diff --git a/LOGAR-LICENSING b/LOGAR-LICENSING index e10bc42..1993907 160000 --- a/LOGAR-LICENSING +++ b/LOGAR-LICENSING @@ -1 +1 @@ -Subproject commit e10bc42cda201ce2aa8ffba95484099e14b6a102 +Subproject commit 1993907a11b32f389b57ae1daaf122cc3063ceea diff --git a/README.md b/README.md index 9c9f503..d8d9d07 100644 --- a/README.md +++ b/README.md @@ -267,17 +267,20 @@ stateDiagram-v2 - Admin WebUI is protected by authenticated login with user and tenant administration. ### 3. Integrated Fleet Licensing & WebUI Dashboard -- **WebUI URL**: Accessible at `http://:8443/webui` (or `/`). -- **Visual Seat Quota Meter**: Real-time progress bar displaying active forwarders vs. allocated seat limit. -- **Licensing Actions**: - - 1-click **Export .lic Request** file download. - - Interactive **View & Copy CA CSR** modal. - - Drag-and-drop or paste **Import License (.lic / ca.crt)** modal. - - **Sync & Renew via mTLS** button for immediate upstream synchronization and seat expansion. -- **Seat Management & Revocation Table**: - - Lists all connected Windows and Linux edge forwarders. - - **Revoke Seat**: Instantly drops and blocks the client at the TLS socket handshake layer. - - **Reactivate Seat**: Restores the client to active status if within seat quota limits. +- **WebUI URL**: Accessible at `http://:8443/webui` (or `/`). Protected by authenticated session login (`/login`). +- **Tab 1: 📋 Active Anomalies & Telemetry**: + - Real-time tabular stream of verified anomalies within the active 12-hour evaluation window. + - Interactive search filter and Hermes AI status metrics. + - **Visual Seat Quota Meter**: Real-time progress bar displaying active forwarders vs. allocated seat limit. + - **Seat Management & Revocation Table**: Lists all connected Windows and Linux edge forwarders with 1-click **Revoke Seat**, **Reactivate Seat**, and **Export Client Configuration** actions. +- **Tab 2: 📜 Sub-CA & Licensing**: + - Dedicated PKI and Subordinate CA lifecycle management interface. + - Displays Master Authority WebSocket status (`logar.eibl.tech`), hardware fingerprint, and embedded seat quota. + - **Licensing Actions**: + - 1-click **Export .lic Request** file download. + - Interactive **View & Copy CA CSR** modal. + - Drag-and-drop or paste **Import License (.lic / ca.crt)** modal. + - **Sync & Renew via WebSocket** button for immediate upstream synchronization and seat expansion. ### 4. Cloud-Side In-Flight Certificate Watchdog - **Continuous Hub PKI Watchdog**: @@ -327,7 +330,7 @@ Client enrollment endpoint: ``` ### `GET /api/clients` -Returns seat quota status and registered client telemetry: +Returns seat quota status and registered client telemetry *(Requires Administrator session cookie or Bearer auth)*: ```json { "active_seats": 2, @@ -369,7 +372,10 @@ Returns all **verified anomalies** within the active 12-hour evaluation window w ``` ### `GET /api/hermes/all` -Diagnostic endpoint listing all tracked anomalies in SQLite. +Diagnostic endpoint listing all tracked anomalies in SQLite *(Requires Administrator auth)*. + +### `POST /api/auth/login` & `POST /api/auth/logout` +Session authentication endpoints for Administrator WebUI access. ### `GET /health` Returns hub health, encryption fingerprint, listener ports, and mTLS status. @@ -422,15 +428,15 @@ LOGAR provides production-grade installation scripts and installer builders for LOGAR/ ├── .gitea/ │ └── workflows/ -│ ├── ci.yml # CI pipeline: syntax, 25 unit tests & mTLS pipeline test -│ └── release.yml # Consolidated release workflow (Linux binaries & Windows installers) +│ ├── ci.yml # CI pipeline: syntax, 35 unit tests & mTLS pipeline test +│ └── release.yml # Consolidated release workflow (Cross-compilation on Linux runner) ├── compilation/ # Packaging, installers, and release automation │ ├── install_linux_client.sh # Automated Linux client systemd installation script │ ├── install_linux_server.sh # Automated Linux server systemd installation script │ ├── installer_client.iss # Inno Setup Windows Client installer script │ ├── installer_server.iss # Inno Setup Windows Server installer script │ ├── nssm.exe # Official 64-bit NSSM service manager binary -│ ├── package_dist.py # Standalone binary compiler & packager +│ ├── package_dist.py # Standalone binary cross-compiler & packager │ ├── requirements.txt # Unified project dependencies │ └── upload_release.py # Gitea REST API release asset publisher ├── src/ # Core application source modules @@ -440,9 +446,10 @@ LOGAR/ │ ├── Win_Client.py # Windows edge