Deploy Device Protection with Chef

Use a Chef cookbook to install Device Protection on the Linux machines your Chef Infra Client already manages. The recipe below picks the right package per platform, installs it with your user group token, and keeps the service running on every converge.

Read Install Device Protection for Linux first for the token, the packages, and the install options that every method uses. The Linux Rollout Reference covers the rest: token handling, reboots, repeat runs, and device identity.

Cookbook layout

cookbooks/aikido_device_protection/
├── attributes/default.rb
├── metadata.rb
└── recipes/default.rb

Set up the cookbook

1. 1

   Add the attributes

   default['aikido']['release_url'] =
     'https://github.com/AikidoSec/safechain-internals/releases/latest/download'
   
   # Reboot after installing. Off by default, see step 3.
   default['aikido']['reboot'] = false

2. 2

   Store the token in an encrypted data bag

   Create a data bag item holding the token for the user group these nodes belong to:

   knife data bag create aikido device_protection --secret-file /path/to/encrypted_data_bag_secret

   data_bag_item decrypts it on the node using the secret at Chef::Config[:encrypted_data_bag_secret]. If you use Chef Vault instead, swap the lookup for chef_vault_item('aikido', 'device_protection')['token'].

3. 3

   Add the recipe

   arch = node['kernel']['machine'] == 'aarch64' ? 'arm64' : 'amd64'
   
   case node['platform_family']
   when 'debian'
     package_file    = "EndpointProtection-#{arch}.deb"
     install_command = 'apt-get install -y'
     installed_check = "dpkg-query -W -f='${db:Status-Status}' aikido-endpoint-protection 2>/dev/null | grep -qx installed"
   when 'rhel'
     package_file    = "EndpointProtection-#{arch}.el#{node['platform_version'].to_i}.rpm"
     install_command = 'dnf install -y'
     installed_check = 'rpm -q aikido-endpoint-protection'
   else
     raise "Aikido Device Protection does not support #{node['platform_family']}"
   end
   
   package_path = "/var/cache/aikido/#{package_file}"
   
   directory '/var/cache/aikido' do
     owner 'root'
     group 'root'
     mode '0700'
   end
   
   remote_file package_path do
     source "#{node['aikido']['release_url']}/#{package_file}"
     owner 'root'
     mode '0600'
     not_if installed_check
   end
   
   execute 'install aikido-endpoint-protection' do
     command "#{install_command} #{package_path}"
     environment 'AIKIDO_TOKEN' => data_bag_item('aikido', 'device_protection')['token']
     sensitive true
     not_if installed_check
     notifies :request_reboot, 'reboot[activate aikido-endpoint-protection]', :delayed
   end
   
   service 'aikido-endpoint-protection' do
     action [:enable, :start]
   end
   
   reboot 'activate aikido-endpoint-protection' do
     action :nothing
     reason 'Activate Aikido Device Protection'
     delay_mins 5
     only_if { node['aikido']['reboot'] }
   end

   Three things in that recipe are worth knowing about:

   • The install is an execute resource because Chef's package resources cannot pass the AIKIDO_TOKEN the install needs.
   • not_if installed_check guards the download and the install, which also means it blocks upgrades. Remove it, or point release_url at a mirrored package, when you want the fleet to move.
   • node['aikido']['reboot'] is off by default so a converge never restarts a machine someone is working on. Turn it on for unattended nodes. See When protection becomes active.
4. 4

   Add it to the run list

   Put the recipe in the run list of the nodes you want protected, through a role, an environment, or a Policyfile:

   run_list 'recipe[aikido_device_protection]'

   The next converge on each node installs the agent. Roll out gradually by adding the recipe to one role first.

Verify the rollout

On a converged node:

systemctl is-active aikido-endpoint-protection
aikidoctl version

The device then appears in your device list with an Active status.

Troubleshooting