13 Storage encryption for hosted applications with cryptctl #

As root, run:

# cryptctl init-server

Answer each of the following prompts and press Enter after every answer. If there is a default answer, it is shown in square brackets at the end of the prompt.

1. Create a strong password, and protect it well. This password unlocks all partitions that are registered on the server.

2. Specify the path to a PEM-encoded TLS certificate or certificate chain file or leave the field empty to create a self-signed certificate. If you specify a path, use an absolute path.

3. If you want the server to be identified by a host name other than the default shown, specify a host name. cryptctl generates certificates which include the host name.

4. Specify the IP address that belongs to the network interface that you want to listen on for decryption requests from the clients, then set a port number (the default is port 3737).

   The default IP address setting, 0.0.0.0 means that cryptctl listens on all network interfaces for client requests using IPv4.

5. Specify a directory on the server that holds the decryption keys for clients.

6. Specify whether clients need to authenticate to the server using a TLS certificate. If you choose No, this means that clients authenticate using disk UUIDs. (However, communication is encrypted using the server certificate in any case.)

   If you choose Yes, pick a PEM-encoded certificate authority to use for signing client certificates.

7. Specify whether to use a KMIP 1.3-compatible server (or multiple such servers) to store encryption keys of clients. If you choose this option, provide the host names and ports for one or multiple KMIP-compatible servers.

   Additionally, provide a user name, password, a CA certificate for the KMIP server, and a client identity certificate for the cryptctl server.

   

   Important: No easy reconfiguration of KMIP setting

   The setting to use a KMIP server cannot easily be changed later. To change this setting, both the cryptctl server and its clients need to be configured afresh.

8. Finally, configure an SMTP server for e-mail notifications for encryption and decryption requests or leave the prompt empty to skip setting up e-mail notifications.

   

   Note: Password-protected servers

   cryptctl currently cannot send e-mail using authentication-protected SMTP servers. If that is necessary, set up a local SMTP proxy.

9. When asked whether to start the cryptctl server, enter y.

To check the status of the service cryptctl-server, use:

# systemctl status cryptctl-server

As root, run:

# cryptctl encrypt

Answer each of the following prompts and press Enter after every answer. If there is a default answer, it is shown in square brackets at the end of the prompt.

1. Specify the host name and port to connect to on the cryptctl server.

2. If you configured the server to have clients authenticate to it using a TLS certificate, specify a certificate and a key file for the client. The client certificate must be signed by the certificate authority chosen when setting up the server.

3. Specify the absolute path to the server certificate (the *.crt file).

4. Enter the encryption password that you specified when setting up the server.

5. Specify the path to the directory to encrypt. Specify the path to the empty partition that contains the encrypted content of the directory.

6. Specify the number of machines that are allowed to decrypt the partition simultaneously.

   Then specify the timeout in seconds before additional machines are allowed to decrypt the partition after the last vital sign was received from the client or clients.

   When a machine unexpectedly stops working and then reboots, it needs to be able to unlock its partitions again. That means this timeout should be set to a time slightly shorter than the reboot time of the client.

   

   Important: Timeout length

   If the time is set too long, the machine cannot decrypt encrypted partitions on the first try. cryptctl then continues to periodically check whether the encryption key has become available. However, this introduces a delay.

   If the timeout is set too short, machines with a copy of the encrypted partition have an increased chance of unlocking the partition first.

To start encryption, enter yes.

cryptctl encrypts the specified directory to the previously empty partition and then mounts the newly encrypted partition. The file system type is the same type as the original unencrypted file system.

Before creating the encrypted partition, cryptctl moves the unencrypted content of the original directory to a location prefixed with cryptctl-moved-.

To check that the directory is indeed mounted correctly, use:

> lsblk -o NAME,MOUNTPOINT,UUID
NAME                        MOUNTPOINT          UUID
[...]
sdc
└─sdc1                                          PARTITION_UUID
  └─cryptctl-unlocked-sdc1  /secret-partition   UNLOCKED_UUID

cryptctl identifies the encrypted partition by its UUID. For the previous example, that is the UUID displayed next to sdc1.

On the server, you can check whether the directory was decrypted using cryptctl.

# cryptctl list-keys

For a successfully decrypted partition, you see output like:

2019/06/06 15:50:00 ReloadDB: successfully loaded database of 1 records
Total: 1 records (date and time are in zone EDT)
Used By     When                 UUID  Max.Users  Num.Users  Mount Point
IP_ADDRESS  2019-06-06 15:00:50  UUID  1          1          /secret-partition

For a partition not decrypted successfully, you see output like:

2019/06/06 15:50:00 ReloadDB: successfully loaded database of 1 records
Total: 1 records (date and time are in zone EDT)
Used By      When                 UUID  Max.Users  Num.Users  Mount Point
             2019-06-06 15:00:50  UUID  1          1          /secret-partition

See the difference in the empty Used by column.

Verify that the UUID shown is that of the previously encrypted partition.

After verifying that the encrypted partition works, delete the unencrypted content from the client. For example, use rm. For more safety, overwrite the content of the files before deleting them, for example, using shred -u.

Important: shred does not guarantee that data is erased

Depending on the type of storage media, using shred is not a guarantee that all data is removed. In particular, SSDs employ wear leveling strategies that render shred ineffective.

Log in to Node1 as root.

Set up a cryptctl-server as described in Section 13.1, “Setting up a cryptctl server”. Use the following parameters:

1. To create the certificate, use the dedicated hostname CrypServerHostName of the cryptctl server. Do not use the host name of the host.

2. Use the dedicated IP address CrypServerIP of the cryptctl server. Do not use the default IP address setting.

3. Do not configure a KMIP server.

4. When asked whether to start the cryptctl server, enter n.

Set up a two-node HA cluster:

1. 

   Important

   Node1 must be the server where you have configured the cryptctl server.

   On the machine where you have configured the cryptctl server, set up the first node as follows:

   # crm cluster init -i NetDev -A AdminIP -n ClusterName

2. Log in via SSH to Node2 and join the cluster from there:

   # ssh Node2
   # crm cluster join -y Node1

3. For more information, also see the Installation and Setup Quick Start.

Set up the resource group for the cryptctl server:

1. You can set up all needed resource agents and copy all files to all nodes with the cryptcl crm-shell-script in one step. We strongly recommend that you verify the setup in the first step:

   # crm script verify cryptctl  \
   cert-path=/etc/cryptctl/servertls/CertificateFileName \
   cert-key-path=/etc/cryptctl/servertls/CertificateKeyFileName \
   virtual-ip:ip=CrypServerIP \
   filesystem:device=DevicePath
   filesystem:fstype=FileSystemType

2. If the check was successful, set up the cluster group by running the script as follows:

   # crm script verify cryptctl  \
   cert-path=/etc/cryptctl/servertls/CertificateFileName \
   cert-key-path=/etc/cryptctl/servertls/CertificateKeyFileName \
   virtual-ip:ip=CrypServerIP \
   filesystem:device=DevicePath
   filesystem:fstype=FileSystemType