Conflicting Instructions - systemd config for tang

Latest response

On this RHEL 8 documentation page:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/system_design_guide/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_system-design-guide

Step 5 for setting up the tang server suggests editing the the port number of tang in this file:

/etc/systemd/system/multi-user.target.wants/tangd.socket

However, by default, that is just a symlink back to the /usr/lib version of tangd.socket and may be overwritten by future RPM updates. The systemd documention says to copy this to /etc/systemd/system and then edit it and do a systemctl reenable .

Even other parts of the RHEL 8 documentation agree that this will be potentially override by normal patching and suggest (section 3.5.4) copying the /usr/lib/systemd/system/ version to /etc/systemd/system/, then doing a reenable and daemon-reload.

Ref: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_basic_system_settings/managing-services-with-systemd_configuring-basic-system-settings#Managing_Services_with_systemd-Extending_Unit_Config

Please fix this documentation as this might cause critical production outages.

Responses