forwarder with auto-enrollment │ └── Linux_Client.py # Linux edge forwarder with auto-enrollment ├── tests/ # Automated test suites +│ ├── test_license_authority.py # Subordinate CA, WebSocket sync, and WebUI integration tests │ ├── test_linux_client.py # Linux client unit tests & mTLS certificate validation │ ├── test_pipeline.py # End-to-end mTLS integration & direct anomaly verification test -│ ├── test_server.py # Server unit tests, PKI generation, and seat quota tests +│ ├── test_server.py # Server unit tests, PKI generation, user auth & seat quota tests │ └── test_win_client.py # Windows client unit tests & mTLS certificate validation ├── .gitignore # Ignores venv, caches, DBs, and private keys ├── README.md # Architecture and usage documentation @@ -491,7 +498,7 @@ LOGAR/ ```bash sudo ./compilation/install_linux_client.sh "http://:8443" "" ``` -2. The installer enrolls the client, configures `/etc/logar/certs`, and activates `logar-client.service`. +2. The installer enrolls the client, configures `/etc/logar/certs` (with `chmod 700`), and activates `logar-client.service`. --- @@ -501,11 +508,13 @@ LOGAR/ ```bash python -m unittest discover -s tests -v ``` -Runs all **25 unit tests**, covering: +Runs all **35 unit tests**, covering: - Dynamic Root CA generation and server TLS certificate issuance. - Dynamic client certificate issuance with CN and authority key extensions. - Enrollment secret authentication, seat limits, and certificate revocation. - Proactive certificate validity checks, Root CA auto-renewal, and in-flight server SSLContext reload. +- Subordinate CA CSR generation, WebSocket enrollment, and dynamic seat quota updates. +- Administrator session authentication, PBKDF2 hashing, and Hermes Bearer token lifecycle. - Windows & Linux event log collection, deduplication, and mTLS certificate verification. - 12-hour evaluation window and direct Hermes anomaly verification. @@ -526,29 +535,30 @@ Tests client enrollment, secret rejection, mTLS TLS 1.3 socket handshake, direct ## Releases & Binary Distribution -Releases can be built and published through three complementary channels: +Releases are cross-compiled and published through automated or manual triggers: ### 1. Tag Push Automation (Gitea Actions) -Pushing a release tag automatically triggers the build workflows: +Pushing a release tag automatically triggers the build workflow: ```bash -git tag v3.0.0 -git push origin v3.0.0 +git tag v3.0.1 +git push origin v3.0.1 ``` -The consolidated workflow **`release.yml`** defines two parallel jobs: -- **`release-linux`** (`ubuntu-latest`): Compiles standalone native ELF binaries (`Linux_Client.bin`, `Server.bin`) and checksums. -- **`release-windows`** (`windows-latest`): Compiles Windows executables (`Win_Client.exe`, `Server.exe`), builds Inno Setup installers, and publishes checksums (requires self-hosted Windows Act Runner). +The consolidated workflow **`release.yml`** runs on a single Ubuntu runner (`ubuntu-latest`) using cross-compilation (`python compilation/package_dist.py --target all`): +- **Linux Binaries**: Native ELF standalone executables (`Linux_Client.bin`, `Server.bin`). +- **Windows Executables & Bundles**: Cross-compiled standalone binaries (`Win_Client.exe`, `Server.exe`) and `.zip` distribution packages. +- **Automated Checksums & Publishing**: Generates `sha256sums.txt` and publishes all release assets and release notes directly to Gitea. ### 2. Manual Workflow Dispatch (Gitea UI) Workflows can be manually triggered on demand from the Gitea web interface: 1. Navigate to **Actions** $\rightarrow$ **Release Binaries & Installers** (`release.yml`). -2. Click **Run workflow**, set the release tag (defaults to `v3.0.0`), and run. +2. Click **Run workflow**, set the release tag (defaults to `v3.0.1`), and run. -### 3. Native Local Windows Build & Direct Release Upload -For environments without a registered Windows CI runner, Windows executables can be built and published directly to Gitea releases: +### 3. Local Native Build & Direct Release Upload +To build and upload binaries locally from an administrative workstation: ```powershell -# 1. Build Windows binaries locally -python compilation/package_dist.py --target windows +# 1. Build binaries locally (windows, linux, or all) +python compilation/package_dist.py --target all # 2. Upload assets and release notes directly to the Gitea release -python compilation/upload_release.py --tag v3.0.0 --token --skip-build +python compilation/upload_release.py --tag v3.0.1 --token --skip-build ```