Skip to content

Commit

Permalink
Merge pull request #1 from iolivergithub/tarzan
Browse files Browse the repository at this point in the history
remaned ta10 to tarzan
  • Loading branch information
iolivergithub committed Jul 6, 2024
2 parents 3a2773d + 028e578 commit de795d5
Show file tree
Hide file tree
Showing 17 changed files with 49 additions and 49 deletions.
28 changes: 14 additions & 14 deletions docs/automaticStartup.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ In this section we present an example distribution for use in a systemd environm

## Example File Layout (Linux/BSD)

One possible layout is to put everything in `/opt/jane`. Note, `janeserver` and `ta10` are put together just for convenience. Set permissions accordingly.
One possible layout is to put everything in `/opt/jane`. Note, `janeserver` and `tarzan` are put together just for convenience. Set permissions accordingly.

```bash
$ pwd
Expand All @@ -13,7 +13,7 @@ $ ls -l
total 27364
-rw-rw-r-- 1 ian ian 706 tammi 21 13:01 config.yaml
-rwxrwxr-x 1 ian ian 19448208 tammi 21 13:00 janeserver
-rwxrwxr-x 1 ian ian 8554460 tammi 21 13:02 ta10
-rwxrwxr-x 1 ian ian 8554460 tammi 21 13:02 tarzan
-rw-rw-r-- 1 ian ian 1440 tammi 21 13:01 temporary.crt
-rw-rw-r-- 1 ian ian 1704 tammi 21 13:01 temporary.key
```
Expand Down Expand Up @@ -44,19 +44,19 @@ Ensure the `config.yaml` is properly configured for your system and installation
Start with `systemctl start jane.service` and enable with `systemctl enable jane.service`. Use `journalctl -xe` to check startup and possible errors.


## TA10 and
## Tarzan

This is how to start ta10. It works on BSDs, Linux, Windows and quite a few others depending upon the binary. Instructions here for starting with systemd and rc.3 which'll probably transfer between many Linux and BSD installations. Windows seems to work too
This is how to start tarzan. It works on BSDs, Linux, Windows and quite a few others depending upon the binary. Instructions here for starting with systemd and rc.3 which'll probably transfer between many Linux and BSD installations. Windows seems to work too

### Linxu with Systemd
### Linux with Systemd

Place the following systemd configuration in `/etc/systemd/system` as `ta10.service`
Place the following systemd configuration in `/etc/systemd/system` as `tarzan.service`

Note ta10 may require root to run. Take note of any security aspects.
Note tarzan may require root to run. Take note of any security aspects.

```
[Unit]
Description=TA10 Trust Agent
Description=Tarzan Trust Agent
After=network.target
StartLimitIntervalSec=0
Expand All @@ -65,28 +65,28 @@ Type=simple
Restart=always
RestartSec=1
User=root
ExecStart=/opt/jane/ta10
ExecStart=/opt/jane/tarzan
[Install]
WantedBy=multi-user.target
```

Start with `systemctl start ta10.service` and enable with `systemctl enable ta10.service`. Use `journalctl -xe` to check startup and possible errors.
Start with `systemctl start tarzan.service` and enable with `systemctl enable tarzan.service`. Use `journalctl -xe` to check startup and possible errors.

### Windows

This is possible. In the respository in `dist` is a file `ta10TrustAgent.xml` which provides some hints on this.
This is possible. In the respository in `dist` is a file `TarzanTrustAgent.xml` which provides some hints on this.

### BSD (rc.d)

Yes too. This script placed in `/etc/rc.d` called `ta10` works for startup, at least on my OpenBSD VM:
Yes too. This script placed in `/etc/rc.d` called `tarzan` works for startup, at least on my OpenBSD VM:

```
#!/bin/sh
#
# $OpenBSD: ta10
# $OpenBSD: tarzan
daemon="/opt/jane/ta10"
daemon="/opt/jane/tarzan"
. /etc/rc.d/rc.subr
Expand Down
32 changes: 16 additions & 16 deletions docs/compiling.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ The instructions presented here have been tested in Ubuntu 22.04 om AMD64.
+ [Install SGX SDK and Edgeless libraries](#install-sgx-sdk-and-edgeless-libraries)
+ [Building ](#building)
+ [Optional BUILD flag](#optional-build-flag)
* [Compiling TA10](#compiling-ta10)
* [Compiling tarzan](#compiling-tarzan)


<!-- TOC --><a name="compiling"></a>
Expand Down Expand Up @@ -58,30 +58,30 @@ If you wish to set a build flag, then specify as part of the `ldflags -X` optio
. /opt/edgelessrt/share/openenclave/openenclaverc && GOOS=linux GOARCH=amd64 go build -ldflags="-X 'main.BUILD=123'" -o janeserver
```

