Skip to content

Commit b405c40

Browse files
Ray LillbackRay Lillback
authored andcommitted
Merged PR 15909: Update TPM
Latest tpm2tss software requires an additional curl parameter. Updated version to v2.16.0
2 parents 05f93ec + d757431 commit b405c40

3 files changed

Lines changed: 260 additions & 161 deletions

File tree

README.md

Lines changed: 137 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,84 +1,60 @@
11
# C-Agent
2+
![Build Status](https://img.shields.io/badge/build-passing-brightgreen) ![License](https://img.shields.io/badge/license-Apache%20License%202.0-blue)
23

3-
![Build Status](https://img.shields.io/badge/build-passing-brightgreen) ![License](https://img.shields.io/badge/license-MIT-blue)
4-
5-
The **C-Agent** is a reference implementation of a Keyfactor Remote Agent designed for IoT-based solutions. It supports the following build modes:
6-
7-
- **OpenSSL**
8-
- **WolfSSL**
4+
The C-Agent is a reference implementation of a Keyfactor Remote Agent geared toward use in IoT based solutions.
5+
The Keyfactor-CAgent can be built for three (3) different modes:
6+
- **openSSL**
7+
- **wolfSSL**
98
- **Raspberry Pi SPI TPM** (Coming Soon)
10-
119
---
12-
1310
## Table of Contents
1411
1. [Overview](#overview)
1512
2. [OpenSSL Build](#openssl-build)
16-
- [Install Dependencies](#install-dependencies)
17-
- [Clone the Repository](#clone-the-repository)
18-
- [Build the Agent](#build-the-agent)
13+
- [Install Dependencies](#install-dependencies)
14+
- [Clone the Repository](#clone-the-repository)
15+
- [Build the Agent](#build-the-agent)
1916
3. [WolfSSL Build](#wolfssl-build)
20-
- [Install Dependencies](#install-dependencies-1)
21-
- [Build WolfSSL](#build-wolfssl)
22-
- [Build cURL](#build-curl)
23-
- [Build the Agent](#build-the-agent-1)
17+
- [Install Dependencies](#install-dependencies-1)
18+
- [Build WolfSSL](#build-wolfssl)
19+
- [Build cURL](#build-curl)
20+
- [Build the Agent](#build-the-agent-1)
2421
4. [TPM Build (Coming Soon)](#tpm-build-coming-soon)
2522
5. [Common Configuration Steps](#common-configuration-steps)
26-
- [Set Up Directories and Trust Store](#set-up-directories-and-trust-store)
27-
- [Modify Configuration File](#modify-configuration-file)
28-
- [Run the Agent](#run-the-agent)
23+
- [Set Up Directories and Trust Store](#set-up-directories-and-trust-store)
24+
- [Modify Configuration File](#modify-configuration-file)
25+
- [Run the Agent](#run-the-agent)
2926
6. [Appendix](#appendix)
30-
- [Agent Switches](#agent-switches)
31-
- [Complete Configuration File Data](#complete-configuration-file-data)
32-
7. [Troubleshooting](#troubleshooting)
27+
- [Agent Switches](#agent-switches)
28+
- [Complete Configuration File Data](#complete-configuration-file-data)
29+
7. [License](#license)
3330
8. [Contributing](#contributing)
34-
9. [License](#license)
35-
3631
---
32+
## OpenSSL build
33+
## Install the __dependencies__ depending on your Linux distribution:
3734

38-
## Overview
39-
40-
The Keyfactor C-Agent provides secure communication between IoT devices and the Keyfactor Control Platform. This guide walks you through building and configuring the agent for different modes.
35+
#### Debian based (e.g., Poky, Ubuntu, Raspian, Raspberry Pi OS, etc.)
36+
sudo apt update
37+
sudo apt install -y build-essential git libcurl4-gnutls-dev curl libssl-dev
4138

42-
---
39+
#### RHEL based (RHEL, CentOS, Rocky, etc.)
40+
sudo yum update
41+
sudo yum install -y build-essential git curl-devel curl openssl-devel
4342

44-
## OpenSSL Build
43+
## Clone the git repository
44+
cd ~
45+
git clone https://github.com/Keyfactor/Keyfactor-CAgent
4546

46-
### Install Dependencies
47+
## Build the agent against the OpenSSL target (64-bit OSes - not Raspberry Pi)
48+
cd ~/Keyfactor-CAgent
49+
make clean
50+
make opentest -j$(nproc)
4751

48-
#### Debian-based Distributions (e.g., Ubuntu, Raspbian)
49-
```bash
50-
sudo apt update
51-
sudo apt install -y build-essential git libcurl4-gnutls-dev curl libssl-dev
52-
```
52+
## Build the agent against the openSSL target for 32-bit OSes like RaspOS
53+
cd ~/Keyfactor-CAgent
54+
make clean
55+
make openpi -j$(nproc)
5356

