=============
keylime-agent
=============
Presently, we rely upon a certain level of trust for users that leverage
baremetal resources. While we do perform cleaning between deployments,
a malicious attacker could potentially modify firmware of attached devices
in ways that may or may not be readily detectable.
The solution that has been proposed for this is the use of a measured launch
environments with engagement of Trusted Platform Management (TPM) modules to
help ensure that the running system profile is exactly as desired or approved,
by the attestation service.
To leverage TPM's for attestation, we propose Keylime,
an open source remote boot attestation and
runtime integrity measurement system. Keylime agent is a component of the
Keylime suite which runs on the baremetal node we are attesting
during cleaning and deployment steps. Keylime regisrar is
a database of all agents registered with Keylime
and hosts the public keys of the TPM vendors.
In order to enhance the ramdisk to support TPM 2.0 and Keylime,
this keylime-agent element is proposed. This element provides
configurations for Keylime agent to communicate with Keylime server.
Keylime agent runs as a system service to collect
Integrity Measurement Architecture (IMA) measurement lists and
send the measurements to the Keylime verifier for attestation.
Environment Variables
---------------------
DIB_KEYLIME_AGENT_REGISTRAR_IP
:Required: Yes
:Default: 0
:Description: The IP address of Keylime registrar server
which Keylime agent communicates with.
DIB_KEYLIME_AGENT_REGISTRAR_PORT
:Required: Yes
:Default: 8890
:Description: The port of Keylime registrar server
which Keylime agent communicates with.
**REFERENCES**
[1] github.com/keylime/
[2] review.opendev.org/c/openstack/ironic-specs/+/576718
