Platform Installation

The QCecuring SSH KLM Platform is delivered as a unified Spring Boot application containing:

REST API
Web UI
SSH Key Correlation Engine
Policy & Governance Engine
Audit Layer
Agent Management Service

It runs as a single executable JAR.

SSH KLM dashboard

Prerequisites

Required

Java 21+
MongoDB

Optional (Production)

TLS certificates
Reverse proxy (NGINX / Load Balancer)
SMTP server (for reports & alerts)

Step 1 — Verify Java

java -version

Expected: Java 21 or higher.

Step 2 — Start Dependencies

Start MongoDB

docker run -d \
  --name ssh-klm-mongo \
  -p 27017:27017 \
  mongo:7

Step 3 — Run the Platform

Navigate to your JAR location:

cd installers

Start the application:

java -jar ssh-klm-0.0.1-SNAPSHOT.jar

You should see:

:: Spring Boot ::  (v3.x.x)
No active profile set, falling back to default profile: "dev"

SSH KLM launching bash

The application will start on:

http://localhost:8080

Profiles

The platform supports environment-based profiles.

Development Mode (default)

java -jar ssh-klm.jar

Uses:

Local MongoDB
Development security configuration
Relaxed agent validation

Production Mode

java -jar ssh-klm.jar --spring.profiles.active=prod

Or using environment variable:

export SPRING_PROFILES_ACTIVE=prod
java -jar ssh-klm.jar

Production mode enables:

Strict security policies
HSM enforcement
mTLS agent validation
Hardened configurations

Configuration via Environment Variables

Example:

.env settings

# ====================================
# SSH-KLM Platform - Environment Template
# ====================================

# ===============================
# Spring Profile
# ===============================
SPRING_PROFILES_ACTIVE=prod

# ===============================
# Server Configuration
# ===============================
SERVER_PORT=8080

# ===============================
# MongoDB Configuration (REQUIRED in production)
# ===============================
MONGODB_URI=mongodb://localhost:27017/ssh-klm-db

# ===============================
# JWT Configuration (REQUIRED in production)
# ===============================
# Generate a secure random key (min 256 bits):
# openssl rand -base64 32
JWT_SECRET=CHANGE_THIS_TO_A_LONG_RANDOM_STRING
JWT_EXPIRATION=1800000

# ===============================
# Agent & mTLS Configuration
# ===============================
MTLS_ENABLED=true
MTLS_DEV_AGENT_ID=dev-agent

# ===============================
# Email Configuration (Optional)
# ===============================
EMAIL_ENABLED=true
EMAIL_FROM=noreply@yourcompany.com
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_USERNAME=your-email@gmail.com
EMAIL_PASSWORD=your-app-password

# ===============================
# SSL/TLS Configuration (Optional HTTPS)
# ===============================
SERVER_SSL_ENABLED=false

# ===============================
# Reporting & Scheduling
# ===============================
REPORTING_ENABLED=true
SCHEDULING_ENABLED=true

# ===============================
# Swagger / OpenAPI
# ===============================
SWAGGER_ENABLED=false

And launching application

java -jar ssh-klm.jar --spring.profiles.active=prod

Health Check

Verify application health:

curl http://localhost:8080/actuator/health

Expected:

{
  "status": "UP"
}

Accessing the UI

Once started, open:

http://localhost:8080

The UI is served from the same application.

SSH KLM open ui

Production Deployment Pattern

Recommended:

Run behind a reverse proxy
Enable HTTPS
Enable mTLS for agents
Restrict MongoDB access
Configure firewall rules
Rotate JWT secret regularly
Monitor audit logs