Skip to content

Requirements

Etminan is two binaries with deliberately different needs. A monitored host needs a TPM 2.0 and an IMA-capable Linux kernel; a verifier device needs neither — it only needs to reach the hosts it polls. This chapter is the pre-flight checklist for both.

The two roles never share a machine

The verifier's entire trust value comes from being administratively separate from the hosts it checks. Never run etminan-agent and etminan-verifier on the same box — a host compromise would then reach the judge as well as the judged.

flowchart TB
    subgraph mon["Monitored hosts — need a TPM + IMA"]
        a1["web-01<br/>etminan-agent"]
        a2["db-02<br/>etminan-agent"]
        a3["app-03<br/>etminan-agent"]
    end
    subgraph ver["Separate device — no TPM"]
        v["etminan-verifier<br/>polls hourly over mTLS"]
    end
    v -->|"quote request → quote + log delta"| a1
    v --> a2
    v --> a3
    style mon fill:#0f1c18,stroke:#1e332b,color:#e9efec
    style ver fill:#0f1c18,stroke:#7fd99a,color:#e9efec

Monitored host (etminan-agent)

Hardware and kernel

Requirement Detail
TPM 2.0 A TPM 2.0 device — discrete chip, firmware TPM, or a vTPM/swtpm on a VM. The agent uses the resource-managed device node /dev/tpmrm0, not the raw /dev/tpm0.
SHA-256 PCR bank Etminan uses the SHA-256 bank of PCR 10, exclusively and by design. A TPM that exposes only a non-SHA-256 bank is out of scope and cannot be enrolled.
IMA-capable kernel The kernel's Integrity Measurement Architecture must be built in, with securityfs mounted at /sys/kernel/security. The agent reads the per-bank log ascii_runtime_measurements_sha256.
CPU architecture x86_64 only. The agent links tpm2-tss (via tss-esapi) and is built natively for x86_64-unknown-linux-gnu; it does not cross-compile to musl.

The agent writes its own IMA policy

You do not hand-craft an IMA policy. The packaged etminan-agent-ima-policy.service runs etminan-agent write-ima-policy once, early at boot, before the daemon starts — no reboot, no manual securityfs editing. It writes exactly two rules:

measure func=BPRM_CHECK mask=MAY_EXEC
measure func=FILE_CHECK mask=MAY_READ fsuuid=<root-fs-uuid>

IMA has no path filter, so measurement is deliberately broad and paths are filtered on the verifier side. See Agent configuration.

Privileges and users

The agent runs as a narrowly-privileged, non-root user. The package sets this up for you:

  • A system user etminan-agent in the tss group — group membership is what grants access to /dev/tpmrm0.
  • AmbientCapabilities=CAP_DAC_READ_SEARCH on the systemd unit — the IMA measurement log is root:root 0440 by kernel design, and this is the narrowest capability that lets the non-root agent read it (also what event-triggered write detection runs under). No CAP_SYS_ADMIN, no root.

Network

Requirement Detail
Inbound The agent listens on 0.0.0.0:7620 by default (ETMINAN_AGENT_LISTEN) for quote requests from the verifier. Allow the verifier to reach that port.
Transport Every connection is mutual TLS, pinned by certificate fingerprint — there is no plaintext path. See Mutual TLS.
Outbound None required. The agent never phones home; it only answers the verifier.

Verifier device (etminan-verifier)

The verifier makes every trust decision, yet has the lighter list of requirements — quote verification is pure offline signature math.

Requirement Detail
No TPM The shipped verifier binary carries zero TPM-library dependency. It verifies quotes using only the enrolled host's exported AK public key.
A separate machine Independently administered from every monitored host. This separation is the security property; treat the verifier as your trust root.
Portable binary The verifier builds natively on Linux and macOS and cross-compiles cleanly to static musl. Packages are provided for the supported Linux distributions below; other platforms build from source.
Outbound network Reachability to each enrolled agent's host:port. No inbound service is required.
Local storage Room for its trust store: the SQLite baseline.db (approved/pending/rejected measurements + the hash-chained audit log), state.json (per-host enrollment), and its own TLS identity under /var/lib/etminan-verifier.

The verifier is the one catastrophic-loss host

The AK fingerprints, the whole approved baseline, and the entire audit history live only on the verifier. Plan its backup from day one — see Backup & restore.

Supported distributions

Packages are built per distribution for the agent (which must link the distro's tpm2-tss); the verifier is portable and rides the same packages.

Family Versions Package
Debian 12 (bookworm), 13 (trixie) .deb
Ubuntu LTS 22.04, 24.04 .deb
Enterprise Linux (Alma / Rocky / RHEL) 9, 10 .rpm

EL 8 is not supported

Enterprise Linux 8 is dropped: its tpm2-tss is too old for the agent to build against. Use EL 9 or 10.

Every release is GPG-signed with the Etminan Team key (7387 4214 090F 9137 862D 0AF1 E1E5 41B7 B424 36DF); always verify signatures before installing (the install chapters show how).

Next steps