Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Opennav
 


Panel

On this page you will find instructions on how to set up a Trust Router on Debian 7, Ubuntu or Raspbian.

Contents

Table of Contents
maxLevel2


Numbered Headings

System Preparation

Install Debian 7

The first thing that is required is a Debian 7 machine - this can be physical or virtual.

  1. Install Debian 7 (Wheezy) via usual mechanism (e.g netboot CD, ISO in VMware/VirtualBox or the DVD image.
  2. Choose the following server install options: "Debian desktop, SSH server, Standard system utilities”.
  3. Create/choose a secure root password and an initial system user account.
  4. Once installed, make sure you run an apt-get update and apt-get upgrade to ensure your system is fully up to date.
Tip
titleTip

We would recommend using LVM when disk partitioning to allow easier partition/disk expansion on a live system.

Note
titleWarning

After install, you will want to secure/lockdown the server as best practice dictates - for both the server and any extra software installed. This is beyond the remit of this guide but there are many guides available, e.g. for securing Debian, and SSH servers.

Configure Debian 7

Next, there are a few Debian configuration options that need to be set in advance.

Networking configuration

For production deployments, it is recommended that the Trust Router be assigned a static IP address.

Tip

For Debian networking information please refer to the Debian documentation: https://wiki.debian.org/NetworkConfiguration

Firewall configuration

The following ports are required to be accessible from the outside world, both in local firewall and in any external firewalls:

  • 2083/tcp (for RadSec connections to other Moonshot entities)
  • 12309/tcp (for Trust Router client connections - if using the Trust Router to broker trust relationships between entities)

Add the Required Repositories

  1. Add the Moonshot Debian Wheezy repository to your system. To do this, run the following command (as root, or using sudo):

    Code Block
    languagebash
    $ echo "deb http://repository.project-moonshot.org/debian-moonshot wheezy main" > /etc/apt/sources.list.d/moonshot.list
  2. Install the Moonshot GPG key:

    Code Block
    languagebash
    $ wget -O - http://repository.project-moonshot.org/key.gpg | apt-key add -
  3. Update the apt cache with the new repository information:

    Code Block
    languagebash
    $ apt-get update
Install

Include Page
TEM:_SystemPrep_DEB
TEM:_SystemPrep_DEB

Install Trust Router

We’re now ready to install the Trust Router software and its required dependencies. Install the software by running the following command:

$
Code Block
languagebash
linenumberstrue
apt-get install moonshot-trust-router moonshot-noshib

Configure Trust Router

Next, we need to configure the Trust Router.

RadSec

APC TLS

First, you will need a copy of a client key and certificate (and appropriate CA) from the APC(s) that your Trust Router serves. Copy them onto the filesystem of your Trust Router.

Note

You can put these files anywhere on the file system, but this guide assumes you put them in /etc/pki/tls. If you place them in a different location you will need to change the locations below as appropriate.

Connection to APC

Next, we need to configure the RadSec configuration for the APC. We do this by creating a file at /etc/radsec.conf with the following:

Code Block
linenumberstrue
realm gss-eap {
	type = "TLS"
	cacertfile = "/etc/pki/tls/tr-ca.crt"
	certfile = "/etc/pki/tls/tr-client.pem"
	certkeyfile = "/etc/pki/tls/tr-client.key"
	disable_hostname_check = yes
	server {
		hostname = "apc.moonshot.ja.net"
		service = "2083"
		secret = "radsec"
	}
}

Then check the file and the certificates can be read by the Trust Router user:

Code Block
linenumberstrue
sudo -u trustrouter cat /etc/radsec.conf  /etc/pki/certs/tr-*.* /etc/pki/private/tr-*.*

Trust Router

Daemon Configuration

Your Trust Router will need to have a few core configuration items set. To do this:

  1. Open the /etc/sysconfig/trust_router file for editing. Make sure the configuration items are correct. Items you will most likely have to change are:
    • TR_DEFAULT_TEST_ACCEPTOR - this will need to be set to the (fully qualified) hostname of your Trust Router.

