Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add decryption authorization for clevis clients #92

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add decryption authorization for clevis clients #92

wants to merge 2 commits into from

Commits on Aug 8, 2022

  1. Add decryption authorization 

    The default behaviour of tangd is to reply correctly to all key recovery
requests.  In some deployments it may be needed to control when a key
recovery should be allowed or not.  This patch extends the tangd server
with a very simple authorization method.

When tangd is started with a second argument, this need to point at a
directory to be used for authorizations.  When a key recovery request
occurs, the tangd server will check if this directory contains the
filename of the client key fingerprint (thp/kid).  If a file (which
can be empty) exists with the name of a client fingerprint, the
request is authorized and the decryption can be performed successfully.

Signed-off-by: David Sommerseth <[email protected]>
    @dsommers
    dsommers committed Aug 8, 2022
    Configuration menu
    Copy the full SHA
    4ad7364 View commit details
    Browse the repository at this point in the history

  2. systemd: Make use of a configuration file for tangd args 

    To enable the client authorization directory before this change, the
main systemd service unit file needed to be modified.  This is less
ideal and we can use EnvironmentFile= feature in the unit file to read a
file with environmental variables the [email protected] will use for the
command line.

Signed-off-by: David Sommerseth <[email protected]>
    @dsommers
    dsommers committed Aug 8, 2022
    Configuration menu
    Copy the full SHA
    907ad36 View commit details
    Browse the repository at this point in the history