zorin-trust-center-linux
Linux integration for Zorin Trust Core, Zorin Ops and Zorin Authority. The normal infrastructure UI remains Zorin Ops; desktop integration exposes trust state and optional OS authentication hooks.
The Host Agent drives two systemd --user targets: zorin-trust-device.target for cryptographic device trust and zorin-trust-owner.target for current owner presence. The GNOME panel item remains a compact status/launcher.
0.10 — portable owner session
Заголовок раздела «0.10 — portable owner session»The bundle includes 9-START-PORTABLE.sh. It runs the same Host Agent binary in an ephemeral direct-LAN mode without installing systemd units, modifying the normal desktop identity or writing a persistent portable host key.
The script requests a short-lived owner-proof.json after the phone explicitly approves the temporary workstation. Native USB is not part of 0.10; both devices must currently share a private/link-local IPv4 network.
- Host Agent policy v7 can require explicit approval at the policy layer instead of trusting every client to request it correctly.
- Zorin Access Broker 0.2 adds a PAM bridge for local Linux authentication and
sudo. - PAM verification uses a root-owned trusted-phone registry and verifies the returned
ZOWNER/1signature again outside the user-owned Host Agent process. - Privileged PAM enrollment requires an explicit phone approval plus a fingerprint copied by the owner before the root trust anchor is written.
- The default integration is
auth sufficient: successful phone approval can satisfysudo, while an unavailable/denied phone falls through to the normal password stack. - PAM integration is opt-in and is not enabled by the normal desktop installer.
Enable sudo approval
Заголовок раздела «Enable sudo approval»Install/pair the normal Linux bundle first, then run the release helper:
sudo ./7-INSTALL-PAM-SUDO.shThe installer backs up /etc/pam.d/sudo, installs a root-owned helper under /usr/local/libexec, and asks you to compare/paste the phone fingerprint before enrolling the privileged trust anchor.
To remove the hook:
sudo ./8-UNINSTALL-PAM-SUDO.shThe root trust registry is intentionally preserved during uninstall so a later reinstall does not silently replace the enrolled phone identity.
Existing 0.8 infrastructure flow
Заголовок раздела «Existing 0.8 infrastructure flow»Use existing SSH for initial Node/CA bootstrap, then switch a server to Zorin short-lived certificate mode. Node and SSH CA behavior from 0.8 remains compatible.