LOGAR/out/linux_server/README.md

LOGAR Linux Server Hub

Standalone compiled binary and automated systemd service distribution for Linux server environments (Server.bin).

---

Overview

Server.bin is a self-contained, pre-compiled Linux ELF executable that operates as the central coordination, log analysis, dynamic PKI, and reporting hub of the LOGAR telemetry architecture.

Key Architecture & Capabilities

• Pre-compiled & Dependency-Free: Ships as a standalone native Linux ELF binary (Server.bin). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system.
• Mutual TLS 1.3 (mTLS) Ingestion (Port 9443): Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Root CA and verifies active licensing in SQLite.
• Dynamic PKI & License Accounting: Built-in Root CA generates server TLS certificates with SANs and dynamically signs client certificates via POST /api/client/enroll while enforcing seat limits (max_seats).
• Warning Persistence & Immediate Error Routing: High-severity ERROR, CRITICAL, and FATAL events are promoted to VERIFIED immediately on their first occurrence. Operational WARNING and INFO events require persistence across at least 4 distinct client transmission cycles within a rolling 12-hour evaluation window.
• Embedded Hermes Reporting & Management API (Port 8443): Integrated REST API exposing /api/hermes/report, /api/clients, and /api/client/enroll.
• State Database: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (logar_state.db).

---

1. Automated Installation via Script (Recommended)

Deploy using the automated installer:

sudo ./compilation/install_linux_server.sh

This script:

1. Installs the server binary to /opt/logar-server/Server.
2. Creates /etc/logar and /var/log/logar.
3. Deploys, enables, and starts the systemd service unit /etc/systemd/system/logar-server.service with LimitNOFILE=65536.

---

2. Initializing & Generating Server Configuration

Step 1: Automatic First-Run Generation

When launched without an existing server_config.json, Server.bin automatically generates:

1. An internal Root CA (certs/ca.crt and certs/ca.key).
2. A server TLS certificate (certs/server.crt and certs/server.key) with SANs.
3. An OpenPGP RSA-2048 keypair (private_key and public_key).
4. Cryptographically random authentication tokens and enrollment secrets.
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).

Run Server.bin once to initialize:

./Server.bin

Output:

[!] Config 'server_config.json' not found. Initializing first-run configuration...
[+] Successfully generated new server config and OpenPGP keypair.
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
[+] Saved to: server_config.json
============================================================
  LOGAR Server Hub: LOGAR-Cloud-Hub
  Transport Security: mTLS (TLS 1.3)
  License Quota: 10 Active Seats
  Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
  Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
============================================================
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll

Step 2: Configuration Fields Reference

The generated server_config.json contains:

{
  "server_name": "LOGAR-Linux-Hub",
  "tcp_host": "0.0.0.0",
  "tcp_port": 9443,
  "hermes_host": "0.0.0.0",
  "hermes_port": 8443,
  "auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
  "enrollment_secret": "e1f2a3b4c5d6...",
  "max_seats": 10,
  "cert_dir": "certs",
  "tls_enabled": true,
  "db_path": "logar_state.db",
  "evaluation_window_hours": 12,
  "min_persistence_runs": 4,
  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
  "public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
  "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
}

---

3. Exporting Client Configurations

Generate a client configuration bundle to deploy onto Windows or Linux forwarders:

./Server.bin --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json

The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.

---

4. Manual Systemd Service Management

Check service status:

sudo systemctl status logar-server.service

Inspect live service logs:

sudo journalctl -u logar-server.service -f -n 50

---

5. Uninstallation & Removal

sudo systemctl disable --now logar-server.service
sudo rm -f /etc/systemd/system/logar-server.service
sudo systemctl daemon-reload
sudo rm -rf /opt/logar-server /etc/logar /var/log/logar