freedomofpress/securedrop — pull request #680 by dolanjs (2014-10-23 11:05:08+00:00)
Title: Authd tasks

Authd and agent_auth are the OSSEC processes for automating adding the OSSEC agent to the OSSEC server after installation. These task replace this part of the old documentation [1]

Authd is insecure and doesn't verify the agent by default. [2] It does support verifying a ca cert. We could add those tasks and have ansible distribute the ca cert to the agent prior to it running.

The sequence of events between the monitor server and app server does matter. Authd has to be running prior to the agent running agent_auth. After adding the agent the ossec agent on the app server needs to restart prior to the OSSEC server process on the monitor server.

[1] https://github.com/freedomofpress/securedrop/blob/develop/docs/install.md#add-ossec-agent
[2] http://ossec-docs.readthedocs.org/en/latest/programs/ossec-authd.html#ossec-authd