crunu status, renew and revoke-self

Three commands help you look after a machine or a service token: crunu status tells you what it can see right now, crunu renew extends its lease, and crunu revoke-self takes it out of service for good.

crunu status

crunu status [--json]

crunu status shows:

• who you are: a machine, a service token or a person;
• the organization, with the fingerprints of the machine and of the organization key;
• the lease and when it ends;
• each environment with its version and head numbers, how it's delivered and when it was last checked;
• the state of the machine service;
• environments that are granted but not available yet, for example because the key hasn't been delivered or the file copy is out of date.

On a machine whose service is stopped, it shows the enrollment and the last saved state.

Network restrictions show up as plain lines. An environment closed by a network rule appears as closed, with the address the server sees, for example 198.51.100.7. If the server couldn't determine the client address, the line says so and points to the server's TRUST_PROXY setting. An environment served from outside its allowed networks appears with the reason, a machine pass with its end time and the network it was issued from, or, for an owner, break-glass access. The server doesn't sign these network details. They only explain its decision and have no effect on how data is verified.

An environment whose data failed verification is listed under an alert, and the exit code is then 6. Its names come from the server and aren't confirmed by a signature.

--json prints an object with the fields token, machine and human, whichever apply, and exitCode. An environment with a network restriction has a network field with restricted, allowed, via (network, pass or break-glass), until, ip and passIp. A stateWriteError field means state.json can't be written and the last saved state is being served. The exit code is then 1.

crunu status --json

If enrollment didn't finish because the server's answer never arrived, crunu status says so, suggests running crunu enroll again with the same code, and exits with 3. On an enrolled machine it never returns 3.

Names and messages from the service and the server are printed only after control, invisible and text-direction characters are removed.

crunu renew

sudo crunu renew

crunu renew renews the lease now. The service already does this every 5 minutes, so you need it only when you want the lease extended right away.

On a machine it asks the service. If the service doesn't answer, it renews directly with the machine key, which needs access to the state directory, usually through sudo. The new end of the lease is written to state.json. If that write fails, the exit code is 1 even though the server already extended the lease.

With CRUNU_TOKEN set, it renews the lease of the service token. For a token, each sign-in also extends the lease, so a token stays alive as long as it is used more often than its lease duration.

crunu revoke-self

sudo crunu revoke-self --yes

crunu revoke-self takes a machine out of service. The server stops answering it for good. The local agent.key, state.json and identity.json are deleted, and the service wipes its environments from memory. Without a terminal you need --yes. If the machine was already revoked, the local files are deleted anyway.

With CRUNU_TOKEN set, the service token is revoked instead.

After revoking a machine, disable its service:

sudo systemctl disable --now crunu-agent

What else to do after a self-revocation

• Rotate the environment keys. The machine had keys to the environments delivered with the environment key. The web app marks those environments as needing rotation. See Rotate environment keys.
• Publish the revocation list. The machine can't add itself to the organization's signed revocation list, because only owners and admins hold the organization signing key. Until an owner or admin publishes the list, the machine shows up in Pending actions.
• Reissue values if needed. If the machine was compromised rather than retired, treat everything it received as exposed and reissue those values at their providers. The revocation stops new deliveries but can't take back what the machine already decrypted.

If a machine is compromised and you can't reach it, revoke it from the web app instead: Machines, the machine, Revoke…. See Machines and leases.