tiCrypt 2.18.3

Components

tiCrypt ships as a set of RPM packages from the tiCrypt repository. This page is the reference for what each one is. Every package listed here is in the repository and installable; the Version Guide shows the version and release date of each.

Package names are lowercase

Every package name is lowercase and hyphenated: ticrypt-sftp, not tiCrypt-SFTP. tiAudit is the single exception, and it is camelCase in the repository. Use the exact name when installing, since dnf is case-sensitive.

Two names are easy to get wrong: ticrypt-driveimport has no hyphen before import, and ticrypt-vmhost has none before host, while ticrypt-vmc-manager does.

Backend

The backend is a modular set of ten services that communicate over TCP, so they can be distributed across hosts. Install the metapackage and you get all of them.

ticrypt-backend

The metapackage for the whole backend. Installing it pulls the ten services below along with ticrypt-common, which is what makes an upgrade a single command.

sudo dnf install ticrypt-backend

Java 21 from backend 3.15.0

Since 3.15.0 the backend runs on Java 21; earlier versions ran on Java 8 (1.8). The packages now depend on java-21-openjdk-headless, so dnf installs Java 21 during the upgrade. It does not remove Java 8 or edit your JVM options, and the services fail to start if /usr/bin/java still points at Java 8 or a JVM option Java 21 rejects is still set.

Critical: you must uninstall Java 8 (1.8)

Once the backend is on 3.15.0 or later, nothing in tiCrypt uses Java 8. Leaving it installed keeps it selectable as the system java, and every backend service fails to start whenever /usr/bin/java points at it. Uninstall Java 8 on every backend host after the upgrade, never before: backend packages older than 3.15.0 depend on Java 8, so removing it first makes dnf remove the backend too.

Work through these steps on each backend host after the upgrade, before restarting the services.

1. Remove the old ticrypt-backup and ticrypt-storage packages. Both services were retired in 3.9.9, but an upgrade does not uninstall them, so a host that once ran 3.9.8 or earlier still has them, and their service may still be running on Java 8. Both depend on Java 8, so dnf refuses to remove Java 8 while they are installed, with an error such as package ticrypt-backup-3.9.8-1.el.noarch from @System requires java-1.8.0-openjdk-headless. Nothing in the current backend uses either service. List every package that still needs Java 8:

   rpm -q --whatrequires java-1.8.0-openjdk-headless

   For each ticrypt-backup or ticrypt-storage it lists, stop and disable the service yourself, because the 3.9.8 package does not stop it when removed, then remove the package. Check that the list dnf shows contains only those packages before you confirm.

   sudo systemctl disable --now ticrypt-backup ticrypt-storage
   sudo dnf remove ticrypt-backup ticrypt-storage
   sudo systemctl daemon-reload

   Leave out whichever of the two is not installed. The removal leaves their configuration files and data in place; they have no effect and can be deleted later. If the list names anything else, something else on the host still needs Java 8, so resolve that before the next step.

2. Uninstall Java 8. List the Java 8 packages, then remove them. dnf shows everything it is about to remove and asks for confirmation.

   rpm -qa 'java-1.8.0*'
   sudo dnf remove 'java-1.8.0-openjdk*'

3. Check the default java. Every service starts with /usr/bin/java, which points at whichever Java the system alternatives setting selects. With Java 8 gone it should select Java 21. Check the version, and if it does not report 21, select Java 21:

   java -version
   sudo alternatives --config java

4. Remove the JVM options Java 21 rejects. Each service passes the contents of /etc/ticrypt/<service>.jvmopts to Java as startup options. Java 21 refuses to start with an option that only Java 8 knew, and the service log shows Unrecognized VM option followed by Could not create the Java Virtual Machine. Two sources put such options in these files:

   • tiCrypt's own files. They have shipped with -XX:MaxPermSize=512m, and the 3.15.0 packages still ship it. An upgrade also keeps any copy you have edited.
   • Your own tuning. Options added at your site for Java 8 garbage collection or logging, such as -XX:+UseConcMarkSweepGC, -XX:+CMSClassUnloadingEnabled, -XX:+UseParNewGC, -XX:+PrintGCDateStamps or -XX:+UseGCLogFileRotation. These differ per service, so only the services whose files were edited fail.

   Ask Java 21 to check each file without starting anything. Every line this prints names an option to remove:

   for f in /etc/ticrypt/*.jvmopts; do
     echo "== $f"
     java $(cat "$f") -version 2>&1 |
       grep -iE 'unrecognized|could not|ignoring'
   done

   Look at the matching lines before deleting them, because the command below deletes whole lines, including any other option on the same line. Then remove them, keeping a .bak copy of each file, and run the check again until it prints only the file names. Keep your other settings, such as a larger -Xmx; Java 21 accepts them.

   P='PermSize|CMS|ConcMarkSweep|ParNew|PrintGCDateStamps|GCLogFileRotation'
   grep -n -E "$P" /etc/ticrypt/*.jvmopts
   sudo sed -i.bak -E "/$P/d" /etc/ticrypt/*.jvmopts

   If the check lists an option this pattern does not cover, delete that line by hand.

5. Restart the backend services. A service that failed to start several times in a row is held back by systemd (Start request repeated too quickly), so clear that first. Then confirm none of the services failed.

   sudo systemctl reset-failed 'ticrypt-*'
   sudo systemctl restart ticrypt-auth ticrypt-rest ticrypt-file-manager \
     ticrypt-batch ticrypt-vm ticrypt-proxy ticrypt-logger \
     ticrypt-stats ticrypt-notifications ticrypt-maintenance
   systemctl --failed | grep ticrypt

   If a service still fails, read its log with journalctl -u <service> -n 30 --no-pager. An Unrecognized VM option there that the check in step 4 did not show is set outside the .jvmopts file; grep -rn <option> /usr/libexec/ticrypt/ /etc/systemd/system/ticrypt-* finds it.

