alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Merge pull request #1 from mkkeffeler/mkkeffeler-docs

Browse source 
RHEL/CentOS Example
This commit is contained in:
Miclain K Keffeler 2020-06-03 08:58:25 -05:00 committed by GitHub
commit 2d45f61987
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 83 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

83
README.md
View file

@ -175,6 +175,89 @@ We are using the [Arch User Repository](https://aur.archlinux.org) to distribute
You can use [pacman](https://www.archlinux.org/pacman/) to install the packages.
#### RHEL/CentOS
There are a few subtle yet important things to getting this setup, at the time of this writing the package cannot be installed via yum (its a feature request). So this is how we setup this on RHEL following some best practices.
1. [Required] Install `step`.
Download the latest Linux package from
[`step` releases](https://github.com/smallstep/cli/releases):
```
$ wget -O step-cert.tar.gz https://github.com/smallstep/cli/releases/download/vX.Y.Z/step_linux_X.Y.Z_amd64.tar.gz
```
Install the Package by unzipping in bin:
```
$ tar -xf step.tar.gz
$ cd step-_X.Y.Z/bin/
$ mv step /usr/bin
```
2. Install `step-ca`.
Download the latest Linux package from [releases](https://github.com/smallstep/certificates/releases):
```
$ wget -O step-ca.tar.gz https://github.com/smallstep/cli/releases/download/vX.Y.Z/step_linux_X.Y.Z_amd64.tar.gz
```
Install the Package by unzipping in bin:
```
$ tar -xf step-ca.tar.gz
$ cd step-certificates_X.Y.Z/bin/
$ mv step-ca /usr/bin
```
3. Now your users can call the step and step-ca commands, create a 'smallstep' user that doesn't have login permitted and will only be used as a service user for systemctl to manage this service.
```
$ useradd smallstep
$ passwd -l smallstep
```
This creates a home directory for smallstep, as root sudo to the smallstep user, and perform the getting-started steps to setup the CA on this box as that user, we chose to put the password in a file in this example but you can mess with other solutions, we then made this systemctl service file
```
[Unit]
Description=Smallstep
After=syslog.target network.target
[Service]
User=smallstep
Group=smallstep
ExecStart=/bin/sh -c '/bin/step-ca /home/smallstep/.step/config/ca.json --password-file=/home/smallstep/.step/pwd >> /var/log/smallstep/output.log 2>&1'
Type=simple
Restart=on-failure
RestartSec=10
[Install]
WantedBy=multi-user.target
```
This also assumes you want logs going to a log file (we don't have a log rotation strategy at this time, perhaps the community can contribute :)
To setup this, perform the following
```
$ mkdir /var/log/smallstep
$ chown -R smallstep:smallstep /var/log/smallstep
```
Then do the following to startup the service.
```
$ systemctl status smallstep
$ systemctl enable smallstep (startup on reboot automatically)
$ systemctl start smallstep
```
If you have issues, you can debug by grabbing the execStart command from systemctl, sudo to smallstep, and start seeing what it is complaining about.
### Kubernetes
We publish [helm charts](https://hub.helm.sh/charts/smallstep/step-certificates) for easy installation on kubernetes: