Install Zettaset XCrypt Full Disk - Futurex Documentation

The installer sends the Zettaset XCrypt Full Disk libraries and configuration files to each target node and encrypts the nodes and partitions listed in the hosts.inv file.

The Zettaset XCrypt Full Disk installer must have permission to write to the Futurex PKCS #11 (FXPKCS11) log file, fxpkcs11.log, on the primary KMIP node. Before proceeding with the steps in this procedure, run the following command as root or sudo to add write permissions on the fxpkcs11.log file.

Shell

$ sudo chmod 666 /tmp/fxpkcs11.log

Perform a sanity check on the inventory file. This command confirms that the settings in your file are valid.

Shell

$ ./install_zts-xcrypt-full-disk.sh -vv -i hosts.inv check

Run the installer:

Shell

$ ./install_zts-xcrypt-full-disk.sh -vv -i hosts.inv install

This creates the needed KMIP and HSM servers, establishes secure connectivity between all nodes and services, and encrypts partitions. At the end of the installation output display, you should see zero failures for all nodes in the PLAY RECAP.

Zettaset XCrypt Full Disk creates four keys on the KMES Series 3: one public and one private RSA 2048 asymmetric key and two AES 256 Data Encryption keys.

View the block devices for each target node to confirm partition encryption. Your output reflects your partitions.

Shell

$ ssh target03 "lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINT"
NAME FSTYPE SIZE MOUNTPOINT
└─sdc crypto_LUKS 5G
  └─crypt2 (dm-2) xfs 5G /data2

View the encryption key names by viewing cryptinittab on the target node:

Shell

$ ssh target03 "cat /etc/zts/conf.default/cryptinittab"
partition mount point mapper name key name
/dev/sdc /data2 crypt2 688eda48-337f-49fd

Back up the cryptinittab file for each encrypted node. This file is the only way to associate a key with a partition.

Review install.log when needed.

Remove any HSM PIN values from the hosts.inv file.