<!-- TOC --><a name="compiling-ta10"></a>
## Compiling TA10
<!-- TOC --><a name="compiling-tarzan"></a>
## Compiling tarzan

*MAKE SURE* you are in the `ta10` directory. TA10 is much simpler than janeserver and requires just compilation. For your local operating system and architecture you can remove the `GOOS` and `GOARCH` variables, for example as shown below. The `strip` command is optional but it does reduce the binary size a little.
*MAKE SURE* you are in the `tarzan` directory. tarzan is much simpler than janeserver and requires just compilation. For your local operating system and architecture you can remove the `GOOS` and `GOARCH` variables, for example as shown below. The `strip` command is optional but it does reduce the binary size a little.

```bash
go get -u
go mod tidy
go build -o ta10
strip ta10
go build -o tarzan
strip tarzan
```

For other architectures, use `go tool dist list` for a list of operating system and architecture options. Listed below are a few common options - and we like to append this to the binary name when we're generating a few of these for the devices we have (remeber amd64 is 64-bit Intel/AMD x86 based chips, eg: Xeons, i9's, i7's, Threaripper etc etc)

```bash
GOOS=linux GOARCH=arm go build -o ta10_arm # eg: Pi 3s
GOOS=linux GOARCH=arm64 go build -o ta10_arm64 # eg: Pi 4, 5s in 64-bit mode (also 3's I think)
GOOS=windows GOARCH=amd64 go build -o ta10_win # eg: Pretty much every Win10, Win11 machine
GOOS=plan9 GOARCH=386 go build -o ta10_belllabs # Because I was in Bell Labs and plan9 was freaking cool! The real Unix next!
GOOS=linux GOARCH=s390x go build -o ta10_mainframe # Because you either have an z-Series in the basement or Hercules
GOOS=solaris GOARCH=amd64 go build -o ta10_solaris # I still mourn the lost of the SparcStation and UltraSparcs, RIP Sun.
GOOS=opebsd GOARCH=amd64 go build -o ta10_openbsd # BSD for security (netbsd and freebsd are supported too)
GOOS=darmin GOARCH=arm64 go build -o ta10_mac # For the Apple people out there...no TPM, but if you figure out attesting a T2 let me know
GOOS=aix GOARCH=ppc64 go build -o ta10_aix # If you have an AIX box, again let me know...DRTM is supported during boot and a TPM too?
GOOS=wasip1 GOARCH=wasm go build -o ta10_aix # Web Assembly works too...never tried this myself, so I wonder how it works
GOOS=linux GOARCH=arm go build -o tarzan_arm # eg: Pi 3s
GOOS=linux GOARCH=arm64 go build -o tarzan_arm64 # eg: Pi 4, 5s in 64-bit mode (also 3's I think)
GOOS=windows GOARCH=amd64 go build -o tarzan_win # eg: Pretty much every Win10, Win11 machine
GOOS=plan9 GOARCH=386 go build -o tarzan_belllabs # Because I was in Bell Labs and plan9 was freaking cool! The real Unix next!
GOOS=linux GOARCH=s390x go build -o tarzan_mainframe # Because you either have an z-Series in the basement or Hercules
GOOS=solaris GOARCH=amd64 go build -o tarzan_solaris # I still mourn the lost of the SparcStation and UltraSparcs, RIP Sun.
GOOS=opebsd GOARCH=amd64 go build -o tarzan_openbsd # BSD for security (netbsd and freebsd are supported too)
GOOS=darmin GOARCH=arm64 go build -o tarzan_mac # For the Apple people out there...no TPM, but if you figure out attesting a T2 let me know
GOOS=aix GOARCH=ppc64 go build -o tarzan_aix # If you have an AIX box, again let me know...DRTM is supported during boot and a TPM too?
GOOS=wasip1 GOARCH=wasm go build -o tarzan_aix # Web Assembly works too...never tried this myself, so I wonder how it works
```

4 changes: 2 additions & 2 deletions docs/docker.md
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,6 @@ The following services are running and available externally by default
## TA10
## TARZAN
Refer back to [compiling](compiling.md) to understand how to build TA10. This normally doesn't need to be run in a container (and we don't really recommend it anyway)
Refer back to [compiling](compiling.md) to understand how to build tarzan. This normally doesn't need to be run in a container (and we don't really recommend it anyway)
30 changes: 15 additions & 15 deletions docs/running.md
Original file line number Diff line number Diff line change
Expand Up @@ -51,17 +51,17 @@ X3270 service listening on port 3270
If that works, point your browser at the machine where this is running and port 8540.


