From 40cdbf349c04bd7878ea8562309cf5a1a4f76d63 Mon Sep 17 00:00:00 2001 From: max Date: Wed, 30 Sep 2026 18:10:12 +0200 Subject: [PATCH] chore: remove redundant docs and wiki directories; reference Gitea wiki directly --- README.md | 8 +- RELEASE_NOTES.md | 4 +- docs/ADMIN_GUIDE.md | 194 -------------------------------------------- wiki/ADMIN_GUIDE.md | 194 -------------------------------------------- wiki/Admin-Guide.md | 194 -------------------------------------------- 5 files changed, 6 insertions(+), 588 deletions(-) delete mode 100644 docs/ADMIN_GUIDE.md delete mode 100644 wiki/ADMIN_GUIDE.md delete mode 100644 wiki/Admin-Guide.md diff --git a/README.md b/README.md index eb60454..ee91744 100644 --- a/README.md +++ b/README.md @@ -8,11 +8,11 @@ [![Version](https://img.shields.io/badge/version-0.3.5-blue.svg)](RELEASE_NOTES.md) [![Tests](https://img.shields.io/badge/tests-51%20passed-success.svg)](tests/) [![Security](https://img.shields.io/badge/mTLS-TLS%201.3-green.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing) -[![Admin Guide](https://img.shields.io/badge/docs-Admin%20Guide-blueviolet.svg)](docs/ADMIN_GUIDE.md) +[![Admin Guide](https://img.shields.io/badge/wiki-Admin%20Guide-blueviolet.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide) **LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, 12-hour temporal persistence tracking, and direct anomaly pass-throughβ€”delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making. -> πŸ“š **Comprehensive Administrator & Operations Guide**: Complete setup, database switching, ingestion queue tuning, zero-knowledge OpenPGP encryption, security runbooks, and REST API references are available in the **[Admin Guide (docs/ADMIN_GUIDE.md)](docs/ADMIN_GUIDE.md)** and mirrored on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki/ADMIN_GUIDE)**. +> πŸ“š **WebUI Administrator Guide & Technical Wiki**: Complete WebUI console guides, storage switching, ingestion queue tuning, zero-knowledge encryption, and REST API references are available on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and the **[WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)**. --- @@ -175,9 +175,9 @@ python compilation/package_dist.py --target all ## Documentation & Deep Dives -For in-depth operational guides, lifecycle state machines, and PKI specifications, consult the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and local documentation: +For in-depth operational guides, lifecycle state machines, and PKI specifications, consult the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)**: -* [Administrator & Operations Guide](docs/ADMIN_GUIDE.md) (*Mirrored at [Wiki: ADMIN_GUIDE](https://gitea.eibl.tech/me0nline/LOGAR/wiki/ADMIN_GUIDE)*) +* [WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide) * [Architecture & Design Details](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Architecture-and-Design) * [System State Machines & Subsystem Lifecycles](https://gitea.eibl.tech/me0nline/LOGAR/wiki/State-Machines-and-Lifecycles) * [PKI Architecture & Custom X.509 Seat OIDs](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing) diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index a52a5c3..9cbc6f8 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -23,8 +23,8 @@ - **Distraction-Free Tab Navigation**: Cleaned all tab headers to remove redundant item counts and visual badges for a streamlined administrative interface. - **Graceful Feature Locking**: Unlicensed enterprise features remain visible but gracefully disabled in the WebUI and rejected by backend API validation. -### πŸ“– Comprehensive Administrator Guide & Expanded Test Suite -- **Administrator & Operations Guide**: Published comprehensive 11-chapter guide in [`docs/ADMIN_GUIDE.md`](docs/ADMIN_GUIDE.md) and [`wiki/ADMIN_GUIDE.md`](wiki/ADMIN_GUIDE.md) covering deployment, database switching, queue tuning, zero-knowledge crypto, forwarders, Hermes AI, 2FA, and troubleshooting. +### πŸ“– WebUI Administrator Guide & Expanded Test Suite +- **WebUI Administrator Guide**: Published comprehensive WebUI management guide on the [Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide) covering console access, telemetry filtering, seat management, licensing, database switching, queue tuning, zero-knowledge crypto, Hermes AI, and 2FA. - **Automated Unit & Integration Tests**: Expanded test suite to **51 automated tests** covering dynamic licensing, WebUI rendering, opt-in isolation, database