54-
#### RHEL-based Distributions (e.g., RHEL, CentOS)
55-
```bash
56-
sudo dnf update -y
57-
sudo dnf groupinstall -y "Development Tools"
58-
sudo dnf install -y curl-devel curl openssl-devel
59-
```
60-
61-
### Clone the Repository
62-
```bash
63-
cd ~
64-
git clone https://github.com/Keyfactor/Keyfactor-CAgent
65-
```
66-
67-
### Build the Agent
68-
69-
#### 64-bit OSes
70-
```bash
71-
cd ~/Keyfactor-CAgent
72-
make clean
73-
make opentest -j$(nproc)
74-
```
75-
76-
#### 32-bit OSes (e.g., Raspberry Pi OS)
77-
```bash
78-
cd ~/Keyfactor-CAgent
79-
make clean
80-
make openpi -j$(nproc)
81-
```
57+
## Configure and run the Agent (see below)
8258

8359
---
8460

@@ -152,7 +128,6 @@ make wolftest -j$(nproc)
152128
This feature is under development. Stay tuned for updates.
153129

154130
---
155-
156131
## Common Configuration Steps
157132

158133
### Set Up Directories and Trust Store
@@ -168,7 +143,33 @@ Copy the PEM-formatted certificate into the `trust.store` file.
168143
cd ~/Keyfactor-CAgent
169144
nano config.json
170145
```
171-
Update the configuration file with your instance details.
146+
#### Add these data lines into the file, replacing the Hostname, Username, and Password entries with the relevant data from your Marketplace instance.
147+
#### Also replace the Agent name and CSR Subject with a unique name to your Marketplace instance.
148+
#### Also note this file is case senstivive!
149+
{
150+
"AgentId": "",
151+
"AgentName": "UniqueName",
152+
"Hostname": "www.yourtestdrive.com",
153+
"Username": "testdrive\\yourusername",
154+
"Password": "yourpassword",
155+
"VirtualDirectory": "KeyfactorAgents",
156+
"TrustStore": "/home/keyfactor/Keyfactor-CAgent/certs/trust.store",
157+
"AgentCert": "/home/keyfactor/Keyfactor-CAgent/certs/Agent-cert.pem",
158+
"AgentKey": "/home/keyfactor/Keyfactor-CAgent/certs/Agent-key.pem",
159+
"CSRKeyType": "ECC",
160+
"CSRKeySize": 256,
161+
"CSRSubject": "CN=UniqueName",
162+
"EnrollOnStartup": true,
163+
"UseSsl": true,
164+
"LogFile": "agent.log"
165+
}
166+
167+
#### The Agent uses a config.json file to provide inputs into the system.
168+
#### For this reference example, we use unencrypted passwords, usernames, and the like.
169+
#### In a full implementation, this data is either secured in trusted element space and/or encrypted and stored as a blob.
170+
#### To allow easier exploration, this is not done here & is implemented depending on physical hardware and business requirements.
171+
172+
---
172173

173174
### Run the Agent
174175
```bash
@@ -178,23 +179,83 @@ cd ~/Keyfactor-CAgent
178179

179180
---
180181

181-
## Appendix
182+
#
183+
# APPENDIX A: Agent switches
182184

183-
### Agent Switches
184-
[List all switches here with examples.]
185+
./agent -l <switch_see_below> enables logging (default is info)
186+
./agent -l t is the greatest detail mode and includes traced curl output
187+
./agent -l d lists all message details other than trace details
188+
./agent -l v lists all verbose and below messages
189+
./agent -l i lists all info, warn, and error messages
190+
./agent -l w lists all warning and error messages
191+
./agent -l e lists only error messages
192+
./agent -l o turns off all output messages
185193

186-
### Complete Configuration File Data
187-
[Include detailed explanations of configuration fields.]
194+
./agent -c <path_and_filename> overrides the default configuration file
188195

189-
---
196+
./agent -h overrides the agent name with $HOSTNAME_$DATETIME
190197

191-
## Troubleshooting
198+
./agent -a adds the client certificate presented for mTLS into a header field named X-ARR-ClientCert
199+
Use this (along with client certificate authentication) in Keyfactor if the platform
200+
is configured to look for this certificate header.
192201

193-
- **Dependency Installation Errors**: Ensure your system package manager is updated.
194-
- **Build Errors**: Verify all dependencies are installed and compatible.
195-
- **Runtime Issues**: Check logs with `-l t` for detailed output.
202+
./agent -e <engine> the crypto engine to use (e.g., tpm2tss) NOTE:
203+
must compile the TPM version of the agent
196204