# Running TA10
# Running tarzan

Running TA10 is simple, just use
Running tarzan is simple, just use

```bash
./ta10
./tarzan
```

```bash
+========================================================================================
| TA10 version - Starting
| tarzan version - Starting
| + linux O/S on amd64
| + version v0.1, build not set
| + session identifier is 19a14951-76c3-4641-b9ac-fa65683e5c36
Expand All @@ -71,15 +71,15 @@ Running TA10 is simple, just use
⇨ http server started on [::]:8530
```

If you are running on Linux and need access to files such as the UEFI log file then you will need to run ta10 as sudo.
If you are running on Linux and need access to files such as the UEFI log file then you will need to run tarzan as sudo.

TA10 requires access to the TPM device, eg `/dev/tpm0` on Linux (Windows handles this internally), and so whichever user ta10 is running as needs access to that device.
tarzan requires access to the TPM device, eg `/dev/tpm0` on Linux (Windows handles this internally), and so whichever user tarzan is running as needs access to that device.

```bash
sudo ./ta10
sudo ./tarzan
```

Read the section on advanced TA10 usage.
Read the section on advanced tarzan usage.

# JANESERVER Configuration File

Expand Down Expand Up @@ -162,22 +162,22 @@ keylime:
apiurl: https://127.0.0.1:30000/keylime #CHANGE ME
```
# Advanced TA10 - Here be a good way to open your system to every hacker ever
# Advanced tarzan - Here be a good way to open your system to every hacker ever
TA10 CURRENTLY starts all the services, ie: it will happily offer TPM, IMA, UEFI services etc, even if these are not available. In a later version these will have be switched on specifically, but don't worry about this.
tarzan CURRENTLY starts all the services, ie: it will happily offer TPM, IMA, UEFI services etc, even if these are not available. In a later version these will have be switched on specifically, but don't worry about this.
TA10 can read UEFI and IMA logs in non-standard places, but in order to do this, the element description in the Jane's database would have to refer to those specifically. TA10 by default operates in a *safe* mode where it will only use the standard locations in Linux's securityfs. You can turn off this mode:
tarzan can read UEFI and IMA logs in non-standard places, but in order to do this, the element description in the Jane's database would have to refer to those specifically. tarzan by default operates in a *safe* mode where it will only use the standard locations in Linux's securityfs. You can turn off this mode:
```bash
sudo ./ta10 -unsafe=true
sudo ./tarzan -unsafe=true
```

which responds with

```bash
$ sudo ./ta10 -unsafe=true
$ sudo ./tarzan -unsafe=true
+========================================================================================
| TA10 version - Starting
| tarzan version - Starting
| + linux O/S on amd64
| + version v0.1, build not set
| + session identifier is 4e85a08d-7d1c-450d-9a7a-659f29ab8380
Expand All @@ -186,7 +186,7 @@ $ sudo ./ta10 -unsafe=true


!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
TA10 is running in UNSAFE file access mode. Unsafe is set to true
tarzan is running in UNSAFE file access mode. Unsafe is set to true
Requests for log files, eg: UEFI, IMA, that supply a non default location will happily read that file
This is a HUGE security issue. YOU HAVE BEEN WARNED
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Expand Down
4 changes: 2 additions & 2 deletions docs/security.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ Read carefully:
* TO SAVE YOURSELF, SET THE use http FIELDS TO true in the configuration file.
* That isn't secure either...
* GENERATE YOUR OWN KEYS AND KEEP THEM SECURE and use https
* TA10 runs over HTTP !!!!
* DO NOT USE TA10 IN UNSAFE MODE !!! (Even if you're not root!)
* Tarzan runs over HTTP !!!!
* DO NOT USE Tarzan IN UNSAFE MODE !!! (Even if you're not root!)
* Jane signs claims, results, sessions etc...the keys are randomly generated each him the system is started and aren't recorded anywhere. There is some code to talk PKCS#11 and has been tested with a YubiHSM but it isn't used. Don't rely upon it, I haven't tested it and it is just placeholder at this time. Yes, I'll get arund to writing the proper functionality real soon now...volunteers?
* Did I tell you that the temporary.key and temporary.crt have been on github and gitlab pages for years; also in the forks and elsewhere...?

Expand Down
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.

0 comments on commit de795d5

Please sign in to comment.