failovers, and mTLS pipelines. --- diff --git a/docs/ADMIN_GUIDE.md b/docs/ADMIN_GUIDE.md deleted file mode 100644 index e2ae2c2..0000000 --- a/docs/ADMIN_GUIDE.md +++ /dev/null @@ -1,194 +0,0 @@ -# WebUI Administrator Guide - -Welcome to the **LOGAR WebUI Administrator Guide**. This guide provides step-by-step instructions for managing and operating the LOGAR Server Hub through its graphical web console (`:8443/webui`). - -For deep architectural design, cryptographic protocols, X.509 OID schemas, and full REST API specifications, please refer to the dedicated technical wiki pages: -* **[Architecture & Design](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Architecture-and-Design)** -* **[PKI & Licensing](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing)** -* **[State Machines & Lifecycles](https://gitea.eibl.tech/me0nline/LOGAR/wiki/State-Machines-and-Lifecycles)** -* **[API Reference](https://gitea.eibl.tech/me0nline/LOGAR/wiki/API-Reference)** - ---- - -## Table of Contents - -1. [Accessing the Web Console & Authentication](#1-accessing-the-web-console--authentication) -2. [Dashboard: Live Verified Telemetry](#2-dashboard-live-verified-telemetry) -3. [Fleet Seat Management & Client Provisioning](#3-fleet-seat-management--client-provisioning) -4. [Sub-CA & Modular Licensing](#4-sub-ca--modular-licensing) -5. [Storage Engine & Ingestion Performance](#5-storage-engine--ingestion-performance) -6. [Hermes AI Tokens & Integration](#6-hermes-ai-tokens--integration) -7. [User Account & 2FA Security](#7-user-account--2fa-security) - ---- - -## 1. Accessing the Web Console & Authentication - -The LOGAR Server Hub provides an authenticated web management portal accessible from any modern web browser. - -### URL & Port -* **Management Console URL**: `http://:8443/webui` -* **Protocol**: HTTP (or HTTPS behind an enterprise reverse proxy / load balancer) - -### Default Credentials -Upon first launch, LOGAR initializes default administrative credentials: -* **Username**: `admin` -* **Password**: `admin_logar_2026!` - -> **Security Recommendation**: Change the default credentials immediately after initial deployment using the **User Settings** menu. - ---- - -## 2. Dashboard: Live Verified Telemetry - -**Tab: πŸ“Š Live Telemetry** - -The Live Telemetry view displays real-time anomalous log events aggregated across all enrolled Windows and Linux edge forwarders. - -### Key Controls & Information -* **Severity Filter**: Filter events by `ALL`, `CRITICAL`, `ERROR`, or `WARNING`. -* **Temporal Tracking**: View occurrence frequency (`Runs: N`), first seen timestamp, and relative last seen time (e.g. `2m ago`). -* **Source Attribution**: Inspect originating Hostname, Machine GUID, and Operating System badge (`Windows` / `Linux`). -* **Message Payload**: Inspect the raw extracted log message and normalized signature. -* **Auto-Refresh**: Live stream updates automatically; displays the latest 50 active anomaly frames. - ---- - -## 3. Fleet Seat Management & Client Provisioning - -**Tab: πŸ’» Client Seats** - -Manage connected edge forwarders (`Win_Client` and `Linux_Client`), enforce cryptographic seat quotas, and export client configuration profiles. - -### Seat Quota Overview -* Displays the current seat consumption ratio (e.g., `3 / 25 Seats in Use`). -* Unlicensed servers allow local log collection (`0 / 0 Seats`) while blocking remote mTLS forwarders until a license is imported. - -### Managing Enrolled Forwarders -The client seat table lists every registered forwarder with its Machine Identifier, Hostname, OS Type, IP Address, First Enrolled date, and Status: -* **🟒 Active**: The forwarder has valid mTLS certificates and is actively streaming logs. -* **πŸ”΄ Revoked**: The forwarder's mTLS certificate has been administratively revoked. Ingestion from this client is rejected. -* **Action Buttons**: - * **Revoke**: Temporarily revoke a client's seat and deny incoming connections. - * **Reactivate / Approve**: Re-enable a previously revoked client seat. - * **Delete**: Remove the client record and release the seat back to the available pool. - -### Exporting Client Configuration -Click **πŸ“₯ Download Client Config** to generate and download `client_config.json`. -* Contains the server's connection endpoints (`server_host:9443`), Sub-CA public certificate, encryption fingerprint, and enrollment secret. -* Distribute this file to edge forwarders during deployment for instant zero-touch auto-enrollment. - ---- - -## 