Repo Configuration¶

Create a new repository¶

SA is designed to work with repositories (repos), which are folder structures following a certain layout. You can use a different repo for each class of hardware, such as 'workstations', 'servers', 'computerlabs', 'public', etc.

Each repo will have its own URL, database, and folder hierarchy. If multiple repos are necessary, symlinks can be used to reduce duplication for things like packages and installers.

In this section, we will create a new repository called 'workstations'.

Clone the source from github¶

I recommend using git to create the repos, this will make maintenance updates easier. Clone the SA source code into a folder called 'source', then be careful to not make any changes in the 'source' folder, so you can use git to pull code updates cleanly in the future.

TODO: Instructions to pull repo files here.

sudo mkdir -p /var/www/software/repo-workstations/source
cd /var/www/software/repo-workstations/source
[git clone instructions here]

Copy the template config files to your new repo¶

The source folder contains template config files which must be copied to the new repo.

cd /var/www/software/repo-workstations
cp -Rf source/repo_template/* .

We will update the new config files in the following sections.

Create a database for the repo¶

Each repo will have its own database. Here we will create the database, and give SA access to the new database.

sudo mysql -u root

# database name cannot have hyphens
CREATE DATABASE sa_workstations;

# Substitute the [username] below with the username you created for software assistant
USE mysql;
INSERT INTO db (
 Host, Db, User,
 Select_priv, Insert_priv, Update_priv, Delete_priv,
 Create_priv, Drop_priv, Grant_priv, References_priv,
 Index_priv, Alter_priv, Create_tmp_table_priv, Lock_tables_priv,
 Create_view_priv, Show_view_priv, Create_routine_priv, Alter_routine_priv,
 Execute_priv, Event_priv, Trigger_priv
) VALUES (
 'localhost','sa_workstations','[username]',
 'Y','Y','Y','Y',
 'Y','Y','N','N',
 'Y','Y','Y','Y',
 'Y','Y','Y','Y',
 'Y','Y','Y'
 );

# dont forget, apply the new changes
FLUSH PRIVILEGES;

Configure the repo to use the new database¶

Update the dbname, user, and pass in the config.phps file.

/var/www/software/repo-workstations/config.phps

    'db' => [
        'type'      => 'mysql',
        'host'      => 'localhost',
        'dbname'    => '[dbname]',
        'user'      => '[dbusername]',
        'pass'      => '[dbpassword]',
    ],

Create the certificate hierarchy¶

SA uses mutual TLS authentication, which requires both the SA client and the webserver to authenticate each other using X.509 certificates.

In this step, we will create a basic X.509 hierarchy with certificates to be used for the server, clients, admins, and provisioning scripts.

Copy these commands into a text editor, add the passwords as necessary, then run them on the server.

# only keep here long enough to run the commands, then remove passwords for security
ca_root_pass="[replace with 64 random characters]"
ca_inter_pass="[replace with 64 random characters]"

# Be sure all files are created in the root_ca folder
cd /var/www/software/repo-workstations/root_ca/

# ca_root cert, keep private key offline after finished creating hierarchy
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_ca_root "$ca_root_pass"

# create webserver certificate, CRL (needed for bundle), and bundle which is loaded into the server
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_client_cert "$ca_root_pass" webserver apache
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_crl "$ca_root_pass"
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_webserver_bundles

# create a client certificate for the admin's web browser
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_client_cert "$ca_root_pass" client admin1
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_client_cert_config

# add the admin's cert to the SA certificate authority (specify the admin cert on the command line, or run after the admin's cert was just created)
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_cert_tables
sudo /var/www/software/repo-workstations/source/php/caMgmt.php add_cert_to_ca_table ClientNonRenewable 0

# create sa_updater provisioning cert
[todo]

# create sa_client fallback cert (if needed)
[todo]

# intermediate cert, private key kept on this server, used to sign client certs
sudo /var/www/software/repo-workstations/source/php/caMgmt.php create_ca_intermediate "$ca_root_pass" "$ca_inter_pass" clientsigner