tpm2

Manage TPM2.0 devices

Project URL RSS Feed Report issues

Module Stats

7,882 downloads

153 latest version

4.8 quality score

Version information

released Mar 18th 2019

This version is compatible with:

Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2016.4.x
Puppet >= 4.10.4 < 6.0.0
, ,

Start using this module

Installation method

Add this module to your Puppetfile:

mod 'simp-tpm2', '0.1.1'

Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add simp-tpm2

Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install simp-tpm2 --version 0.1.1

Tags: simp, tpm, tpm20

Documentation

simp/tpm2 — version 0.1.1 Mar 18th 2019

Description
- This is a SIMP module
Setup
- What tpm2 affects
- Beginning with tpm2
Usage
Reference
Limitations
Development
- Acceptance tests
  - TPM2 simulator
  - Environment variables

Description

This module manages TPM 2.0 devices and the tpm2-tools software.

This is a SIMP module

This module is a component of the System Integrity Management Platform, a compliance-management framework built on Puppet.

If you find any issues, they may be submitted to our bug tracker.

This module is optimally designed for use within a larger SIMP ecosystem, but it can be used independently:

When included within the SIMP ecosystem, security compliance settings will be managed from the Puppet server.
If used independently, all SIMP-managed security subsystems are disabled by default and must be explicitly opted into by administrators. Please review the parameters in simp/simp_options for details.

Setup

What tpm2 affects

The tpm2 module manages:

tpm2-software packages and services (e.g., tpm2-tools, etc.,)
The tpm2 Facter fact
TODO: Ownership of a TPM2 device's endorsement hierarchy

Beginning with tpm2

include 'tpm2'

Usage

To set the authentication passwords on the system:

Include the tpm module and set the following in hiera:

Note: You must indicate the desired status of all three authentications settings. They can be either 'set' or 'clear'.

tpm2::take_ownership: true tpm2::ownership::owner: set tpm2::ownership::lock: set tpm2::ownership::endorsement: set

The passwords will default to automatically generated passwords using passgen. If you want to set them to specific passwords then set them in hiera using the following settings (it expects a minumum password length of 14 charaters):

tpm2::ownership::owner_auth: 'MyOwnerPassword' tpm2::ownership::lock_auth: 'MyLockPassword' tpm2::ownership::endorse_autt: 'MyEndorsePassword'

Limitations

The tpm2_takeownership module cannot be used to change the current password. It would continually try to reset the password and would lock out the TPM. It should be used to initialized or clear the TPM only.

SIMP Puppet modules are generally intended for use on Red Hat Enterprise Linux and compatible distributions, such as CentOS. Please see the metadata.json file for the most up-to-date list of supported operating systems, Puppet versions, and module dependencies.

Reference

See REFERENCE.md for API documentation.

Development

Please read our Contribution Guide.

Acceptance tests

This module includes Beaker acceptance tests using the SIMP Beaker Helpers. By default the tests use Vagrant with VirtualBox as a back-end; Vagrant and VirtualBox must both be installed to run these tests without modification. To execute the tests run the following:

bundle install
bundle exec rake beaker:suites

TPM2 simulator

The acceptance tests spin up a tpm2-simulator. To our knowledge this has not been packaged for EL7, so a package has been provided as an RPM, currently hosted at https://github.com/op-ct/simp-tpm2-rpms/releases.

Environment variables

BEAKER_download_pre_suite_rpms When 'yes', downloads a tarball of RPMs to install before running the first Beaker suite
BEAKER_tpm2_rpms_tarball_url

FIXME: Ensure the Acceptance tests section is correct and complete, including any module-specific instructions, and remove this message!

Please refer to the SIMP Beaker Helpers documentation for more information.

Types in this module release

tpm2_ownership

A type to manage ownership of a TPM 2.0.

Use this to set the passwords on a TPM to prevent unauthorized access.

It can not change the passwords.

Example:

include 'tpm'

tpm2_ownership { 'tpm2': owner => set, lockout => set, endorsement => set, owner_auth => 'badpass', lockout_auth => 'badpass', endorsement_auth => 'badpass', }

Parameters
endorsement_auth	The endorse password of the TPM
in_hex	Whether or not the passwords are in hex
local	Whether to save the passwords on the local system
lockout_auth	The lock out password of the TPM
name	A static name assigned to this type. You can only declare this type of resource once in your node scope
owner_auth	The owner password of the TPM
provider

Properties
endorsement	Seting for owner authorization
lockout	Seting for owner authorization
owner	Seting for owner authorization

Providers
tpm2tools	tpm2tools providers uses the TCG software stack and commands provided by tpm2-tools rpm to set the authentication tokens for the tpm if it is a version 2 tpm. `@author SIMP Team https://simp-project.com`

tpm2 - Manage TPM2.0 devices

Per Section 105 of the Copyright Act of 1976, these works are not entitled to
domestic copyright protection under US Federal law.

The US Government retains the right to pursue copyright protections outside of
the United States.

The United States Government has unlimited rights in this software and all
derivatives thereof, pursuant to the contracts under which it was developed and
the License under which it falls.

---

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

Modules

Discover

Contribute

Resources

About Forge

Getting Started