4. Sub-CA & Modular Licensing - -**Tab: πŸ“œ Sub-CA & Licensing** - -Manage the server's Subordinate Certificate Authority (Sub-CA), verify hardware host binding, view active licensed capabilities, and apply license updates. - -### Sub-CA Status & Fingerprints -* **CA Subject**: The Distinguished Name (DN) of the local Sub-CA. -* **Server Encryption Fingerprint**: SHA-256 / OpenPGP fingerprint for encrypted payloads. -* **Validity Period**: Issue date and certificate expiration date. -* **Assigned Seat Quota**: Maximum authorized forwarder capacity. - -### ✨ Licensed Capabilities & Feature Modules -This section displays all authorized feature modules: -* **`enterprise_db`**: Multi-engine external database support (PostgreSQL / MySQL / MariaDB), high-throughput ring buffering, and zero-knowledge data encryption at rest. -* *Standard Edition*: If running without an enterprise license, standard local SQLite storage remains active. - -### License Management Operations -* **Export License Request (`.lic`)**: - Click **πŸ“€ Export CSR (.lic)** to download the server's hardware-bound certificate signing request. Send this file to your organization's Master License Authority administrator. -* **Import Signed Sub-CA Certificate**: - Paste the signed PEM certificate received from the Master Authority into the text area and click **πŸ“₯ Import Signed Certificate**. The server reloads its SSLContext and updates seat quotas in-flight with zero downtime. -* **Live WebSocket Sync**: - Click **πŸ”„ Sync with License Hub** to trigger immediate real-time synchronization with `logar.eibl.tech`. - ---- - -## 5. Storage Engine & Ingestion Performance - -**Tab: πŸ—„οΈ Database Engine** - -Configure ingestion buffering, payload encryption at rest, and database backends. - -``` -β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” -β”‚ 1. INGESTION RING BUFFER & BATCH FLUSHER (Top) β”‚ -β”‚ β€’ Mode: Direct (Sync) / In-Memory Ring Buffer β”‚ -β”‚ β€’ Batch Flush Interval (sec) & Batch Size (events) β”‚ -β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ -β”‚ 2. PAYLOAD ENCRYPTION AT REST (Middle) β”‚ -β”‚ β€’ Toggle: OpenPGP / RSA-2048 Payload Encryption β”‚ -β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ -β”‚ 3. STORAGE BACKEND SELECTION (Bottom) β”‚ -β”‚ β€’ Local SQLite (WAL Mode) β”‚ -β”‚ β€’ External SQL Server (PostgreSQL / MySQL / MariaDB) β”‚ -β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ -``` - -### 1. Ingestion Ring Buffer (Top Section) -Tune log ingestion throughput to prevent socket I/O bottlenecks during high-volume spikes: -* **Cache Mode**: - * **Direct (Synchronous)**: Commits incoming log batches immediately to disk. Recommended for small deployments (< 20 nodes). - * **In-Memory Ring Buffer**: Places incoming events into an in-memory queue. A background thread flushes events in atomic batches. Recommended for large fleets (> 50 nodes). -* **Batch Flush Interval**: Time in seconds between automated queue commits (default: `2.0s`). -* **Batch Size**: Maximum events processed per database commit transaction (default: `100`). -* *Note: Ingestion buffering is an explicit opt-in setting and is not auto-enabled.* - -### 2. Payload Encryption at Rest (Middle Section) -* **Encrypt Payloads at Rest**: When enabled, log message payloads (`event_data`) stored in external databases are encrypted using the server's X.509 RSA-2048 / OpenPGP public key. -* **Zero-Knowledge Guarantee**: Database administrators or compromised SQL servers cannot read raw logs without the private key resident on the LOGAR Server Hub. -* *Note: Encryption at rest is an explicit opt-in setting.* - -### 3. Database Backend Selection (Bottom Section) -Switch between local file storage and external SQL servers: -* **Local SQLite (WAL Mode)**: - * Default, zero-configuration embedded database located at `logar_state.db`. - * Operates with Write-Ahead Logging (WAL) for high concurrency. -* **External SQL Server (PostgreSQL / MySQL / MariaDB)**: - * Select your database dialect (**PostgreSQL** or **MySQL / MariaDB**). - * Enter **Host**, **Port**, **Database Name**, **Username**, and **Password**. - * Click **πŸ’Ύ Save & Apply Storage Configuration**. - * The server tests connectivity, initializes required tables and indices, and migrates operational state seamlessly. -* *Licensing Note: External SQL backend options require the `enterprise_db` licensed capability. If unlicensed, these controls are visible but gracefully disabled.