Deploy Device Protection in Golden Images

If you build your own Linux images with Packer, or any other image pipeline, install Device Protection during the build. Every machine created from the image is then protected from its first boot, with no install step at runtime.

Read Install Device Protection for Linux first for the token, the packages, and the install options that every method uses. The Linux Rollout Reference covers the rest: token handling, reboots, repeat runs, and device identity.

Install during the build

variable "aikido_token" {
  type      = string
  sensitive = true
}

build {
  sources = ["source.amazon-ebs.workstation"]

  provisioner "shell" {
    environment_vars = [
      "AIKIDO_TOKEN=${var.aikido_token}",
    ]
    inline = [
      "curl -fsSLo /tmp/aikido.deb https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.deb",
      "sudo AIKIDO_TOKEN=\"$AIKIDO_TOKEN\" apt-get install -y /tmp/aikido.deb",
      "rm -f /tmp/aikido.deb",
      "systemctl is-enabled aikido-endpoint-protection",
      "sudo truncate -s 0 /etc/machine-id",
    ]
  }
}

Nothing has to be deferred to first boot: the package registers the device during the build. Three things in that build are worth knowing about:

• Pass the token in from your secret store rather than a .pkrvars.hcl file, for example PKR_VAR_aikido_token=$(...) packer build .. Marking the variable sensitive keeps it out of Packer's output. See Keep the token out of logs and state.
• systemctl is-enabled fails the build if the service did not get enabled, which is the check you want. A broken image is much more expensive to find later.
• truncate -s 0 /etc/machine-id comes last, so systemd writes a fresh ID on each machine's first boot. This one is not optional: machines that share a machine ID share a single entry in your device list. See How devices are identified.

One image, one user group

The token selects the Aikido user group the device joins, so a baked image belongs to one user group. If one image has to serve several groups, keep the token out of it and stage only the package file:

provisioner "shell" {
  inline = [
    "sudo mkdir -p /var/cache/aikido",
    "sudo curl -fsSLo /var/cache/aikido/EndpointProtection-amd64.deb https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.deb",
  ]
}

Then install from the staged file on first boot, with the token of the group that machine belongs to:

#cloud-config
runcmd:
  - AIKIDO_TOKEN=<your-token> apt-get install -y /var/cache/aikido/EndpointProtection-amd64.deb

First boot then needs no network access to GitHub. See cloud-init for the rest of that document.

Verify the rollout

Boot one machine from the finished image and check:

cat /etc/machine-id
systemctl is-active aikido-endpoint-protection
aikidoctl version

Boot a second machine from the same image and confirm the two machine IDs differ, and that both appear in your device list with an Active status.

Images pin whatever version was current at build time, so rebuild on your normal image cadence and upgrade machines already running from an older image by installing the newer package over it.

Troubleshooting