The ten services

Each has its own configuration file in /etc/ticrypt/. Configuration is covered in Backend Services.

Package	What it does
ticrypt-auth	Authentication, authorization, and user management. Manages users, groups and sessions, and supervises the other services
ticrypt-rest	The REST interface. Exposes the system over HTTP, validates client payloads. See the REST API
ticrypt-file-manager	Encrypted file and directory operations. Tracks file metadata and chunked storage
ticrypt-batch	Slurm batch integration. Coordinates jobs between Global Slurm and ticrypt-host-controller
ticrypt-vm	VM and drive lifecycle: creation, scheduling, cost functions, realm coordination
ticrypt-proxy	Proxies network connections from outside into running VMs
ticrypt-logger	Centralized logging. Records actions performed by the other services, with file and TCP output
ticrypt-stats	Collects operational statistics and usage metrics
ticrypt-notifications	Historical and real-time notification delivery
ticrypt-maintenance	Automated maintenance, including disabling inactive accounts

ticrypt-common

Shared files and requirements: creates the service accounts and common prerequisites every backend service depends on. Pulled automatically by each of the ten, so it is rarely installed directly.

Data ingress

Both ingress services are deployed outside the secure perimeter, with a one-way path to ticrypt-rest and no access to the internal network or compute nodes.

ticrypt-sftp

The SFTP frontend. Accepts data transfers into tiCrypt over SFTP on port 2020 (the shipped [sftp] listen_port) for the SFTP Inboxes that users create. It only receives files; sending files out over SFTP goes to External SFTP Servers that a Super-admin allowlists.

sudo dnf install ticrypt-sftp

Configured through /etc/ticrypt/ticrypt-sftp.toml. See SFTP Inbox Configuration.

ticrypt-mailbox

The mailbox server. Gives external collaborators a web form to submit files without an account. Uploads are encrypted on arrival with the recipient's public key, so only the recipient can decrypt them. Needs its own Nginx virtual host and TLS certificate. See Inboxes.

sudo dnf install ticrypt-mailbox

The page senders open, the inbox upload page, is not part of this package. It is downloaded and updated separately; see Install or update the inbox upload page.

Compute and VM hosts

ticrypt-host-controller

Runs on each compute node. Coordinates Slurm jobs on that node: it starts a secure VM for each allocated job and notifies the backend so the VM can be handed to the VM Controller for provisioning. Maintains the local job-tracking database.

sudo dnf install ticrypt-host-controller

ticrypt-vmhost

Tools for configuring and deploying tiCrypt VM hosts.

sudo dnf install ticrypt-vmhost

ticrypt-vm-controller

The VM Controller orchestration service: downloads, verifies, executes and restarts the VM Controller software that runs inside VMs.

Install from the VM Installer channel only

Do not install this package with dnf. The VM Controller is distributed exclusively through the VM Installer channel, which is what the Version Guide tracks.

A copy exists in the RPM repository, but it is not the distribution path and will lag behind the installer. Installing it from dnf gives you an older VM Controller than your deployment expects.

ticrypt-vmc-manager

A utility for managing VM Controller deployments across hosts.

sudo dnf install ticrypt-vmc-manager

Network control

These govern what running VMs can reach. Unless a specific IP-and-port mapping is configured, all outbound VM traffic stays blocked.

ticrypt-allowedlist

Restricts VM internet access by manipulating firewall rules and DNS replies on the backend host, allowing traffic only to configured external licensing servers. Configuration requires Super-Admin authorization.

sudo dnf install ticrypt-allowedlist

ticrypt-allowedlist-ipset

The raw ipset variant of the same service, for deployments driving iptables through ipset directly. Ships at the same version as ticrypt-allowedlist. Install one or the other, not both.

sudo dnf install ticrypt-allowedlist-ipset

ticrypt-nft

The nftables bridge, manipulating nftables rules for tiCrypt VMs, proxies and licensing servers. The nftables-based alternative to the iptables approach above.

sudo dnf install ticrypt-nft

Audit

tiAudit

The tiCrypt log viewer and auditing tool. Extracts information from tiCrypt's secure logs, generates reports, and can forward entries to a SIEM. See Audit.

The package name is camelCase, unlike every other package here. The binaries and configuration it installs are lowercase: /usr/sbin/tiaudit, /etc/tiaudit/.

sudo dnf install tiAudit

The package ships three binaries: tiaudit (the interface and reporting engine), tiaudit-logger (listens on TCP port 25000 for log entries pushed from the backend and stores them in ClickHouse), and tiaudit-log-uploader (backfills historical logs during deployment or recovery). These are programs within the one package, not separate packages.

Utilities

ticrypt-driveimport

Supports the External Drive Builder workflow: an administrator populates a drive outside tiCrypt, seals it with a manifest that encrypts it and binds mount rights to a named user, then imports it. Built for migrations of 5 TB and larger.

sudo dnf install ticrypt-driveimport

Not RPM packages

Two components appear in tiCrypt documentation but are not packages in this repository:

Component	What it is
ticrypt-setup	The Ansible installer, and the only supported deployment method. Distributed separately. See the Install Guide
ticrypt-host-manager	Bridges the Global Slurm scheduler and the backend for batch processing. Not currently published to the RPM repository

The tiCrypt Frontend and the Connect application are also delivered through their own channels and are tracked on the Version Guide.