* - ---- - -## 6. Hermes AI Tokens & Integration - -**Tab: πŸ€– Hermes AI** - -Provision dedicated access tokens for Hermes AI agents to ingest anomalous telemetry. - -### Managing Access Tokens -* **Create Token**: Enter an agent name (e.g. `Hermes-Production-Cluster`) and click **βž• Generate Token**. -* **Token Attributes**: View Token Name, Creation Date, Last Used Timestamp, and Status (`Active` / `Revoked`). -* **Revoke / Delete**: Instantly revoke access for compromised tokens or permanently delete retired tokens. - -### Connecting Hermes AI -Configure Hermes AI agents to query the structured anomaly stream: -```http -GET http://:8443/api/hermes/report -Authorization: Bearer hermes_live_xxxxxxxxxxxxxxxx -``` -* Or via query parameter: `http://:8443/api/hermes/report?token=hermes_live_xxxxxxxxxxxxxxxx` - ---- - -## 7. User Account & 2FA Security - -**Menu: βš™οΈ User Settings** - -### Changing Administrative Credentials -1. Click the **Admin Profile** icon in the navigation bar. -2. Enter a new Username and Password. -3. Click **Update Account**. - -### Two-Factor Authentication (TOTP 2FA) -Enhance login security with RFC 6238 Time-Based One-Time Passwords: -1. Click **πŸ”’ Setup Two-Factor Authentication**. -2. Scan the displayed QR Code using your preferred authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, etc.). -3. Enter the 6-digit verification code from your authenticator app to confirm activation. -4. Subsequent logins will require your password followed by the 6-digit TOTP code. diff --git a/wiki/ADMIN_GUIDE.md b/wiki/ADMIN_GUIDE.md deleted file mode 100644 index e2ae2c2..0000000 --- a/wiki/ADMIN_GUIDE.md +++ /dev/null @@ -1,194 +0,0 @@ -# WebUI Administrator Guide - -Welcome to the **LOGAR WebUI Administrator Guide**. This guide provides step-by-step instructions for managing and operating the LOGAR Server Hub through its graphical web console (`:8443/webui`). - -For deep architectural design, cryptographic protocols, X.509 OID schemas, and full REST API specifications, please refer to the dedicated technical wiki pages: -* **[Architecture & Design](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Architecture-and-Design)** -* **[PKI & Licensing](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing)** -* **[State Machines & Lifecycles](https://gitea.eibl.tech/me0nline/LOGAR/wiki/State-Machines-and-Lifecycles)** -* **[API Reference](https://gitea.eibl.tech/me0nline/LOGAR/wiki/API-Reference)** - ---- - -## Table of Contents - -1. [Accessing the Web Console & Authentication](#1-accessing-the-web-console--authentication) -2. [Dashboard: Live Verified Telemetry](#2-dashboard-live-verified-telemetry) -3. [Fleet Seat Management & Client Provisioning](#3-fleet-seat-management--client-provisioning) -4. [Sub-CA & Modular Licensing](#4-sub-ca--modular-licensing) -5. [Storage Engine & Ingestion Performance](#5-storage-engine--ingestion-performance) -6. [Hermes AI Tokens & Integration](#6-hermes-ai-tokens--integration) -7. [User Account & 2FA Security](#7-user-account--2fa-security) - ---- - -## 1. Accessing the Web Console & Authentication - -The LOGAR Server Hub provides an authenticated web management portal accessible from any modern web browser. - -### URL & Port -* **Management Console URL**: `http://:8443/webui` -* **Protocol**: HTTP (or HTTPS behind an enterprise reverse proxy / load balancer) - -### Default Credentials -Upon first launch, LOGAR initializes default administrative credentials: -* **Username**: `admin` -* **Password**: `admin_logar_2026!` - -> **Security Recommendation**: Change the default credentials immediately after initial deployment using the **User Settings** menu. - ---- - -## 2. Dashboard: Live Verified Telemetry - -**Tab: πŸ“Š Live Telemetry** - -The Live Telemetry view displays real-time anomalous log events aggregated across all enrolled Windows and Linux edge forwarders. - -### Key Controls & Information -* **Severity Filter**: Filter events by `ALL`, `CRITICAL`, `ERROR`, or `WARNING`. -* **Temporal Tracking**: View occurrence frequency (`Runs: N`), first seen timestamp, and relative last seen time (e.g. `2m ago`). -* **Source Attribution**: Inspect originating Hostname, Machine GUID, and Operating System badge (`Windows` / `Linux`). -* **Message Payload**: Inspect the raw extracted log message and normalized signature. -* **Auto-Refresh**: Live stream updates automatically; displays the latest 50 active anomaly frames. - ---- - -## 3. Fleet Seat Management & Client