Page History
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
localhost$ eval $(ssh-agent) Agent pid 5095 localhost$ ssh-add Identity added: /Users/deiter/.ssh/id_rsa (/Users/deiter/.ssh/id_rsa) localhost$ ssh -A stack@20.62.171.73 Last login: Tue Aug 24 19:11:18 2021 from 181.241.16.227 [stack@exascaler-cloud-65f1-mgs0 ~]$ loci hosts 10.0.0.7 exascaler-cloud-65f1-cls0 10.0.0.5 exascaler-cloud-65f1-cls1 10.0.0.8 exascaler-cloud-65f1-cls2 10.0.0.13 exascaler-cloud-65f1-cls3 10.0.0.12 exascaler-cloud-65f1-mds0 10.0.0.11 exascaler-cloud-65f1-mgs0 10.0.0.10 exascaler-cloud-65f1-oss0 10.0.0.4 exascaler-cloud-65f1-oss1 10.0.0.6 exascaler-cloud-65f1-oss2 10.0.0.9 exascaler-cloud-65f1-oss3 [stack@exascaler-cloud-65f1-mgs0 ~]$ ssh exascaler-cloud-65f1-cls0 [stack@exascaler-cloud-65f1-cls0 ~]$ lfs df UUID 1K-blocks Used Available Use% Mounted on exacloud-MDT0000_UUID 315302464 5744 309928012 1% /mnt/exacloud[MDT:0] exacloud-OST0000_UUID 3181466888 570662088 2578541648 19% /mnt/exacloud[OST:0] exacloud-OST0001_UUID 3181466888 590910696 2558305972 19% /mnt/exacloud[OST:1] exacloud-OST0002_UUID 3181466888 580374740 2568825852 19% /mnt/exacloud[OST:2] exacloud-OST0003_UUID 3181466888 570645704 2578552816 19% /mnt/exacloud[OST:3] filesystem_summary: 12725867552 2312593228 10284226288 19% /mnt/exacloud |
How to use client-side encryption
The purpose that client-side encryption wants to serve is to be able to provide a special directory for each user, to safely store sensitive files. The goals are to protect data in transit between clients and servers, and protect data at rest.
This feature is implemented directly at the Lustre client level. Lustre client-side encryption relies on kernel fscrypt. fscrypt is a library which filesystems can hook into to support transparent encryption of files and directories. As a consequence, the key points described below are extracted from fscrypt documentation.
The client-side encryption feature is available natively on Lustre clients running a Linux distributions, including RHEL/CentOS 8.1 and later, Ubuntu 18.04 and later.
Client-side encryption supports data encryption and file and directory names encryption. Ability to encrypt file and directory names is governed by parameter named enable_filename_encryption and set to 0 by default. When this parameter is 0, new empty directories configured as encrypted use content encryption only, and not name encryption. This mode is inherited for all subdirectories and files. When enable_filename_encryption parameter is set to 1, new empty directories configured as encrypted use full encryption capabilities by encrypting file content and also file and directory names. This mode is inherited for all subdirectories and files. To set the enable_filename_encryption parameter globally for all clients, one can do on the management server:
| Code Block | ||||
|---|---|---|---|---|
| ||||
# lctl set_param -P llite.*.enable_filename_encryption=1 |
The fscrypt package is included in the EXAScaler Cloud client toolkit and can be installed using esc-client.
Steps to install Lustre client and fscrypt packages:
| Code Block | ||||
|---|---|---|---|---|
| ||||
# cat > /etc/esc-client.cfg <<EOF
{
"Version": "2.0.0",
"MountConfig": {
"ClientDevice": "10.0.0.10@tcp:/exacloud",
"Mountpoint": "/mnt/exacloud",
"PackageSource": "http://10.0.0.10/client-packages"
}
}
EOF
# curl -fsSL http://10.0.0.10/client-setup-tool -o /usr/sbin/esc-client
# chmod +x /usr/sbin/esc-client
# esc-client auto setup --config /etc/esc-client.cfg |
Output:
| Code Block | ||||
|---|---|---|---|---|
| ||||
# esc-client auto setup --config /etc/esc-client.cfg
Discovering platform ... Done.
