Hardware Encryption

From OSNEXUS Wiki
Jump to: navigation, search

There are three CLI commands for setting up hardware encryption using the 'qs' command line utility. They are 'hw-unit-encrypt', 'hw-controller-create-security-key', and 'hw-controller-change-security-key'. The process for setting up encryption is as follows:

1) Create a hardware RAID unit using the 'Create Unit..' dialog in the QuantaStor web management interface as per your workload requirements (RAID10, RAID6, etc).

2) Go to the console/ssh window and assign a security key to the controller if one is not already set.

    hw-controller-create-security-key [hwc-create-security-key]
      :: Create the security key for encryption on SED/FDE-enabled drives on hardware RAID
         controller.
        <--controller>   :: Name or ID of a hardware RAID controller.
        <--security-key> :: Security key on HW Controller card for encryption on FDE-enabled secure
                            disk drives.

3) Encrypt the hardware RAID unit that you created in step one.

    hw-unit-encrypt [hwu-encrypt]
      :: Enable hardware SED/FDE encryption for the specified hardware RAID unit.
        <--unit>         :: Name of a hardware RAID unit or it unique ID.
        [--options]      :: Special options to hardware encryption policy.

4) Create a new storage pool using the now encrypted RAID unit

Note that your system will be setup so that no pass-phrase is required at boot time. In this mode you're protected against someone taking all the hard drives from your system but if they can take the entire server and/or RAID controller with the disks then the drives can be decrypted without a password. In general the no pass-phrase option is preferred so that the system can be rebooted without administrative involvement but it is less secure.

Setting Up Boot Passphrase

As noted above, the hw-controller-create-security-key command will setup the hardware RAID controller so that no pass-phrase is required at boot time. To change the keys so that a pass-phrase is required at boot time you'll need to use the MegaCli CreateSecurityKey command to set a security key for the controller that includes a pass-phrase. Here's a snippet of the LSI documentation on how to create a key.

Syntax: MegaCli -CreateSecurityKey -SecurityKey sssssssssss | [-Passphrase sssssssssss] |[-KeyID kkkkkkkkkkk] -aN

Description:
        Command enables security feature on specified controller.
        The possible parameters are:
        SecurityKey: Security key will be used to generate lock key when drive security is enabled.
        Passphrase: Pass phrase to provide additional security.
        KeyID: Security key Id.

Convention:
          -aN         N specifies the adapter number for the command.
        Note:
        -       Security key is mandatory and pass phrase is optional.
        -       Security key and pass phrase have special requirements.
        Security key & pass phrase should have 8 - 32 chars, case-sensitive; 1 number, 1 lowercase letter, 1 uppercase letter, 1 non-alphanumeric character (no spaces).
       - In case of Unix based systems, if the character '!' is used as one of the input characters in the value of Security key or pass phrase, it must be preceded by a back slash character('\').

A good way to generate a secure passphrase and/or security key is to use the uuidgen tool as follows:

uuidgen | cut -c 25-

This will output a randomly generated string of characters that looks like '6bb45eb7b615'. You can then run the tool like so but be sure to replace the generated text '1dabc3b0d467' and '6bb45eb7b615' with your own unique keys generated by the uuidgen tool:

MegaCli -CreateSecurityKey -SecurityKey 1dabc3b0d467 -Passphrase 6bb45eb7b615 -a0

Be sure to write down both keys someplace safe. The pass-phrase will be needed every time the system boots and the security key will be needed in the event that you need to replace the RAID controller.