Provisioning - -**Tab: πŸ’» Client Seats** - -Manage connected edge forwarders (`Win_Client` and `Linux_Client`), enforce cryptographic seat quotas, and export client configuration profiles. - -### Seat Quota Overview -* Displays the current seat consumption ratio (e.g., `3 / 25 Seats in Use`). -* Unlicensed servers allow local log collection (`0 / 0 Seats`) while blocking remote mTLS forwarders until a license is imported. - -### Managing Enrolled Forwarders -The client seat table lists every registered forwarder with its Machine Identifier, Hostname, OS Type, IP Address, First Enrolled date, and Status: -* **🟒 Active**: The forwarder has valid mTLS certificates and is actively streaming logs. -* **πŸ”΄ Revoked**: The forwarder's mTLS certificate has been administratively revoked. Ingestion from this client is rejected. -* **Action Buttons**: - * **Revoke**: Temporarily revoke a client's seat and deny incoming connections. - * **Reactivate / Approve**: Re-enable a previously revoked client seat. - * **Delete**: Remove the client record and release the seat back to the available pool. - -### Exporting Client Configuration -Click **πŸ“₯ Download Client Config** to generate and download `client_config.json`. -* Contains the server's connection endpoints (`server_host:9443`), Sub-CA public certificate, encryption fingerprint, and enrollment secret. -* Distribute this file to edge forwarders during deployment for instant zero-touch auto-enrollment. - ---- - -## 4. Sub-CA & Modular Licensing - -**Tab: πŸ“œ Sub-CA & Licensing** - -Manage the server's Subordinate Certificate Authority (Sub-CA), verify hardware host binding, view active licensed capabilities, and apply license updates. - -### Sub-CA Status & Fingerprints -* **CA Subject**: The Distinguished Name (DN) of the local Sub-CA. -* **Server Encryption Fingerprint**: SHA-256 / OpenPGP fingerprint for encrypted payloads. -* **Validity Period**: Issue date and certificate expiration date. -* **Assigned Seat Quota**: Maximum authorized forwarder capacity. - -### ✨ Licensed Capabilities & Feature Modules -This section displays all authorized feature modules: -* **`enterprise_db`**: Multi-engine external database support (PostgreSQL / MySQL / MariaDB), high-throughput ring buffering, and zero-knowledge data encryption at rest. -* *Standard Edition*: If running without an enterprise license, standard local SQLite storage remains active. - -### License Management Operations -* **Export License Request (`.lic`)**: - Click **πŸ“€ Export CSR (.lic)** to download the server's hardware-bound certificate signing request. Send this file to your organization's Master License Authority administrator. -* **Import Signed Sub-CA Certificate**: - Paste the signed PEM certificate received from the Master Authority into the text area and click **πŸ“₯ Import Signed Certificate**. The server reloads its SSLContext and updates seat quotas in-flight with zero downtime. -* **Live WebSocket Sync**: - Click **πŸ”„ Sync with License Hub** to trigger immediate real-time synchronization with `logar.eibl.tech`. - ---- - -## 5. Storage Engine & Ingestion Performance - -**Tab: πŸ—„οΈ Database Engine** - -Configure ingestion buffering, payload encryption at rest, and database backends. - -``` -β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” -β”‚ 1. INGESTION RING BUFFER & BATCH FLUSHER (Top) β”‚ -β”‚ β€’ Mode: Direct (Sync) / In-Memory Ring Buffer β”‚ -β”‚ β€’ Batch Flush Interval (sec) & Batch Size (events) β”‚ -β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ -β”‚ 2. PAYLOAD ENCRYPTION AT REST (Middle) β”‚ -β”‚ β€’ Toggle: OpenPGP / RSA-2048 Payload Encryption β”‚ -β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ -β”‚ 3. STORAGE BACKEND SELECTION (Bottom) β”‚ -β”‚ β€’ Local SQLite (WAL Mode) β”‚ -β”‚ β€’ External SQL Server (PostgreSQL / MySQL / MariaDB) β”‚ -β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ -``` - -### 1. Ingestion Ring Buffer (Top Section) -Tune log ingestion throughput to prevent socket I/O bottlenecks during high-volume spikes: -* **Cache Mode**: - * **Direct (Synchronous)**: Commits incoming log batches immediately to disk. Recommended for small deployments (< 20 nodes). - * **In-Memory Ring Buffer**: Places incoming events into an in-memory queue. A background thread flushes events in atomic batches. Recommended for large fleets (> 50 nodes). -* **Batch Flush Interval**: Time in seconds between automated queue commits (default: `2.0s`). -* **Batch Size**: Maximum events processed per database commit transaction (default: `100`). -* *Note: Ingestion buffering is an explicit opt-in setting and is not auto-enabled.