> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Zettaset XCrypt Full Disk

> Step-by-step installation of Zettaset XCrypt Full Disk with encryption of target nodes.

The installer sends the Zettaset XCrypt Full Disk libraries and configuration files to each target node. It also encrypts the nodes and partitions listed in the `hosts.inv` file.

<Warning>
  The Zettaset XCrypt Full Disk installer must be able to write to the Futurex PKCS #11 (FXPKCS11) log file (such as `fxpkcs11.log`) on the primary KMIP node.  Before proceeding with the following steps, run the following command as root or sudo to add write permissions on the `fxpkcs11.log` file.
</Warning>

```text expandable lines wrap title="Text" theme={null}
$ sudo chmod 666 /tmp/fxpkcs11.log
```

<Steps>
  <Step>
    Perform a sanity check on the inventory file. This confirms that the settings in your file are valid.

    ```text expandable lines wrap title="Text" theme={null}
    $ ./install_zts-xcrypt-full-disk.sh -vv -i hosts.inv check
    ```
  </Step>

  <Step>
    Run the installer:

    ```text expandable lines wrap title="Text" theme={null}
    $ ./install_zts-xcrypt-full-disk.sh -vv -i hosts.inv install
    ```

    This creates any KMIP and HSM servers needed, establishes secure connectivity between all nodes and services, and encrypts partitions. You should see zero failures for all nodes in the **PLAY RECAP** at the end of the install output.

    <Note>
      Zettaset XCrypt Full Disk creates four keys on the CryptoHub: one public and one private RSA 2048 asymmetric key and two AES-256 Data Encryption keys.
    </Note>
  </Step>

  <Step>
    View the block devices for each target node to confirm partition encryption. The output reflects your partitions.

    ```text expandable lines wrap title="Text" theme={null}
    $ ssh target03 "lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINT"
    NAME FSTYPE SIZE MOUNTPOINT
    └─sdc crypto_LUKS 5G
      └─crypt2 (dm-2) xfs 5G /data2
    ```
  </Step>

  <Step>
    View the encryption key names by viewing `cryptinittab` on the target node:

    ```text expandable lines wrap title="Text" theme={null}
    $ ssh target03 "cat /etc/zts/conf.default/cryptinittab"
    partition mount point mapper name key name
    /dev/sdc /data2 crypt2 688eda48-337f-49fd
    ```
  </Step>

  <Step>
    Back up the `cryptinittab` file for each encrypted node. This file is the only way to associate a key with a partition.
  </Step>

  <Step>
    Review `install.log` when needed.
  </Step>

  <Step>
    Remove the HSM PIN values from the `hosts.inv` file.
  </Step>
</Steps>