Zettaset XCrypt Full Disk deployment prerequisites

The following sections show how to install the prerequisite software online or offline.

Install prerequisites online

Perform the following steps on each target node in your deployment to install prerequisites online:

Confirm that the operating system is either CentOS or RHEL 6.x - 9.0 by viewing /etc/redhat-release:

Shell

$ cat /etc/issue.net
CentOS Linux release 7.2.1511 (Core)

Confirm that the installed java version is 1.7 or later:

Shell

$ java -version
java version "1.7.0"

Install libselinux-python, 2.0.94 or later:

Shell

$ yum install libselinux-python -y

Install cryptsetup if the OS is CentOS or RHEL 6.x:

Shell

$ yum install cryptsetup-luks -y

Confirm that the installed wget version is 1.12 or later:

Shell

$ wget --version

Install wget, if needed:

Shell

$ yum install wget -y

Confirm that netstat is installed:

Shell

$ netstat --version

Install netstat if needed:

Shell

$ yum install netstat -y

Update nss. This application must be version 3.21 or later.

Shell

$ yum update nss -y

If encrypting an xfs file system, install the xfsprogs and xfsdump libraries on the node running xfs. You must unmount the xfs partitions before installing Zettaset XCrypt Full Disk.

Open the ports used by your Key Manager. For example, when using the Zettaset software-based Key Manager, open ports 6666 and 8789:When using iptables, run the following commands:

Shell

$ iptables -I INPUT -p tcp --dport 6666 --syn -j ACCEPT
$ iptables -I INPUT -p tcp --dport 8789 --syn -j ACCEPT
$ service iptables save
$ service iptables restart
$ iptables -L -n # confirm

When using firewalld, run the following commands:

Shell

$ firewall-cmd --get-active-zones # use the active zone
$ firewall-cmd --zone=public --add-port=6666/tcp --permanent
$ firewall-cmd --zone=public --add-port=8789/tcp --permanent
$ firewall-cmd --reload
$ firewall-cmd --list-all # confirm

If using an external, third-party Key Manager, ensure that the necessary ports are open in your cluster.

When enabling KMIP HA on CentOS or RHEL 7.x, open ports 2181, 2888, and 3888 on the [zookeeper] nodes to establish communication between those devices. For example, if using firewalld, run the following commands:

Shell

$ firewall-cmd --zone=public --add-port=2181/tcp --permanent
$ firewall-cmd --zone=public --add-port=2888/tcp --permanent
$ firewall-cmd --zone=public --add-port=3888/tcp --permanent
$ firewall-cmd --reload
$ firewall-cmd --list-all # confirm

Then, run the following commands to open port 24007 and one port per [kmip] node starting from 49152 on the [kmip] nodes.

Shell

$ firewall-cmd --zone=public --add-port=24007/tcp --permanent
$ firewall-cmd --zone=public --add-port=29152-29154/tcp --permanent
$ firewall-cmd --reload

Open the port used by the Futurex PKCS #11 (FXPKCS11) library to connect to the KMES Series 3. The default Excrypt/Production port on our HSMs is port 9100.When using iptables, run the following commands:

Shell

$ iptables -I INPUT -p tcp --dport 9100 --syn -j ACCEPT
$ service iptables save
$ service iptables restart
$ iptables -L -n # confirm

When using firewalld, run the following commands:

Shell

$ firewall-cmd --get-active-zones # use the active zone
$ firewall-cmd --zone=public --add-port=9100/tcp --permanent
$ firewall-cmd --reload
$ firewall-cmd --list-all # confirm

Install the Java Cryptography Extension (JCE) unlimited strength jurisdiction policy files:Download the file from https://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.htmlorhttps://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.htmlThen, extract the jar files and install them in $JAVA_HOME/lib/security.

We support FIPS mode only in CentOS or RHEL 7.x and later. If you set fips_mode to true, confirm that the FIPS version openssl installed on all nodes is at least version 1.0.1.e-fips.

You must open a License Server port. The default is 21800. To change the default value, edit the following files:

/usr/share/zts/config/license-config.xml (on the License Server nodes)
/etc/zts/conf.default/license-server_ssl.xml (on the slave nodes)

Perform the following steps on the installer node (installer01 in the following code):

Establish SSH trust between the installer node and all target nodes. This prevents errors when running SSH commands. To create an SSH trust, run the following command to generate an SSH key for the installer, if not already present:

Shell

$ ssh-keygen

Distribute the key to each target node:

In addition to copying the ssh key to the KMIP primary and secondary nodes, also copy the ssh key to the installer node itself.

Shell

$ ssh-copy-id target01
$ ssh-copy-id target02
$ ssh-copy-id target03

Install Ansible (any version between 1.7.2 and 2.4.2.0) on the installer node:

Shell

$ yum install python36-devel markupsafe epel-release gcc ansible -y
$ easy_install pip==1.5.6
$ pip install paramiko PyYAML jinja2 httplib2
$ pip install ansible==2.3.0

Install the Zettaset archive and license files:

Shell

$ scp -P 22 zts-xcrypt-full-disk-8.5.2.tar.gz root@installer01:/opt
$ scp -P 22 sample.license root@installer01:/opt

Extract the archive:

Shell

$ ssh installer01
$ cd /opt
$ tar zxvf zts-xcrypt-full-disk-8.5.2.tar.gz

Copy hosts.inv.example to hosts.inv:

Shell

$ cd /opt/zettaset/xcrypt-full-disk/8.5.2
$ cp hosts.inv.example hosts.inv

Install prerequisites offline

When deploying Zettaset XCrypt Full Disk to a cluster that does not have access to the internet or a central package repository, use the Zettaset pre-installer to install the required RPMs. To use the pre-installer:

Copy the tar.gz file to all nodes on which the Zettaset software is deployed and the node that serves as the Zettaset XCrypt Full Disk installer node.

Extract the archive file on each node:

Shell

$ tar -xvf zts-offline-preinstall.tar.gz

Prepare the installer node by executing the following command:

Shell

$ ./preinstall.py ansible.lst

This command installs the RPMs needed to run the Zettaset XCrypt Full Disk installation.

Prepare the nodes in the Zettaset deployment by executing the following command on each node:

Shell

$ ./preinstall.py deps.lst

This command installs the RPMs required by the Zettaset deployment.

You can then continue with the Zettaset XCrypt Full Disk installation.

​Install prerequisites online

​Install prerequisites offline

Install prerequisites online

Install prerequisites offline