158 lines
6.8 KiB
Markdown
158 lines
6.8 KiB
Markdown
# LOGAR Linux Server Hub
|
|
|
|
Standalone compiled binary and automated systemd service distribution for Linux server environments (`Server.bin`).
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
`Server.bin` is a self-contained, pre-compiled Linux ELF executable that operates as the central coordination, log analysis, dynamic PKI, and reporting hub of the LOGAR telemetry architecture.
|
|
|
|
### Key Architecture & Capabilities
|
|
- **Pre-compiled & Dependency-Free**: Ships as a standalone native Linux ELF binary (`Server.bin`). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system.
|
|
- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite.
|
|
- **Master License Authority (`logar.eibl.tech`) & Seat-Bearing CA**: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID `1.3.6.1.4.1.59999.1.1`.
|
|
- **Zero-Touch mTLS Renewals**: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with `https://logar.eibl.tech/api/license/renew` when nearing expiration (< 30 days).
|
|
- **Fleet Management & WebUI Dashboard (Port 8443)**: Modern browser WebUI accessible at `http://localhost:8443/webui` to monitor seat quotas, export `.lic` request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement.
|
|
- **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events require persistence across at least 4 distinct client transmission cycles within a rolling 12-hour evaluation window.
|
|
- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`.
|
|
- **State Database**: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (`logar_state.db`).
|
|
|
|
---
|
|
|
|
## 1. Automated Installation via Script (Recommended)
|
|
|
|
Deploy using the automated installer:
|
|
```bash
|
|
sudo ./compilation/install_linux_server.sh
|
|
```
|
|
This script:
|
|
1. Installs the server binary to `/opt/logar-server/Server`.
|
|
2. Creates `/etc/logar` and `/var/log/logar`.
|
|
3. Deploys, enables, and starts the systemd service unit `/etc/systemd/system/logar-server.service` with `LimitNOFILE=65536`.
|
|
|
|
---
|
|
|
|
## 2. Initializing & Generating Server Configuration
|
|
|
|
### Step 1: Automatic First-Run Generation
|
|
When launched without an existing `server_config.json`, `Server.bin` automatically generates:
|
|
1. An internal Root CA (`certs/ca.crt` and `certs/ca.key`).
|
|
2. A server TLS certificate (`certs/server.crt` and `certs/server.key`) with SANs.
|
|
3. An OpenPGP RSA-2048 keypair (`private_key` and `public_key`).
|
|
4. Cryptographically random authentication tokens and enrollment secrets.
|
|
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).
|
|
|
|
Run `Server.bin` once to initialize:
|
|
```bash
|
|
./Server.bin
|
|
```
|
|
Output:
|
|
```
|
|
[!] Config 'server_config.json' not found. Initializing first-run configuration...
|
|
[+] Successfully generated new server config and OpenPGP keypair.
|
|
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
|
[+] Saved to: server_config.json
|
|
============================================================
|
|
LOGAR Server Hub: LOGAR-Cloud-Hub
|
|
Transport Security: mTLS (TLS 1.3)
|
|
License Quota: 10 Active Seats
|
|
Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
|
Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
|
|
============================================================
|
|
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
|
|
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
|
|
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll
|
|
```
|
|
|
|
### Step 2: Configuration Fields Reference
|
|
The generated `server_config.json` contains:
|
|
```json
|
|
{
|
|
"server_name": "LOGAR-Linux-Hub",
|
|
"tcp_host": "0.0.0.0",
|
|
"tcp_port": 9443,
|
|
"hermes_host": "0.0.0.0",
|
|
"hermes_port": 8443,
|
|
"auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
|
|
"enrollment_secret": "e1f2a3b4c5d6...",
|
|
"max_seats": 10,
|
|
"cert_dir": "certs",
|
|
"tls_enabled": true,
|
|
"db_path": "logar_state.db",
|
|
"evaluation_window_hours": 12,
|
|
"min_persistence_runs": 4,
|
|
"server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
|
|
"public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
|
|
"private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 3. Exporting Client Configurations
|
|
|
|
Generate a client configuration bundle to deploy onto Windows or Linux forwarders:
|
|
```bash
|
|
./Server.bin --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json
|
|
```
|
|
The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.
|
|
|
|
---
|
|
|
|
## 4. Fleet Licensing, .lic Files & WebUI Dashboard
|
|
|
|
### Accessing the WebUI
|
|
Open your browser and navigate to:
|
|
```
|
|
http://<SERVER_IP>:8443/webui
|
|
```
|
|
The WebUI provides:
|
|
1. **Real-time Seat Quota Meter**: Visual meter displaying active clients against approved seat quota.
|
|
2. **Export .lic Request**: 1-click download of `logar_server.lic` containing your Subordinate CA CSR and machine fingerprint for `logar.eibl.tech`.
|
|
3. **Import License (.lic / ca.crt)**: Modal to paste or upload the activated `.lic` package or `ca.crt` issued by `logar.eibl.tech`. Activating updates your seat limit immediately and reloads mTLS context in-flight.
|
|
4. **Sync & Renew via mTLS**: Button to test or trigger immediate mTLS renewal against `logar.eibl.tech` and pull seat quota increases without restart.
|
|
5. **Client Seat Management**: View all enrolled nodes; click **Revoke Seat** to immediately drop and block an edge node at the socket layer, or **Reactivate** to restore access.
|
|
|
|
### CLI Licensing Utilities
|
|
Export a `.lic` request file via CLI:
|
|
```bash
|
|
./Server.bin --export-lic server.lic
|
|
```
|
|
Import an activated `.lic` license package or signed CA certificate via CLI:
|
|
```bash
|
|
./Server.bin --import-lic activated.lic
|
|
# Or alternatively with --import-ca:
|
|
./Server.bin --import-ca ca.crt
|
|
```
|
|
Synchronize license and check for seat quota increases against the master authority:
|
|
```bash
|
|
./Server.bin --sync-license
|
|
```
|
|
|
|
---
|
|
|
|
## 5. Manual Systemd Service Management
|
|
|
|
Check service status:
|
|
```bash
|
|
sudo systemctl status logar-server.service
|
|
```
|
|
|
|
Inspect live service logs:
|
|
```bash
|
|
sudo journalctl -u logar-server.service -f -n 50
|
|
```
|
|
|
|
---
|
|
|
|
## 6. Uninstallation & Removal
|
|
|
|
```bash
|
|
sudo systemctl disable --now logar-server.service
|
|
sudo rm -f /etc/systemd/system/logar-server.service
|
|
sudo systemctl daemon-reload
|
|
sudo rm -rf /opt/logar-server /etc/logar /var/log/logar
|
|
```
|
|
|