Deployment on client OS, using RPMs

1) Introduction

This document contains the deployment instructions for installing VeridiumID server. In the following sections, we will present in detail the installation procedure and present the packages that will be required during said procedure.

Packages can be downloaded from here:

https://veridium-repo.veridium-dev.com/repository/VeridiumUtils/Veridium_3.5.0/VeridiumInstaller/veridium-installer-9.1.28.zip

https://veridium-repo.veridium-dev.com/repository/VeridiumUtils/Veridium_3.5.0/VeridiumInstaller/vid-ansible-9.1.28.zip

1.1) Type of nodes

In the following lines we will use three specific terms to describe the virtual machines used during the deployment procedure:

• Ansible/Deployment node

  • This node will be used as the central node from which the installation/configuration will take place.

• Webapp node

  • This type of node will be used in order to deploy WEB layer packages (for example: web applications and load balancers).

• Persistence node

  • This type of node will be used in order to deploy data layer packages (for example: database solutions, configuration managers).

2) Prerequisites - RPM installation

This section will provide the list of packages provided by VerdiumID and details regarding the installation procedure.

2.1) Requirements for VeridiumID

The following list of packages must be installed from official repositories in order to be able to use VeridiumID, the following command can be run as root:

yum -y install apr-devel openssl-devel libstdc++-devel curl unzip wget zlib zlib-devel nc openssh-clients perl rsync libtalloc perl-DBI

*On RHEL make sure subscription is activated

sudo subscription-manager repos --enable=rhel-7-server-rpms --enable=rhel-7-server-extras-rpms --enable=rhel-7-server-optional-rpms

The following requirements must be available on all nodes:

• VeridiumID requires OpenJDK 8 latest release and rng-tools to provide entropy to the system.

  CODE

  yum -y install java-1.8.0-openjdk
  yum -y install rng-tools
  systemctl enable rngd
  systemctl start rngd

• Disable IPv6 on all nodes

sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1

• VeridiumID nodes must have SELinux DISABLED or permissive during the deployment; after the deployment, it can be turned back on.

setenforce 0     

2.2.1) Layout RPMs

Packages can be found in veridium-installer-9.1.28.zip. Unzip this file and go to package folder. Transfer the RPMs to the machines, accordingly to below instructions.

VeridiumID provides layout packages that are in charge of creating the default paths on the operating system and users that will be necessary during the configuration phase.

All users, groups and default paths are created by installing the following packages. Please DO NOT CREATE veridiumid user, at is automatically created.

## WEBAPP
yum -y --disablerepo=* localinstall veridiumid_veridium-layout-9.1.28-20231017.x86_64.rpm veridiumid_veridium-layout-users-webapp-9.1.28-20231017.x86_64.rpm veridiumid_python-9.1.28-20231017.x86_64.rpm
## PERSISTENCE
yum -y --disablerepo=* localinstall veridiumid_veridium-layout-9.1.28-20231017.x86_64.rpm veridiumid_veridium-layout-users-persistance-9.1.28-20231017.x86_64.rpm veridiumid_python-3.6.8-20231017.x86_64.rpm

• Add veridiumid user to sudoers on Webapp and Persistence

  CODE

  add the following line to /etc/sudoers, by running: visudo
  
  veridiumid ALL=(ALL) NOPASSWD: ALL

• Please add the following rule, for logging for haproxy (as root) on Webapp nodes:

  • chcon -R -t httpd_sys_rw_content_t /vid-app/dyn/logs/haproxy

• Also, you have to run the following command in order to permit rsyslog logging (as root):

  • semanage permissive -a syslogd_t

• For the backup disk, after mounting it make sure that the directory has the correct permissions. To change permissions please run the following commands as root. These permissions will be granted after installing the packages

• The default backup directory is the following: /vid-app

  We recommend mounting the second disk on the path above. To mount a disk please use the following commands as root user:

  CODE

  mount DISK_PATH /vid-app/dyn/backup
  chown -R veridiumid:veridiumid /vid-app/dyn/backup
  chmod -R 770 /vid-app/dyn/backup

