9.2. Deploying a Tang server

You can use a Tang server to unlock LUKS-encrypted volumes on Clevis-enabled clients automatically. In the minimalist scenario, you deploy a Tang server by installing its package and entering a single command.

Prerequisites

Commands that start with the # command prompt require administrative privileges provided by sudo or root user access. For information on how to configure sudo access, see Enabling unprivileged users to run certain commands.

Procedure

Install the tang package and its dependencies:
```
# dnf install tang
```
Start and enable the tangd service:
```
# systemctl enable tangd.socket --now
```
Because tangd uses the systemd socket activation mechanism, the server starts as soon as the first connection comes in. A new set of cryptographic keys is automatically generated at the first start. To perform cryptographic operations such as manual key generation, use the jose utility as described in the jose(1) man page on your system.

Verification

On your NBDE client, verify that your Tang server works correctly by using the following command. The command must return the identical message you pass for encryption and decryption:
```
# echo test | clevis encrypt tang '{"url":"<tang.server.example.com:80>"}' -y | clevis decrypt
test
```

Next steps

For deployments on a different port than 80, see Deploying a Tang server with SELinux in enforcing mode.

9.2. Deploying a Tang server

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 소개

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 문서 정보

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links