Amazon Cloud News and Articles from A to Z

Amazon Cloud Journal

Subscribe to Amazon Cloud Journal: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get Amazon Cloud Journal: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


Amazon Cloud Journal Authors: Liz McMillan, Elizabeth White, Yeshim Deniz, Chris Kocher, Vaibhaw Pandey

Related Topics: Cloud Computing, Ubuntu Linux Journal, MySQL Journal, Amazon Cloud Journal, Java in the Cloud

Blog Feed Post

Using the Porticor Agent

The Porticor Agent enables you to encrypt disks on your server, using Porticor’s highly secure key management technology.

The Agent connects to a key management appliance – a Porticor virtual machine deployed in your cloud account, which is responsible to safeguard your master key so that you do not have to trust anybody else with your keys, not even Porticor. The Agent is provisioned with an API key, which allows it to access its own managed crypto keys, but not the master key. All disk encryption takes place locally on the server that runs the Agent, and the disk-encryption keys are split between the key management appliance and the Porticor Virtual Key Management (PVKM) service.

Installing the Agent

  1. Download the agent from this link (for Debian/Ubuntu) or this link (for RHEL, CentOS or Amazon Linux).
  2. Install the package on your application server:
    On Ubuntu, run dpkg -i package-name.deb
    On Red Hat, CentOS and Amazon Linux, run yum install package-name.rpm
  3. Configure the appliance:
    • You will need the address of a Porticor appliance that’s in your cloud account. Go to the PVKM’s main management page, select an appropriate appliance and note down its DNS address (typically ending with d.porticor.net). If no such appliance exists, you will have to start one.
    • You will also need an API key, which you can obtain from the PVKM’s API key management page.
    • On AWS, we strongly recommend to enter your cloud credentials into the Porticor appliance. Go to the Protected File Systems and enter the AWS Key ID and Secret Key.
    • From your application server (where you installed the Porticor agent) run sudo porticor_agent initialize appliance-addr –api-key-id key-id and enter the secret key when prompted. Please do not cut-and-paste from this page, or you might get an incorrect dash in front of “api-key-id”.
    • The agent is ready to go.

Agent Commands

The agent provides a single command porticor_agent, which in turn provides numerous subcommands. All subcommands must be run with root permissions. For example:

sudo porticor_agent status

Command Syntax

All options in brackets [ are optional. All options in double-quotes " must be quoted if they consist of multiple words.

Below is the list of subcommands:

help
List the agent's commands.
status
Display a status summary.
initialize appliance-addr [--agent-name "name"] –api-key-id key-id [--api-secret-key secret-key] [--persist-key] [--no-ip-validation]
Initialize the agent. The agent will connect to the given appliance using the provided API key. If the secret part of the key is not given on the command line, you will be prompted for it. The agent’s configuration is written to /etc/porticor-agent/agent-config.json. The appliance must be available for the initialization to complete successfully. During initialization, the current server’s entropy pool (/dev/random) is refreshed. You can use −−agent-name to name the agent. Use −−persist-key if you want the agent’s key to be saved on disk so that it can survive a reboot. On AWS, you may use −−no-ip-validation if you prefer not to tie API keys to a particular server instance.
reconfigure appliance-addr –api-key-id key-id [--api-secret-key secret-key]
Similar to initialize, to be used when the agent has already been initialized. This is useful if you want to switch to a different appliance, or another API key.
deconfigure [--force]
Remove the agent’s configuration without uninstalling it. The –force option eliminates the confirmation prompt.
secure-disk device-name “comment”
Set up a new disk for encryption. The device name is a block device, e.g. /dev/sdb. Important: make sure the device is empty before using it. You can add a comment between quotes, such as “My project’s MySQL data disk”.
secure-mapped-disk file-name size ["comment"]
Set up a new disk for encryption. This command uses a file-mapped disk (also known as “loop device”) instead of a block device. A new file of the specified size (given in gigabytes) is created and mapped. You can add a comment between quotes, such as “My project’s MySQL data disk”.
After you have set up the disk, you can use the mkfs /dev/mapper/hl-xxxx and mount /dev/mapper/hl-xxxx mount-point commands to respectively format and mount it. The mapper address is displayed by the list-disks command.
lock-disk disk-name
Lock a disk and forget its key. The key is removed from the appliance but retained on the Porticor Key Management service. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command.
unlock-disk disk-name
Retrieve the disk’s key from the Key Management service and ready it for use. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. You may need to remount the disk using the mount command.
remove-disk [--force] disk-name
Permanently remove the encrypted disk, and forget its encryption key. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. This operation cannot be undone! The –force argument overrides the confirmation prompt.
edit-comment disk-name “new comment”
Replaces the comment associated with the disk. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. The comment must be quoted.
list-disks
List all the disks managed by the agent.

Agent Security

In normal use, no long-term secrets are kept on the agent. Whenever the agent is configured using the API key, this key is replaced by a short-term, policy-constrained key, and only that second key is retained. The short-term key allows API calls to originate only from a single cloud instance, and allows for the instance to change its IP address. By default, the secret part of this key is not kept on disk, and so cannot be recovered by snapshot attacks. This means that your provisioning system should refresh the API key using the enter-key command whenever the server reboots. Note that the instance restriction policy is only available if the agent is installed on an AWS server, and requires that any agents should be collocated within the same subnet as their Porticor appliance.

The post Using the Porticor Agent appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.