  • Where DISK_PATH is the full path of the second disk connected to the machine, for example: /dev/sdb

   

• Ensure that the Deployment node has SSH access to all other nodes using SSH keys and using the veridiumid user (the veridiumid user is created by above packages)

Veridiumid python contains the following packages (if it is not possible to install Veridium python)

Python-3.6.8, setuptools-40.0.0,dnspython-1.16.0,pem-20.1.0,python3-pythondialog-3.5.1,urllib3-1.25.9,ansible-2.9.10,ansible-vault-1.2.0,asn1crypto-1.4.0,bcrypt-3.2.0,cryptography-2.9.2,Jinja2-2.11.2,kazoo-2.1,MarkupSafe-1.1.1,paramiko-2.7.2,pexpect-4.8.0,ptyprocess-0.7.0,pycrypto-2.6.1,PyYAML-5.3.1,six-1.15.0,cffi-1.14.4,pycparser-2.20,pyparsing-2.4.7,gnureadline-8.0.0,pyOpenSSL-19.1.0,semantic_version-2.8.5,rpm-0.0.2,rpm-py-installer-1.1.0,pip-21.0.1,selinux-0.2.1,cassandra-driver-3.25.0,kafka-python-2.0.2,click-8.0.4,geomet-0.2.1.post1,importlib_metadata-4.8.3,typing_extensions-4.1.1,zipp-3.6.0,PyNaCl-1.5.0

After the layout packages have been installed, you can proceed to mount your second drive to /vid-app/dyn/backup

2.2.2) VeridiumID RPMs list

## WEBAPP
yum -y --disablerepo=* localinstall veridiumid_apache-tomcat-9.0.70-20231017.x86_64.rpm veridiumid_haproxy-2.6.13-20231017.x86_64.rpm veridiumid_shibboleth-idp-9.1.28-20231017.x86_64.rpm veridiumid_vclibs-1.1-20231017.x86_64.rpm veridiumid_4fidlibs-5.4.8-20231017.x86_64.rpm veridiumid_vfacelibs-4.1.3-20231017.x86_64.rpm veridiumid_ADS-9.1.28-20231017.x86_64.rpm veridiumid_dmz-9.1.28-20231017.x86_64.rpm veridiumid_websec-9.1.28-20231017.x86_64.rpm veridiumid_websecadmin-9.1.28-20231017.x86_64.rpm veridiumid_statistics-9.1.28-20231017.x86_64.rpm veridiumid_fido-9.1.28-20231017.x86_64.rpm veridiumid_freeradius-9.1.28-20231017.x86_64.rpm veridiumid_selfservice-9.1.28-20231017.x86_64.rpm veridiumid_notifications-9.1.28-20231017.x86_64.rpm veridiumid_opa-9.1.28-20231017.x86_64.rpm
## PERSISTENCE
yum -y --disablerepo=* localinstall veridiumid_zookeeper-3.8.1-20231017.x86_64.rpm veridiumid_apache-cassandra-4.0.9-20231017.x86_64.rpm veridiumid_kafka-2.11-20231017.x86_64.rpm veridiumid_data-retention-9.1.28-20231017.x86_64.rpm

3) Ansible configuration

Download vid-ansible-8.2.7.zip, transfer over scp to Deployment Node and unzip in the deployment directory ( eg: /home/veridiumid directory)

After finishing the installation of the packages listed above on their designated nodes, connect on the Ansible node in order to start the configuration.

The following variable will be used during the following steps:

Where ANSIBLE_PATH=/home/veridiumid/vid_ansible

3.1) Create SSH for the veridiumid user

Login as the veridiumid user on the Ansible node and run the following command to generate a new SSH key:

ssh-keygen

After the key has been generated copy the value of /home/veridiumid/.ssh/id_rsa.pub and add it to the /home/veridiumid/.ssh/authorized_keys file on all other nodes.

Test the SSH connectivity between the Ansible node and all other nodes.

3.2) Setup environment hosts

The environment hosts file describes the structure of the deployment. In this file, for each Ansible role, the user provides the IP address(es) of the node(s).