197-
---
205+
# APPENDIX B: Complete Configuration file data
206+
__AgentID__ : Assigned by Keyfactor Control. Please leave blank.
207+
208+
__AgentName__ : <optional> Leave blank if using the `-h` argument with the agent. This is <required> if not using the `-h` switch.
209+
210+
__ClientParameterPath__ : <optional> Used to pass optional client parameters to the Registration session.
211+
212+
__Hostname__ : <required> Either the IP address or the FQDN of the Keyfactor Control Web Address
213+
214+
__Password__ : <optional> If using basic authentication to the Keyfactor Control Platform, then the password for the user. This can also be omitted if a reverse proxy is injecting authentication credentials into the HTTP header.
215+
216+
__Username__ : <optional> If using basic authentication to the Keyfactor Control Platform, then the domain and username to log into the Keyfactor Control Platform (remember, the \ character must be escaped -- e.g., KEYFACTOR\\Administrator). This can also be omitted if a reverse proxy is injecting authentication credentials into the HTTP header.
217+
218+
__VirtualDirectory__ : <required> Set this to KeyfactorAgents if you are not using a reverse proxy. If you are using a reverse-proxy, set it to the virtual directory that is mapped to KeyfactorAgents.
219+
220+
__TrustStore__ : <required> The location of additional certificates that are trusted by the Agent. This list is appended to the standard CA certificate store located in `/etc/ssl/certs/ca-certificates.crt` for Ubuntu.
221+
222+
__AgentCert__ : <required> The (eventual) location of the Agent's certificate. This is the certificate used by the Agent to call into the platform.
223+
224+
__AgentKey__ : <required> The (eventual) location of the Agent's private key. This is the key used by the Agent to call into the platform.
225+
226+
__AgentKeyPassword__ : <optional> An optional passphrase for decoding the Agent Key. Note, if a TPM, Secure Element, or secure area is used, this **must be defined**.
227+
228+
__CSRKeyType__ : <required> The Key type for the AgentKey (ECC or RSA). This must match the template defined in the Keyfactor Platform.
229+
230+
__CSRKeySize__ : <required> The Key size for the AgentKey. This must be equal to or greater than the minimum size defined in the template.
231+
232+
__CSRSubject__ : <optional> If the `-h` command line switch is used, this field is not used. This field is <required> if the command line switch is not used.
233+
234+
__EnrollOnStartup__ : <required> true = The agent will register itself with the platform. The agent will set this to false once the agent has registered and been approved.
235+
236+
__UseBootstrapCert__ : <optional> true = Use a bootstrap certificate when registering with the platform. false = otherwise.
237+
238+
__BootstrapCert__ : <optional/required> If UseBootstrapCert is true, this is required & is the path/filename for the certificate.
239+
240+
__BootstrapKey__ : <optional/required> If UseBootstrapCert is false, this is required & is the path/filename of the private key for the bootstrap certificate.
241+
242+
__BootstrapKeyPassword__ : <optional> An optional passphrase used to decode the bootstrap key.
243+
244+
__UseSsl__ : <required> true = https:// is used. false = http:// is used. Both refer to the Keyfactor Control Platform communications. Really, this should always be true in a production environment.
245+
246+
__Serialize__ : <optional> true = use a shared network file to grab a serial number/name combination for the AgentName and CN. false = otherwise.Typically this is an nfs file store that is on the production line. Most IoT implementations do not use this method, as UKIDs and names are defined by the host and UKID chips (e.g., [1-wire EEPROM with 64-bit UKID](https://www.microchip.com/wwwproducts/en/AT21CS01) )
247+
248+
__SerialFile__ : <optional> The location of a mounted nfs file store & file to use in the serialization operation.
249+
250+
__LogFile__ : <required> The path/filename of a log file for the agent. **NOTE:** This log file uses the same logging level as the agent. (See command line arguments for the agent)
251+
252+
__httpRetries__ : <required> The number of times the agent will attempt to connect to the Keyfactor Control platform before recording an error. Minimum value is 1.
253+
254+
__retryInterval__ : <required> The time delay (in seconds) between httpRetries.
255+
256+
__LogFileIndex__ : <AgentUseOnly> This is used as an index into the LogFile to allow for a rolling maximum sized log file.
257+
258+
#### __WARNING:__ if the Agent's LogFile is deleted, this **has** to be set to zero (0).
198259

199260
## Contributing
200261

@@ -204,4 +265,4 @@ Contributions are welcome! Submit issues or pull requests on [GitHub](https://gi
204265

205266
## License
206267

207-
This project is licensed under the MIT License. See the `LICENSE` file for details.
268+
This project is licensed under the Apache-2.0 License. See the `README-LICENSE.txt` file for details.

agent.h

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,9 @@ extern struct ScheduledJob* currentJob; /* Defined in schedule.c */
9595
/* 2.14.2.1 = Set up long options & cleaned usage output */
9696
/* 2.14.3.0 = Upgraded for EJBCA DN State Key & openssl v3.0 compatibility */
9797
/* 2.15.0.0 = Minor bug improvements */
98-
/* 2.15.1.0 = Updated for v12 API modifications *//* 2.15.2.0 = Updated DTO for Warning to allow agent rotation */
99-
#define AGENT_VERSION 0x0002000F00020000
98+
/* 2.15.1.0 = Updated for v12 API modifications */
99+
/* 2.15.2.0 = Updated DTO for Warning to allow agent rotation */
100+
/* 2.16.0.0 = Updated TPM for default passkey */
101+
#define AGENT_VERSION 0x0002001000000000
100102

101103
#endif /* AGENT_H_ */

0 commit comments

Comments
 (0)