Package: custodia
CustodiaA tool for managing secrets.See ourQuick Start GuideCustodia is a project that aims to define an API for modern cloud
applications that allows to easily store and share passwords, tokens,
certificates and any other secret in a way that keeps data secure,
manageable and auditable.The Custodia project offers example implementations of clear text and
encrypted backends, and aims to soon provide drivers to store data in
external data stores like the Vault Project, OpenStack’s Barbican,
FreeIPA’s Vault and similar.In future the Custodia project plans to enhance and enrich the API to
provide access to even more secure means of dealing with private keys,
like HSM as a Service and other similar security systems.See the Custodia documentation for more information:https://custodia.readthedocs.ioRequirementsRuntimeconfigparser (Python 2.7)cryptographyjwcrypto >= 0.2requestssixTestingpipsetuptools >= 18.0tox >= 2.3.1wheelcustodia.ipa depends on several binary extensions and shared libraries
for e.g. python-cryptography, python-gssapi, python-ldap, and
python-nss. For testing and installation in a virtual environment, a C
compiler and several development packages are required.Fedora$ sudo dnf install python2 python-pip python-virtualenv python-devel \
    gcc redhat-rpm-config krb5-workstation krb5-devel libffi-devel \
    nss-devel openldap-devel cyrus-sasl-devel openssl-develDebian / Ubuntu$ sudo apt-get update
$ sudo apt-get install -y python2.7 python-pip python-virtualenv python-dev \
    gcc krb5-user libkrb5-dev libffi-dev libnss3-dev libldap2-dev \
    libsasl2-dev libssl-devAPI stabilitySome APIs are provisional and may change in the future.Command line interface in modulecustodia.cli.The script custodia-cli.custodia.ipapluginscustodia.ipa — IPA plugins for CustodiaWARNINGcustodia.ipa is a tech preview with a provisional API.custodia.ipa is a collection of plugins forCustodia. It provides integration
withFreeIPA. TheIPAVaultplugin is an
interface toFreeIPA
vault. Secrets are
encrypted and stored inDogtag’s Key
Recovery Agent. TheIPACertRequestplugin creates private key and
signed certificates on-demand. Finally theIPAInterfaceplugin is a
helper plugin that wraps ipalib and GSSAPI authentication.custodia.ipa requirementsipalib >= 4.5.0ipaclient >= 4.5.0Python 2.7 (Python 3 support in IPA vault is unstable.)ipalib and ipaclient are not pulled in and install by default. The
packages depend on additional OS packages for Kerberos/GSSAPI, LDAP and
NSS crypto library. The dependencies are listed undertestingrequirements above.$ pip install custodia[ipa]custodia.ipa requires an IPA-enrolled host and a Kerberos TGT for
authentication. It is recommended to provide credentials with a keytab
file or GSS-Proxy. FurthermoreIPAVaultdepends on Key Recovery Agent
service (ipa-kra-install).Example configurationCreate directories$ sudo mkdir /etc/custodia /var/lib/custodia /var/log/custodia /var/run/custodia
$ sudo chown USER:GROUP /var/lib/custodia /var/log/custodia /var/run/custodia
$ sudo chmod 750 /var/lib/custodia /var/log/custodiaCreate service account and keytab$ kinit admin
$ ipa service-add custodia/$HOSTNAME
$ ipa service-allow-create-keytab custodia/$HOSTNAME --users=admin
$ mkdir -p /etc/custodia
$ ipa-getkeytab -p custodia/$HOSTNAME -k /etc/custodia/ipa.keytab
$ chown custodia:custodia /etc/custodia/ipa.keytabThe IPA cert request plugin needs additional permissions$ ipa privilege-add \
    --desc="Create and request service certs with Custodia" \
    "Custodia Service Certs"
$ ipa privilege-add-permission \
    --permissions="Retrieve Certificates from the CA" \
    --permissions="Request Certificate" \
    --permissions="Revoke Certificate" \
    --permissions="System: Modify Services" \
    "Custodia Service Certs"
# for add_principal=True
$ ipa privilege-add-permission \
    --permissions="System: Add Services" \
    "Custodia Service Certs"
$ ipa role-add \
    --desc="Create and request service certs with Custodia" \
    "Custodia Service Cert Adminstrator"
$ ipa role-add-privilege \
    --privileges="Custodia Service Certs" \
    "Custodia Service Cert Adminstrator"
$ ipa role-add-member \
    --services="custodia/$HOSTNAME" \
    "Custodia Service Cert Adminstrator"Create/etc/custodia/ipa.conf# /etc/custodia/ipa.conf

[global]
debug = true
makedirs = true

[auth:ipa]
handler = IPAInterface
keytab = ${configdir}/${instance}.keytab
ccache = FILE:${rundir}/ccache

[auth:creds]
handler = SimpleCredsAuth
uid = root
gid = root

[authz:paths]
handler = SimplePathAuthz
paths = /. /secrets

[store:vault]
handler = IPAVault

[store:cert]
handler = IPACertRequest
backing_store = vault

[/]
handler = Root

[/secrets]
handler = Secrets
store = vault

[/secrets/certs]
handler = Secrets
store = certCreate/etc/systemd/system/custodia@ipa.service.d/override.confOn Fedora 26 and newer, the Custodia service file defaults to Python 3.
Although FreeIPA 4.5 has support for Python 3, it’s not stable yet.
Therefore it is necessary to run thecustodia.ipaplugins with
Python 2.7. You can either usesystemctl edit custodia@py2.serviceto create an override or copy the file manually. Don’t forget to runsystemctldaemon-reloadin the latter case.[Service]
ExecStart=
ExecStart=/usr/sbin/custodia-2 --instance=%i /etc/custodia/%i.confRun Custodia server$ systemctl start custodia@ipa.socketIPA cert requestTheIPACertRequeststore plugin generates or revokes certificates on
the fly. It uses a backing store to cache certs and private keys. The
plugin can create service principal automatically. However the host must
already exist. TheIPACertRequestdoes not create host entries on
demand.A request likeGET /path/to/store/HTTP/client1.ipa.examplegenerates
a private key and CSR for the serviceHTTP/client1.ipa.examplewith
DNS subject alternative nameclient1.ipa.example. The CSR is then
forwarded to IPA and signed by Dogtag. The resulting cert and its trust
chain is returned together with the private key as a PEM bundle.$ export CUSTODIA_INSTANCE=ipa
$ custodia-cli get /certs/HTTP/client1.ipa.example
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

Issuer: organizationName=IPA.EXAMPLE, commonName=Certificate Authority
Subject: organizationName=IPA.EXAMPLE, commonName=client1.ipa.example
Serial Number: 22
Validity:
    Not Before: 2017-04-27 09:44:20
    Not After: 2019-04-28 09:44:20
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Issuer: organizationName=IPA.EXAMPLE, commonName=Certificate Authority
Issuer: organizationName=IPA.EXAMPLE, commonName=Certificate Authority
Serial Number: 1
Validity:
    Not Before: 2017-04-26 08:24:11
    Not After: 2037-04-26 08:24:11
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----A DELETE request removes the cert/key pair from the backing store and
revokes the cert at the same time.Automatic renewal of revoked or expired certificates is not implemented
yet.FreeIPA 4.4 supportThe default settings and permissions are tuned for FreeIPA >= 4.5. For
4.4, the plugin must be configured withchain=False. The additional
permissionRequest Certificate with SubjectAltNameis required, too.ipa privilege-add-permission \
    --permissions="Request Certificate with SubjectAltName" \
    "Custodia Service Certs"