* - -### 2. Payload Encryption at Rest (Middle Section) -* **Encrypt Payloads at Rest**: When enabled, log message payloads (`event_data`) stored in external databases are encrypted using the server's X.509 RSA-2048 / OpenPGP public key. -* **Zero-Knowledge Guarantee**: Database administrators or compromised SQL servers cannot read raw logs without the private key resident on the LOGAR Server Hub. -* *Note: Encryption at rest is an explicit opt-in setting.* - -### 3. Database Backend Selection (Bottom Section) -Switch between local file storage and external SQL servers: -* **Local SQLite (WAL Mode)**: - * Default, zero-configuration embedded database located at `logar_state.db`. - * Operates with Write-Ahead Logging (WAL) for high concurrency. -* **External SQL Server (PostgreSQL / MySQL / MariaDB)**: - * Select your database dialect (**PostgreSQL** or **MySQL / MariaDB**). - * Enter **Host**, **Port**, **Database Name**, **Username**, and **Password**. - * Click **πŸ’Ύ Save & Apply Storage Configuration**. - * The server tests connectivity, initializes required tables and indices, and migrates operational state seamlessly. -* *Licensing Note: External SQL backend options require the `enterprise_db` licensed capability. If unlicensed, these controls are visible but gracefully disabled.* - ---- - -## 6. Hermes AI Tokens & Integration - -**Tab: πŸ€– Hermes AI** - -Provision dedicated access tokens for Hermes AI agents to ingest anomalous telemetry. - -### Managing Access Tokens -* **Create Token**: Enter an agent name (e.g. `Hermes-Production-Cluster`) and click **βž• Generate Token**. -* **Token Attributes**: View Token Name, Creation Date, Last Used Timestamp, and Status (`Active` / `Revoked`). -* **Revoke / Delete**: Instantly revoke access for compromised tokens or permanently delete retired tokens. - -### Connecting Hermes AI -Configure Hermes AI agents to query the structured anomaly stream: -```http -GET http://:8443/api/hermes/report -Authorization: Bearer hermes_live_xxxxxxxxxxxxxxxx -``` -* Or via query parameter: `http://:8443/api/hermes/report?token=hermes_live_xxxxxxxxxxxxxxxx` - ---- - -## 7. User Account & 2FA Security - -**Menu: βš™οΈ User Settings** - -### Changing Administrative Credentials -1. Click the **Admin Profile** icon in the navigation bar. -2. Enter a new Username and Password. -3. Click **Update Account**. - -### Two-Factor Authentication (TOTP 2FA) -Enhance login security with RFC 6238 Time-Based One-Time Passwords: -1. Click **πŸ”’ Setup Two-Factor Authentication**. -2. Scan the displayed QR Code using your preferred authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, etc.). -3. Enter the 6-digit verification code from your authenticator app to confirm activation. -4. Subsequent logins will require your password followed by the 6-digit TOTP code. diff --git a/wiki/Admin-Guide.md b/wiki/Admin-Guide.md deleted file mode 100644 index e2ae2c2..0000000 --- a/wiki/Admin-Guide.md +++ /dev/null @@ -1,194 +0,0 @@ -# WebUI Administrator Guide - -Welcome to the **LOGAR WebUI Administrator Guide**. This guide provides step-by-step instructions for managing and operating the LOGAR Server Hub through its graphical web console (`:8443/webui`). - -For deep architectural design, cryptographic protocols, X.509 OID schemas, and full REST API specifications, please refer to the dedicated technical wiki pages: -* **[Architecture & Design](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Architecture-and-Design)** -* **[PKI & Licensing](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing)** -* **[State Machines & Lifecycles](https://gitea.eibl.tech/me0nline/LOGAR/wiki/State-Machines-and-Lifecycles)** -* **[API Reference](https://gitea.eibl.tech/me0nline/LOGAR/wiki/API-Reference)** - ---- - -## Table of Contents - -1. [Accessing the Web Console & Authentication](#1-accessing-the-web-console--authentication) -2. [Dashboard: Live Verified Telemetry](#2-dashboard-live-verified-telemetry) -3. [Fleet Seat Management & Client Provisioning](#3-fleet-seat-management--client-provisioning) -4. [Sub-CA & Modular Licensing](#4-sub-ca--modular-licensing) -5. [Storage Engine & Ingestion Performance](#5-storage-engine--ingestion-performance) -6. [Hermes AI Tokens & Integration](#6-hermes-ai-tokens--integration) -7. [User Account & 2FA Security](#7-user-account--2fa-security) - ---- - -## 1. Accessing the Web Console & Authentication - -The LOGAR Server Hub provides an authenticated web management portal accessible from any modern web browser. - -### URL & Port -* **Management Console URL**: `http://:8443/webui` -* **Protocol**: HTTP (or HTTPS behind an enterprise reverse proxy / load balancer) - -### Default Credentials -Upon first launch, LOGAR initializes default administrative credentials: -* **Username**: `admin` -* **Password**: `admin_logar_2026!` - -> **Security Recommendation**: Change the default credentials immediately after initial deployment using the **User Settings** menu. - ---- - -## 2. Dashboard: Live Verified Telemetry - -**Tab: πŸ“Š Live Telemetry** - -The Live Telemetry view displays real-time anomalous log events aggregated across all enrolled Windows and Linux edge forwarders. - -### Key Controls & Information -* **Severity Filter**: Filter events by `ALL`, `CRITICAL`, `ERROR`, or `WARNING`. -* **Temporal Tracking**: View occurrence frequency (`Runs: N`), first seen timestamp, and relative last seen time (e.g. `2m ago`). -* **Source Attribution**: Inspect originating Hostname, Machine GUID, and Operating System badge (`Windows` / `Linux`). -* **Message Payload**: Inspect the raw extracted log message and normalized signature. -* **Auto-Refresh**: Live stream updates automatically; displays the latest 50 active anomaly frames. - ---- - -## 3. Fleet Seat Management & Client Provisioning - -**Tab: πŸ’» Client Seats** - -Manage connected edge forwarders (`Win_Client` and `Linux_Client`), enforce cryptographic seat quotas, and export client configuration profiles. - -### Seat Quota Overview -* Displays the current seat consumption ratio (e.g., `3 / 25 Seats in Use`). -* Unlicensed servers allow local log collection (`0 / 0 Seats`) while blocking remote mTLS forwarders until a license is imported. - -### Managing Enrolled Forwarders -The client seat table lists every registered forwarder with its Machine Identifier, Hostname, OS Type, IP Address, First Enrolled date, and Status: -* **🟒 Active**: The forwarder has valid mTLS certificates and is actively streaming logs. -* **πŸ”΄ Revoked**: The forwarder's mTLS certificate has been administratively revoked. Ingestion from this client is rejected. -* **Action Buttons**: - * **Revoke**: Temporarily revoke a client's seat and deny incoming connections. - * **Reactivate / Approve**: Re-enable a previously revoked client seat. - * **Delete**: Remove the client record and release the seat back to the available pool. - -### Exporting Client Configuration -Click **πŸ“₯ Download Client Config** to generate and download `client_config.json`. -* Contains the server's connection endpoints (`server_host:9443`), Sub-CA public certificate, encryption fingerprint, and enrollment secret. -* Distribute this file to edge forwarders during deployment for instant zero-touch auto-enrollment. - ---- - -## 4. Sub-CA & Modular Licensing - -**Tab: πŸ“œ Sub-CA & Licensing** - -Manage the server's Subordinate Certificate Authority (Sub-CA), verify hardware host binding, view active licensed capabilities, and apply license updates. - -### Sub-CA Status & Fingerprints -* **CA Subject**: The Distinguished Name (DN) of the local Sub-CA. -* **Server Encryption Fingerprint**: SHA-256 / OpenPGP fingerprint for encrypted payloads. -* **Validity Period**: Issue date and certificate expiration date. -* **Assigned Seat Quota**: Maximum authorized forwarder capacity. - -### ✨ Licensed Capabilities & Feature Modules -This section displays all authorized feature modules: -* **`enterprise_db`**: Multi-engine external database support (PostgreSQL / MySQL / MariaDB), high-throughput ring buffering, and zero-knowledge data encryption at rest. -* *Standard Edition*: If running without an enterprise license, standard local SQLite storage remains active. - -### License Management Operations -* **Export License Request (`.lic`)**: - Click **πŸ“€ Export CSR (.lic)** to download the server's hardware-bound certificate signing request. Send this file to your organization's Master License Authority administrator. -* **Import Signed Sub-CA Certificate**: - Paste the signed PEM certificate received from the Master Authority into the text area and click **πŸ“₯ Import Signed Certificate**. The server reloads its SSLContext and updates seat quotas in-flight with zero downtime. -* **Live WebSocket Sync**: - Click **πŸ”„ Sync with