StellerSight Packages

Signed Linux package repositories from StellerSight Private Limited.

Package	What it is	Status
`suit-linux`	SUIT for Linux: a just-in-time broker for privileged commands, with approval, boot-bound expiry and a hash-chained audit trail.	0.2.0 beta 1, experimental
`priv-audit`	Read-only Linux privilege-boundary auditor: sudoers, SUID/SGID, file capabilities, permissions, cron, OpenSSH.	0.1.0, pre-release

Every repository is signed with the StellerSight package key:

StellerSight Packages <security@stellersight.com>
RSA 4096, fingerprint B03D 5600 7C15 758D FB2A  E4D9 4716 60C8 90D3 9DC9

Check the fingerprint after importing the key. Both tools need Python 3.8 or later as python3, so RHEL 8 and openSUSE Leap 15 (Python 3.6) are not supported.

Debian and Ubuntu (apt)

curl -fsSL https://packages.stellersight.com/stellersight.gpg | sudo tee /usr/share/keyrings/stellersight.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/stellersight.gpg] https://packages.stellersight.com/deb stable main" | sudo tee /etc/apt/sources.list.d/stellersight.list
sudo apt update
sudo apt install suit-linux priv-audit

RHEL, Rocky, AlmaLinux, Oracle Linux, Fedora, Amazon Linux 2023 (dnf / yum)

sudo curl -fsSL https://packages.stellersight.com/rpm/stellersight.repo -o /etc/yum.repos.d/stellersight.repo
sudo dnf install suit-linux priv-audit

openSUSE Tumbleweed and SLES (zypper)

sudo rpm --import https://packages.stellersight.com/stellersight.asc
sudo zypper addrepo --gpgcheck https://packages.stellersight.com/rpm stellersight
sudo zypper install suit-linux priv-audit

Alpine Linux (apk)

wget -qO /etc/apk/keys/stellersight.rsa.pub https://packages.stellersight.com/apk/stellersight.rsa.pub
echo "https://packages.stellersight.com/apk" >> /etc/apk/repositories
apk add suit-linux priv-audit

Arch Linux (pacman)

curl -fsSL https://packages.stellersight.com/stellersight.asc | sudo pacman-key --add -
sudo pacman-key --lsign-key B03D56007C15758DFB2AE4D9471660C890D39DC9
printf '[stellersight]\nSigLevel = Required\nServer = https://packages.stellersight.com/arch/$arch\n' | sudo tee -a /etc/pacman.conf
sudo pacman -Sy suit-linux priv-audit

After installing SUIT for Linux

The package installs an empty policy, so it grants nothing until you define it. Add actions to /etc/suit/profiles.json and users to /etc/suit/eligibility.json (examples in /usr/share/doc/suit-linux/), put requesters in suit-eligible and approvers in suit-approvers, then run suit doctor as root. Read the guarantees and their limits before relying on it.

Security

Report vulnerabilities privately to security@stellersight.com. Source, licences (Apache-2.0) and issue trackers are on github.com/stellersight.