Moreover, in order to work properly, the inventory file requires a Python executable path, that needs to be included in the environment hosts file.

For our deployment, the default path is: /usr/bin/python3 (provided by the VeridiumID Python package).

To configure this file, edit the following: $ANSIBLE_PATH/environments_hosts/inventory

For multi-node deployments, you will also need to alter the IP addresses in $ANSIBLE_PATH/environments_hosts/inventory using the guiding information already there.

3.3) Ansible configuration file

No changes should be done in this file.

Ansible configuration file ($ANSIBLE_PATH/ansible.cfg) contains the following variables:

3.4) Create the password file

In the list above we have set the value for vault_password_file. This file will be used for Ansible encryption functions of CA certificates.

To create this file, use the following command:

echo "PASSWORD" > $ANSIBLE_PATH/pass.txt

Where PASSWORD is a random password string selected for this installation.

3.5) Setup VeridiumID system configuration parameters

The default variable file used by Ansible is the following: $ANSIBLE_PATH/mandatory_vars.yml

*where red values from above should be updated with customer prefered values

3.6) HaProxy domain configuration

The Ansible role in charge of configuring HaProxy can add the client’s domain certificate during the configuration. To use an existing domain certificate please create the following directory path:

mkdir -p $ANSIBLE_PATH/group_files/DOMAIN_NAME

Where DOMAIN_NAME is the name of the client’s domain (and is the value set during the last step).

In this directory please copy the private key and public certificate extracted from the domain certificate. Please set a new line in privateKey.pem. publicCert.pem should not have an empty line at the end of it.

The files must have the following names:

• privateKey.pem

• publicCert.pem

To extract the private key and public certificate from a PKCS12 certificate please run the following commands:

openssl pkcs12 -in domain.p12 -nocerts -nodes -out privateKey.pem
openssl pkcs12 -in domain.p12 -nokeys -out publicCert.pem

3.7) Ansible connectivity check

To check the connectivity between the Ansible nodes and the other nodes run the following command from the $ANSIBLE_PATH directory:

ansible -i $ANSIBLE_PATH/environments_hosts/inventory all -m ping

4) Installation procedure

This section will provide the Ansible commands required to install VeridiumID.

4.1) Install procedure

veridiumid user should be allowed to have elevated privileges during the installation.

cd $ANSIBLE_PATH
./install_script.sh -e=@mandatory_vars.yml

 Logs can be found here:

$ANSIBLE_PATH/vid_ansible/logs

Recovery procedure for ansible configuration part:

Depending on the type of error, one of the following steps can be executed.

1. If the install_script.sh fails due to network issues, it can be executed once again and it will recover from the last failure point. ( the script can be execute with screen if installed on the OS.

2. If there is another issue, try to fix the error and rerun one more time (the script will try to install from the last failed step).

./install_script.sh -e=@mandatory_vars.yml 

1. If the error is due to a previous configuration step, try to do the recovery using steps 1, 2 & 3.

If you want to configure from scratch, do all the steps, (1,2,3)

1. remove file state.txt (the installation will be starting from the begging), logs folder, and some generated files from below:

rm -f $ANSIBLE_PATH/state.txt
rm -rf $ANSIBLE_PATH/logs
rm -f $ANSIBLE_PATH/group_files/dc1/*
sudo systemctl stop ver_* ##(on all nodes; do not execute this step at this moment, if you want to execute step2)

1. in some cases, if necessary, log in to Cassandra (persistence node) and run the below commands:

/opt/veridiumid/cassandra/bin/cqlsh --cqlshrc=/opt/veridiumid/cassandra/conf/veridiumid_cqlshrc --ssl -e 'drop keyspace veridium;'
####(even it received timeout, it should be deleted; check with the following command; the veridium keyspace should not exists)
/opt/veridiumid/cassandra/bin/cqlsh --cqlshrc=/opt/veridiumid/cassandra/conf/veridiumid_cqlshrc --ssl -e 'desc keyspaces;'

1. if necessary, if you want to regenerate CA, you should run (under node selected for CA in env hosts)

rm -rf /opt/veridiumid/CA