124 lines
4.3 KiB
Markdown
124 lines
4.3 KiB
Markdown
# Starting NFD on macOS
|
|
|
|
macOS provides a standard way to start system daemons, monitor their health, and restart
|
|
them when they die.
|
|
|
|
## Initial setup
|
|
|
|
Edit `net.named-data.nfd.plist` as needed, adjusting the paths for the `nfd` binary,
|
|
configuration, and log files.
|
|
|
|
# Copy launchd.plist for NFD
|
|
sudo cp net.named-data.nfd.plist /Library/LaunchDaemons/
|
|
sudo chown root /Library/LaunchDaemons/net.named-data.nfd.plist
|
|
|
|
### Assumptions in the default scripts
|
|
|
|
* `nfd` is installed into `/usr/local/bin`
|
|
* Configuration file is `/usr/local/etc/ndn/nfd.conf`
|
|
* `nfd` will be run as root
|
|
* Log files will be written to `/usr/local/var/log/ndn` folder, which is owned by user `ndn`
|
|
|
|
### Creating users
|
|
|
|
If `ndn` user does not exists, it needs to be manually created (procedure copied from
|
|
[macports script](https://trac.macports.org/browser/trunk/base/src/port1.0/portutil.tcl)).
|
|
Update uid/gid if 6363 is already used.
|
|
|
|
# Create user `ndn`
|
|
sudo dscl . -create /Users/ndn UniqueID 6363
|
|
|
|
# These are implicitly added on Mac OSX Lion. AuthenticationAuthority
|
|
# causes the user to be visible in the Users & Groups Preference Pane,
|
|
# and the others are just noise, so delete them.
|
|
# https://trac.macports.org/ticket/30168
|
|
sudo dscl . -delete /Users/ndn AuthenticationAuthority
|
|
sudo dscl . -delete /Users/ndn PasswordPolicyOptions
|
|
sudo dscl . -delete /Users/ndn dsAttrTypeNative:KerberosKeys
|
|
sudo dscl . -delete /Users/ndn dsAttrTypeNative:ShadowHashData
|
|
|
|
sudo dscl . -create /Users/ndn RealName "NDN User"
|
|
sudo dscl . -create /Users/ndn Password "{*}"
|
|
sudo dscl . -create /Users/ndn PrimaryGroupID 6363
|
|
sudo dscl . -create /Users/ndn NFSHomeDirectory /var/empty
|
|
sudo dscl . -create /Users/ndn UserShell /usr/bin/false
|
|
|
|
# Create group `ndn`
|
|
sudo dscl . -create /Groupsndn Password "{*}"
|
|
sudo dscl . -create /Groups/ndn RealName "NDN User"
|
|
sudo dscl . -create /Groups/ndn PrimaryGroupID 6363
|
|
|
|
### Creating folders
|
|
|
|
Folder `/usr/local/var/log/ndn` should be created and assigned proper user and group:
|
|
|
|
sudo mkdir -p /usr/local/var/log/ndn
|
|
sudo chown -R ndn:ndn /usr/local/var/log/ndn
|
|
|
|
`HOME` directory for `nfd` should be created and configured with correct library's config file
|
|
and contain proper NDN security credentials for signing Data packets. This is necessary since
|
|
the default private key storage on macOS (`tpm-osxkeychain`) does not support non-interactive
|
|
access, and file-based private key storage needs to be used:
|
|
|
|
# Create HOME and generate self-signed NDN certificate for nfd
|
|
sudo -s -- ' \
|
|
mkdir -p /usr/local/var/lib/ndn/nfd/.ndn; \
|
|
export HOME=/usr/local/var/lib/ndn/nfd; \
|
|
echo tpm=tpm-file > /usr/local/var/lib/ndn/nfd/.ndn/client.conf; \
|
|
ndnsec key-gen /localhost/daemons/nfd | ndnsec cert-install -; \
|
|
'
|
|
|
|
### Configuring NFD's security
|
|
|
|
NFD sample configuration allows anybody to create faces, add nexthops to FIB, and set strategy
|
|
choice for namespaces. While such settings could be a good start, it is generally not a good
|
|
idea to run NFD in this mode.
|
|
|
|
While thorough discussion about security configuration of NFD is outside the scope of this
|
|
document, at least the following change should be done to nfd.conf in authorize section:
|
|
|
|
authorizations
|
|
{
|
|
authorize
|
|
{
|
|
certfile certs/localhost_daemons_nfd.ndncert
|
|
privileges
|
|
{
|
|
faces
|
|
fib
|
|
strategy-choice
|
|
}
|
|
}
|
|
|
|
authorize
|
|
{
|
|
certfile any
|
|
privileges
|
|
{
|
|
faces
|
|
strategy-choice
|
|
}
|
|
}
|
|
}
|
|
|
|
While this configuration still allows management of faces and updating strategy choice by
|
|
anybody, only NFD's RIB Manager (i.e., NFD itself) is allowed to manage FIB.
|
|
|
|
As the final step to make this configuration work, NFD's self-signed certificate needs to
|
|
be exported into `localhost_daemons_nfd.ndncert` file:
|
|
|
|
sudo -s -- '\
|
|
mkdir -p /usr/local/etc/ndn/certs || true; \
|
|
export HOME=/usr/local/var/lib/ndn/nfd; \
|
|
ndnsec cert-dump -i /localhost/daemons/nfd > \
|
|
/usr/local/etc/ndn/certs/localhost_daemons_nfd.ndncert; \
|
|
'
|
|
|
|
## Enable auto-start
|
|
|
|
sudo launchctl load -w /Library/LaunchDaemons/net.named-data.nfd.plist
|
|
|
|
## Disable auto-start
|
|
|
|
sudo launchctl unload -w /Library/LaunchDaemons/net.named-data.nfd.plist
|