Establishing an encryption-enabled environment

Refer to the ISKLM installation guide.

From the main page of the ISKLM web GUI, select Configuration and then Key Serving Parameters from the selector on the right. Then make sure that the check box next to Keep pending client device communication certificates is selected.

(Skip this step if you have already configured the SSL/KMIP server certificate).

1. Click Configuration in the menu bar at the top, and select SSL/KMIP from the menu on the left.
2. To create a new self-signed certificate, click the Create self-signed certificate radio button.
3. Enter the appropriate details for the certificate to be created, and click OK.

1. From the main page of the ISKLM web GUI, select Advanced Configuration and then Device Group from the menu bar at the top.
2. On the next page, click the Create button.
3. In the Create Device Group window, select the GPFS device family and enter an appropriate name (for example, "GPFS_TENANT1"); make note of this name, as it will be required later on.
4. Once the device group has been created, the system will prompt you to add devices and keys. However, the next steps in this procedure will generate keys explicitly, so now just click Close to return to the main page.
5. On the main page, select the GPFS tenant device group, click Go to..., and select Manage keys and devices from the dropdown menu.
6. On the next screen, click Add and select Key from the dropdown menu.
   The system prompts you to specify the following:

   • the number of keys to be created
   • the three-letter prefix to be added to their name

     The name is the ISKLM internal name and is not used for GPFS encryption.

   Make note of the key UUID (in the example, KEY-326a1906-be46-4983-a63e-29f005fb3a15), as it will be required later on.

7. Enable the option Hold new certificate requests pending my approval by selecting it from the dropdown menu in the lower part of the page.

1. Create a key store containing the server certificate and a new key pair and certificate that will be used by the client.
   1. To do so, from an administrator console on the GPFS node you wish to be configured with encryption, create the subdirectory /var/mmfs/etc/RKMcerts.
   2. Issue the following command, replacing cname_test with a string identifying the GPFS node or the tenant performing encryption, label_test with a string that identifies the client certificate in the key store, and a_password with a password protecting the secret key material in the key store file:

      mmauth gencert --cname cname_test --label a_label --cert /tmp/srvcert --out
      /var/mmfs/etc/RKMcerts/ISKLM.p12 --pwd a_password

      Upon success, the new key store is created (for example, in /var/mmfs/etc/RKMcerts/ISKLM.p12).

      Note: The created key store must be record locked when the GPFS daemon starts. If the key store files are stored on an NFS mount, it is possible for the encryption initialization process to hang, due to a bug that affects the way NFS handles record locking. If this happens, upgrade your version of NFS or store your key store file on a local file system. If an upgrade is not possible and no local file system is available, use a RAM drive to store the key store files.
   3. Open an editor to create the /var/mmfs/etc/RKM.conf file, as follows:

      ISKLM_srv {
      type = ISKLM
      kmipServerUri = tls://raclette.zurich.ibm.com:5696
      keyStore = /var/mmfs/etc/RKMcerts/ISKLM.p12
      passphrase = a_password
      clientCertLabel = a_label
      tenantName = GPFS_TENANT1
      }

      Choose an appropriate name for the RKM backend stanza (ISKLM_srv in the example) and ensure that the fields are filled in correctly:

      type

      Must be set to ISKLM.

      kmipServerUri

      Contains the DNS name or IP address of the ISKLM server and the KMIP SSL port (you can find the latter in the main page of the ISKLM web GUI; 5696 is the default).

      keyStore

      Contains the path to the key store file created in the previous step.

      passphrase and clientCertLabel

      Contain the password and label specified in the command line upon creation of the key store.

      tenantName

      Contains the name of the device group created in ISKLM.

All files created from this point on will be encrypted with an FEK, which in turn will be wrapped with the chosen MEK.

-rw-------. 1 root root 2446 Mar 20 12:15 /var/mmfs/etc/RKM.conf
drw-------. 2 root root 4096 Mar 20 13:47 /var/mmfs/etc/RKMcerts
-rw-------. 1 root root 3988 Mar 20 13:47 /var/mmfs/etc/RKMcerts/ISKLM.p12