https://carlosprados.github.io/keystone/security/index.htmlKeystone runs arbitrary software on machines you cannot physically reach. The security model is therefore not decoration — this chapter is the part to read before a device leaves your desk. Secure by default What is locked down out of the box, and the one escape hatch. Signing How trust reaches the device, and how to set it up. API authentication Why the agent refuses to listen on 0.0.0.0 without a token.Hugoenhttps://carlosprados.github.io/keystone/security/secure-defaults/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://carlosprados.github.io/keystone/security/secure-defaults/index.htmlWhat is locked down out of the box, and the one escape hatch.https://carlosprados.github.io/keystone/security/signing/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://carlosprados.github.io/keystone/security/signing/index.htmlHow trust reaches the device, and how to set it up.https://carlosprados.github.io/keystone/security/api-auth/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://carlosprados.github.io/keystone/security/api-auth/index.htmlWhy the agent refuses to listen on 0.0.0.0 without a token.https://carlosprados.github.io/keystone/security/releases/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://carlosprados.github.io/keystone/security/releases/index.htmlWhat ships alongside the binaries, and how to check it before you install.https://carlosprados.github.io/keystone/security/process-privileges/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://carlosprados.github.io/keystone/security/process-privileges/index.htmlPer-component user, capabilities and no_new_privileges — and how they are enforced.https://carlosprados.github.io/keystone/security/enrolment/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://carlosprados.github.io/keystone/security/enrolment/index.htmlGive each device its own MQTT identity, and keep it renewed.