    • TR_DEFAULT_TEST_RPREALM - this will need to be set to the (fully qualified) hostname for your APC.

    • TR_DEFAULT_TEST_COMMUNITY - this will need to be set to the (fully qualified) hostname for your APC.

    • TR_DEFAULT_TEST_REALM - this will need to be set to the (fully qualified) hostname for your APC.

    Open the default instance's main configuration file at /etc/trust_router/conf.d/default/main.cfg for editing.
    1. Change the hostname to the (fully qualified) hostname of your Trust Router.Change the port that it runs on, if necessary
Note

If the /etc/trust_router directory does not exist, you may need to create it yourself, along with the subdirectories mentioned.

Moonshot Configuration

Moonshot, you say? Yes, Trust Router uses Moonshot to authenticate and secure all communications between Trust Router clients and servers. So, you will need to configure the trust router user to make use of the Moonshot flatstore (i.e. telling Moonshot that this is a special system account, not a regular user account), and you will need to import a set of credentials for your Trust Router to use.

  1. Enable the trustrouter user to use the Moonshot UI flatstore:

    Code Block
    languagebash
    $ echo "trustrouter" >> /etc/moonshot/flatstore-users
  2. Import it using the moonshot-webp command (as the trustrouter user):

    $
    Code Block
    languagebash
    linenumberstrue
    su - --shell =/bin/bash trustrouter
    $ unset DISPLAY
    $ moonshot-webp -f [path to credential file]


    Info

    The credentials file will be given to you by the administrator of the APC.


Shibboleth

Note

This step is only required if you use the default Moonshot packages. Using the moonshot-noshib packages will not require this step.

Shibboleth, you say? Yes, Shibboleth is used by the Moonshot components to be able to deal with incoming SAML. However, this feature typically isn't used in Trust Router, but its logging will appear in your Trust Router's log files. So, to simplify your log files, it is recommended that you silence the Shibboleth logging. To do this:

  1. Open /etc/shibboleth/console.logger for editing.
  2. Change WARN to NONE on the first line, i.e.

    Code Block
    linenumberstrue
    log4j.rootCategory=NONE, console


Default Peer

Info
If your Trust Router is going to run in its own, standalone, trust network, then you can skip this step.

If it your Trust Router is going to run in a wider trust network, then you can configure your Trust Router's default peer - i.e. the Trust Router it sends its clients to when they ask it to locate a Moonshot entity that your Trust Router doesn't know about. To do this:

 

  1. Open /etc/trust_router/conf.d/default/peering.cfg for editing. Change the content as follows:

    Code Block
    linenumberstrue
    {
    "default_servers": [
     "[hostname of trust router]"
     ]
    }



    Tip
    titleExample

    If you were configuring your default Trust Router peer to be Janet's Trust Router at tr1tr.moonshot.ja.net, its peering.cfg file would look like this:

    Code Block
    linenumberstrue
    {
    "default_servers": [
     "tr1tr.moonshot.ja.net"
     ]
    }
Restart


Configure your Trust Router

A trust router requires a trust configuration to function correctly. See the trust configuration file for more information.

Place an appropriate trusts.cfg file info the /etc/trust_router directory and symbolically link it into the default configuration directory:

Info

You can find a Trust Router configuration suitable for a Trust Router connecting to tr1.moonshot.ja.net at sample Trust Router Client configuration


Start your Trust Router

You are now ready to restart start your Trust Router and test it. To do this:

  1. As root, restart start the Trust Router daemon:

    Code Block
    languagebash
    $systemctl servicestart trust_router restart


Testing

service trustrouter status. Default should work, tr-test shouldn'tTo test your trust router, you should attempt a TIDC request on a Moonshot service connected to your trust router. The TIDC request will take a little longer, but it should succeed.

If it fails, please contact us.

Next Steps

At this point, you now have a Trust Router. Blimey.

/etc/trust_router/trusts.cfg with trust config

 

Automatically start the software

Trust Router

To automatically start Trust Router, issue the following command (as root):


Code Block
linenumberstrue
systemctl enable trust_router
systemctl start  trust_router