3.7. Installing, configuring, and running the Owner server

Procedure

1. Install the required RPMs in this server:

   # dnf install -y fdo-owner-cli fdo-owner-onboarding-server

2. Prepare the owner-onboarding-server.yml configuration file and save it to the /etc/fdo/ directory. Include the path to the certificates you already copied and information about where to publish the Owner server service in this file.

   The following is an example available in /usr/share/doc/fdo/owner-onboarding-server.yml. You can find references to the Service Info API, such as the URL or the authentication token.

   ---
   ownership_voucher_store_driver:
     Directory:
       path: /etc/fdo/stores/owner_vouchers
   session_store_driver:
     Directory:
       path: /etc/fdo/stores/owner_onboarding_sessions
   trusted_device_keys_path: /etc/fdo/keys/device_ca_cert.pem
   owner_private_key_path: /etc/fdo/keys/owner_key.der
   owner_public_key_path: /etc/fdo/keys/owner_cert.pem
   bind: "0.0.0.0:8081"
   service_info_api_url: "http://localhost:8083/device_info"
   service_info_api_authentication:
     BearerToken:
       token: Kpt5P/5flBkaiNSvDYS3cEdBQXJn2Zv9n1D50431/lo=
   owner_addresses:
     - transport: http
       addresses:
         - ip_address: 192.168.122.149

3. Create and configure the Service Info API.

   1. Add the automated information for onboarding, such as user creation, files to be copied or created, commands to be executed, disk to be encrypted, and so on. Use the Service Info API configuration file example in /usr/share/doc/fdo/serviceinfo-api-server.yml as a template to create the configuration file under /etc/fdo/.

      ---
      service_info:
        initial_user:
          username: admin
          sshkeys:
          - "ssh-rsa AAAA...."
        files:
        - path: /root/resolv.conf
          source_path: /etc/resolv.conf
        commands:
        - command: touch
          args:
          - /root/test
          return_stdout: true
          return_stderr: true
        diskencryption_clevis:
        - disk_label: /dev/vda4
          binding:
            pin: tpm2
            config: "{}"
          reencrypt: true
        additional_serviceinfo: ~
      bind: "0.0.0.0:8083"
      device_specific_store_driver:
        Directory:
          path: /etc/fdo/stores/serviceinfo_api_devices
      service_info_auth_token: Kpt5P/5flBkaiNSvDYS3cEdBQXJn2Zv9n1D50431/lo=
      admin_auth_token: zJNoErq7aa0RusJ1w0tkTjdITdMCWYkndzVv7F0V42Q=

4. Check the status of the systemd units:

   # systemctl list-unit-files | grep fdo
   fdo-owner-onboarding-server.service        disabled        disabled
   fdo-serviceinfo-api-server.service         disabled        disabled

   1. If the service is stopped and disabled, enable and start it:

      # systemctl enable --now fdo-owner-onboarding-server.service
      # systemctl enable --now fdo-serviceinfo-api-server.service

      注意

      You must restart the systemd services every time you change the configuration files.

5. Check that the server is listening on the default configured port 8083:

   # ss -ltn

6. Open the port if you have a firewall configured on this server:

   # firewall-cmd --add-port=8081/tcp --permanent
   # firewall-cmd --add-port=8083/tcp --permanent
   # systemctl restart firewalld