Antitheft HowTo

This document outlines antitheft-related procedures.

Example scenarios

Upgrade and activate a set of XOs

To accomplish this, you need 3 machines in total.

• An XO acting as the Master Lease Signing Server (MLSS)
• An XS (can be XS-on-XO machine)
• An XO running as NANDBlast sender

as well as your master keys.

Steps

1. On the MLSS, create a lease.sig file with leases for all the XOs you will upgrade and activate.
2. On the XS, load the lease.sig file so that xs-activation can use it
3. On the NANDBlast machine, prepare to run nb-secure, as described in Multicast_NAND_FLASH_Update#NANDblasting_a_Signed_NAND_Image_File
4. Setup the XS and the NANDBlast machine in the "upgrade" room and commence the unpack/start process

B - XS-on-XO 'activador'

Baja la imágen para XS-on-XO que indiqué la semana pasada, instálala en un SD card como marcan las instrucciones. Con ese SD card pones a andar la máquina B.

Cuando arrancas la máquina B tienes que hacer la configuración inicial de dominio, como vimos cuando estuve en Managua, y reiniciarla.

Las activaciones que han creado en la máquina A, las pones en un disco USB, con el nombre 'lease.sig'. Cuando pones ese disco USB en la máquina B, la máquina las va a cargar automáticamente.

Como les mostré cuando estaba en Managua, puedes monitorear eso siguiendo el log /var/log/user.log --

C - XO 'emisor' NANDBlaster -- con un USB con la imagen a "emitir".

Procedures

Prepare an XO as the Master Lease Signing Server (MLSS)

This machine is only used to generate leases, devkeys or delegations. In other words, it is of occassional use, and should be kept in a secure place at all times.

1. Grab an XO, with the standard OS image. These notes are based on XO OS 8.2.1, but should work on future versions.
2. Install the latest olpc-bios-crypto package:
   1. Download the latest one from [1]
   2. Install it with rpm -ivh olpc-bios-crypto-(version).rpm
3. Make a new directory to store the master keys: mkdir /root/masterkeys
4. Copy the master keys into /root/masterkeys - you will normally have the files developer.private developer.public fs.private fs.public fw.private fw.public lease.private lease.public oats.private oats.public os.private os.public

1. - define which XOs / boxes will be sent to the school you are planning...
2. - open spreadsheet in OpenOffice Calc or similar
3. - find them in the spreadsheet
4. - make a new page in the existing spreadsheet - give that page the

name of the school

1. - copy/paste the SN/UUID region to the new page, remove the "extra"

columns we don't need. Also make sure you don't include the 'column headers' row.

1. - Save the document
2. - Make sure you are on the spreadsheet page for the right school
3. - Now use the "File->Save As..." menu option to create a new file.

The file format must be CSV. The file name must be the name of the school.

1. - Accept the defaults. OpenOffice will warn you that it is only

exporting the 'current page'. Perfect, that's _exactly_ what we want

-)

Bájate el RPM de olpc-bios-crypto que indiqué en el email anterior, instálalo en esta máquina. Copia las llaves "maestras" de Nicaragua a esta máquina.

En ésta máquina -- que hay que tener guardada bajo llave -- puedes generar las activaciones, usando la llave 'a1' y el archivo CSV, con el programa obc-make-lease-from-csv.sh .

Ésta máquina sólo la van a usar ocasionalmente para generar más activaciones. El resto del tiempo, bien guardada.