License Hub** to trigger immediate real-time synchronization with `logar.eibl.tech`. - ---- - -## 5. Storage Engine & Ingestion Performance - -**Tab: πŸ—„οΈ Database Engine** - -Configure ingestion buffering, payload encryption at rest, and database backends. - -``` -β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” -β”‚ 1. INGESTION RING BUFFER & BATCH FLUSHER (Top) β”‚ -β”‚ β€’ Mode: Direct (Sync) / In-Memory Ring Buffer β”‚ -β”‚ β€’ Batch Flush Interval (sec) & Batch Size (events) β”‚ -β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ -β”‚ 2. PAYLOAD ENCRYPTION AT REST (Middle) β”‚ -β”‚ β€’ Toggle: OpenPGP / RSA-2048 Payload Encryption β”‚ -β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ -β”‚ 3. STORAGE BACKEND SELECTION (Bottom) β”‚ -β”‚ β€’ Local SQLite (WAL Mode) β”‚ -β”‚ β€’ External SQL Server (PostgreSQL / MySQL / MariaDB) β”‚ -β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ -``` - -### 1. Ingestion Ring Buffer (Top Section) -Tune log ingestion throughput to prevent socket I/O bottlenecks during high-volume spikes: -* **Cache Mode**: - * **Direct (Synchronous)**: Commits incoming log batches immediately to disk. Recommended for small deployments (< 20 nodes). - * **In-Memory Ring Buffer**: Places incoming events into an in-memory queue. A background thread flushes events in atomic batches. Recommended for large fleets (> 50 nodes). -* **Batch Flush Interval**: Time in seconds between automated queue commits (default: `2.0s`). -* **Batch Size**: Maximum events processed per database commit transaction (default: `100`). -* *Note: Ingestion buffering is an explicit opt-in setting and is not auto-enabled.* - -### 2. Payload Encryption at Rest (Middle Section) -* **Encrypt Payloads at Rest**: When enabled, log message payloads (`event_data`) stored in external databases are encrypted using the server's X.509 RSA-2048 / OpenPGP public key. -* **Zero-Knowledge Guarantee**: Database administrators or compromised SQL servers cannot read raw logs without the private key resident on the LOGAR Server Hub. -* *Note: Encryption at rest is an explicit opt-in setting.* - -### 3. Database Backend Selection (Bottom Section) -Switch between local file storage and external SQL servers: -* **Local SQLite (WAL Mode)**: - * Default, zero-configuration embedded database located at `logar_state.db`. - * Operates with Write-Ahead Logging (WAL) for high concurrency. -* **External SQL Server (PostgreSQL / MySQL / MariaDB)**: - * Select your database dialect (**PostgreSQL** or **MySQL / MariaDB**). - * Enter **Host**, **Port**, **Database Name**, **Username**, and **Password**. - * Click **πŸ’Ύ Save & Apply Storage Configuration**. - * The server tests connectivity, initializes required tables and indices, and migrates operational state seamlessly. -* *Licensing Note: External SQL backend options require the `enterprise_db` licensed capability. If unlicensed, these controls are visible but gracefully disabled.* - ---- - -## 6. Hermes AI Tokens & Integration - -**Tab: πŸ€– Hermes AI** - -Provision dedicated access tokens for Hermes AI agents to ingest anomalous telemetry. - -### Managing Access Tokens -* **Create Token**: Enter an agent name (e.g. `Hermes-Production-Cluster`) and click **βž• Generate Token**. -* **Token Attributes**: View Token Name, Creation Date, Last Used Timestamp, and Status (`Active` / `Revoked`). -* **Revoke / Delete**: Instantly revoke access for compromised tokens or permanently delete retired tokens. - -### Connecting Hermes AI -Configure Hermes AI agents to query the structured anomaly stream: -```http -GET http://:8443/api/hermes/report -Authorization: Bearer hermes_live_xxxxxxxxxxxxxxxx -``` -* Or via query parameter: `http://:8443/api/hermes/report?token=hermes_live_xxxxxxxxxxxxxxxx` - ---- - -## 7. User Account & 2FA Security - -**Menu: βš™οΈ User Settings** - -### Changing Administrative Credentials -1. Click the **Admin Profile** icon in the navigation bar. -2. Enter a new Username and Password. -3. Click **Update Account**. - -### Two-Factor Authentication (TOTP 2FA) -Enhance login security with RFC 6238 Time-Based One-Time Passwords: -1. Click **πŸ”’ Setup Two-Factor Authentication**. -2. Scan the displayed QR Code using your preferred authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, etc.). -3. Enter the 6-digit verification code from your authenticator app to confirm activation. -4. Subsequent logins will require your password followed by the 6-digit TOTP code.