Security
Keystone runs arbitrary software on machines you cannot physically reach. The security model is therefore not decoration — this chapter is the part to read before a device leaves your desk.
What is locked down out of the box, and the one escape hatch.
How trust reaches the device, and how to set it up.
Why the agent refuses to listen on 0.0.0.0 without a token.
What ships alongside the binaries, and how to check it before you install.
Per-component user, capabilities and no_new_privileges — and how they are enforced.
Give each device its own MQTT identity, and keep it renewed. {class=“children children-type-flat children-sort-”}