'wusr': False, 'rusr': True, 'xusr': False, 'wgrp': False, 'rgrp': False, 'xgrp': False, 'woth': False, 'roth': False, 'xoth': False, 'isuid': False, 'isgid': False}) 
skipping: [tang1.example.com] => (item={'path': '/var/db/tang/.Uy9c24zPIIDx44KuEiIMT0CxDAs.jwk', 'mode': '0400', 'isdir': False, 'ischr': False, 'isblk': False, 'isreg': True, 'isfifo': False, 'islnk': False, 'issock': False, 'uid': 994, 'gid': 990, 'size': 349, 'inode': 8687707, 'dev': 64768, 'nlink': 1, 'atime': 1620554678.6718948, 'mtime': 1620554678.6718948, 'ctime': 1620554719.4278374, 'gr_name': 'tang', 'pw_name': 'tang', 'wusr': False, 'rusr': True, 'xusr': False, 'wgrp': False, 'rgrp': False, 'xgrp': False, 'woth': False, 'roth': False, 'xoth': False, 'isuid': False, 'isgid': False}) 
skipping: [tang1.example.com] => (item={'path': '/var/db/tang/pOj4xtmDCwqC0pYagg7A3MFArfc.jwk', 'mode': '0400', 'isdir': False, 'ischr': False, 'isblk': False, 'isreg': True, 'isfifo': False, 'islnk': False, 'issock': False, 'uid': 994, 'gid': 990, 'size': 354, 'inode': 8687708, 'dev': 64768, 'nlink': 1, 'atime': 1620554719.4238374, 'mtime': 1620554719.4238374, 'ctime': 1620554719.4278374, 'gr_name': 'tang', 'pw_name': 'tang', 'wusr': False, 'rusr': True, 'xusr': False, 'wgrp': False, 'rgrp': False, 'xgrp': False, 'woth': False, 'roth': False, 'xoth': False, 'isuid': False, 'isgid': False}) 
skipping: [tang1.example.com] => (item={'path': '/var/db/tang/30U1IwWxK5FkXztskFy4RYcVIlw.jwk', 'mode': '0400', 'isdir': False, 'ischr': False, 'isblk': False, 'isreg': True, 'isfifo': False, 'islnk': False, 'issock': False, 'uid': 994, 'gid': 990, 'size': 349, 'inode': 8687709, 'dev': 64768, 'nlink': 1, 'atime': 1620554719.4268374, 'mtime': 1620554719.4268374, 'ctime': 1620554719.4278374, 'gr_name': 'tang', 'pw_name': 'tang', 'wusr': False, 'rusr': True, 'xusr': False, 'wgrp': False, 'rgrp': False, 'xgrp': False, 'woth': False, 'roth': False, 'xoth': False, 'isuid': False, 'isgid': False}) 

TASK [fedora.linux_system_roles.nbde_server : Ensure we fetch the keys for deploying in every host] ******************************************
fatal: [tang1.example.com]: FAILED! => {"msg": "Unable to create local directories(/var/db/tang/keys): [Errno 13] Permission denied: b'/var/db/tang'"}

NO MORE HOSTS LEFT ***************************************************************************************************************************

PLAY RECAP ***********************************************************************************************************************************
tang1.example.com      : ok=20   changed=1    unreachable=0    failed=1    skipped=3    rescued=0    ignored=0

As you can see from the output it is trying to write to the dir but the perm is denied. I'm root on the system so that shouldn't be a problem.

Critical Error in Idempotence Test When Setting Custom Port for Tangd

When configuring a custom port (port 80) for tangd using the playbook at https://github.com/linux-system-roles/nbde_server/blob/main/tasks/tangd-custom-port.yml, a critical error occurs during the idempotence test phase. The error indicates that specific tasks related to managing the tangd custom port and ensuring required services are enabled and at the correct state fail to execute idempotently. This issue was observed during the execution of an Ansible playbook that utilizes the fedora.linux_system_roles.nbde_server and my_tang_wrap roles.

Steps to Reproduce:
Clone the repository containing the nbde_server role.
Configure the playbook to set tangd to listen on port 80.
Create a custom directory /etc/systemd/system/tangd.socket.d.
Inside the /etc/systemd/system/tangd.socket.d directory, create a custom file named maxcon that includes an increase in connections to 1024.
Run the playbook once to apply the configuration.
Run the playbook again to test for idempotence.

Actual Behavior:
The second playbook execution fails the idempotence test with critical errors for the following tasks:

Manage tangd custom port systemd directory (repeatedly listed)
Ensure required services are enabled and at the right state (repeatedly listed)
Create Directory for Telnet Configuration (repeatedly listed)
Configure Maximum Telnet Connections (repeatedly listed)
These errors suggest that the playbook attempts to reapply configurations or settings that should already be in place, indicating a potential issue with how state is checked or managed for these tasks.

Logs:
CRITICAL Idempotence test failed because of the following tasks:

=> fedora.linux_system_roles.nbde_server : Manage tangd custom port systemd directory
=> fedora.linux_system_roles.nbde_server : Manage tangd custom port systemd directory
=> fedora.linux_system_roles.nbde_server : Ensure required services are enabled and at the right state
=> fedora.linux_system_roles.nbde_server : Ensure required services are enabled and at the right state
=> my_tang_wrap: Create Directory for Telnet Configuration
=> my_tang_wrap : Create Directory for Telnet Configuration
=> my_tang_wrap : Configure Maximum Telnet Connections
=> my_tang_wrap : Configure Maximum Telnet Connections

Warning: Value 512 is outside of the allowed entropy range, adjusting it.

When using the role on new servers (Fedora34, Fedora33, Rhel8 (all minimal installs)) the nbde_server roles produces the following error:

Warning: Value 512 is outside of the allowed entropy range, adjusting it.

then the key is wrong and thus NBDE doesn't work

when creating everything manually it works just fine. I guess there is a problem in the library.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.