Configuring firewall rules for Lustre ... Done.
Configuring Lustre client package source ... Done.
Installing Lustre client packages ... Done.
Mounting 10.0.0.10@tcp0:/exacloud at /mnt/exacloud ... Done.
# rpm -q fscrypt lustre-client kmod-lustre-client
fscrypt-0.3.3-1.wc2.x86_64
lustre-client-2.14.0_ddn52-1.el8.x86_64
kmod-lustre-client-2.14.0_ddn52-1.el8.x86_64 |
Steps to configure client-side encryption:
| Code Block | ||||
|---|---|---|---|---|
| ||||
$ sudo fscrypt setup
Defaulting to policy_version 2 because kernel supports it.
Customizing passphrase hashing difficulty for this system...
Created global config file at "/etc/fscrypt.conf".
Allow users other than root to create fscrypt metadata on the root filesystem? (See
https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem) [y/N]
Metadata directories created at "/.fscrypt", writable by root only.
$ sudo fscrypt setup /mnt/exacloud
Allow users other than root to create fscrypt metadata on this filesystem? (See
https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem) [y/N] y
Metadata directories created at "/mnt/exacloud/.fscrypt", writable by everyone. |
Steps to encrypt directory:
| Code Block | ||||
|---|---|---|---|---|
| ||||
$ sudo install -v -d -m 0755 -o stack -g stack /mnt/exacloud/stack
install: creating directory '/mnt/exacloud/stack'
$ fscrypt encrypt /mnt/exacloud/stack
The following protector sources are available:
1 - Your login passphrase (pam_passphrase)
2 - A custom passphrase (custom_passphrase)
3 - A raw 256-bit key (raw_key)
Enter the source number for the new protector [2 - custom_passphrase]:
Enter a name for the new protector: test
Enter custom passphrase for protector "test":
Confirm passphrase:
"/mnt/exacloud/stack" is now encrypted, unlocked, and ready for use.
$ cp -v /etc/passwd /mnt/exacloud/stack/
'/etc/passwd' -> '/mnt/exacloud/stack/passwd'
$ ls -l /mnt/exacloud/stack/
total 1
-rw-r--r--. 1 stack stack 1610 Jul 13 20:34 passwd
$ md5sum /mnt/exacloud/stack/passwd
867541523c51f8cfd4af91988e9f8794 /mnt/exacloud/stack/passwd |
Lock the directory:
| Code Block | ||||
|---|---|---|---|---|
| ||||
$ fscrypt lock /mnt/exacloud/stack
"/mnt/exacloud/stack" is now locked.
$ ls -l /mnt/exacloud/stack
total 4
-rw-r--r--. 1 stack stack 4096 Jul 13 20:34 ydpdwRP7MiXzsTkYhg0mW3DNacDlsUJdJa2e9l6AQKL
$ md5sum /mnt/exacloud/stack/ydpdwRP7MiXzsTkYhg0mW3DNacDlsUJdJa2e9l6AQKL
md5sum: /mnt/exacloud/stack/ydpdwRP7MiXzsTkYhg0mW3DNacDlsUJdJa2e9l6AQKL: Required key not available |
Unlock the directory:
| Code Block | ||||
|---|---|---|---|---|
| ||||
$ fscrypt unlock /mnt/exacloud/stack
Enter custom passphrase for protector "test":
"/mnt/exacloud/stack" is now unlocked and ready for use.
$ ls -l /mnt/exacloud/stack
total 4
-rw-r--r--. 1 stack stack 1610 Jul 13 20:34 passwd
$ md5sum /mnt/exacloud/stack/passwd
867541523c51f8cfd4af91988e9f8794 /mnt/exacloud/stack/passwd |
Learn more about client-side encryption.
How to run benchmarks
Steps to run IOR benchmark on the EXAScaler Cloud deployment:
...
Overview
Content Tools