Microsoft Azure Stack Deployments

Azure Stack offers hybrid cloud platforms, which allows you to deploy Virtual CipherTrust Manager instances to be accessible to both private and public networks. You can deploy Virtual CipherTrust Manager on Azure Stack hyperconverged architecture (HCI) or Azure Stack Hub.

Prerequisites

• The Virtual CipherTrust Manager VHDX image file available from Thales customer support portal.

• A Microsoft account with Azure Stack HCI or Azure Stack Hub software.

• For Azure Stack HCI Deployments, a configured cluster is necessary.

Minimum Requirements

To deploy a CipherTrust Manager instance, the following minimum requirements apply:

• System volume: 50 GB for evaluation, 100 GB for production

• Memory: 16 GB

• vCPUs: 2

• NICs: 1

Where applicable, we provide some recommended starting values in the deployment steps.

Azure Stack HCI Deployment

1. Download and install the Windows Desktop Client.

2. In the Desktop Client main page, select Subscribe and enter your Microsoft account name.

3. Select Jump Box to start the remote connection. Enter your Microsoft account credentials when prompted.

4. In a browser, login to the Windows Admin Center with your Microsoft account.

5. On the Windows Admin Center home screen, under All connections, select the desired cluster.

6. Navigate to Volumes > Files & file sharing and upload the Virtual CipherTrust Manager VDHX file.

7. From the home screen, navigate to Tools > Virtual machines.

8. Select the Inventory tab, select Add and New.

9. Provide the necessary values for the new virtual machine (VM).

   1. Enter a Name.

   2. Ensure Generation 1 is selected for the Generation.

   3. Under Host, select the desired host server.

   4. Under Path, choose a folder on the Jump Box file system to save the VM configuration and virtual hard disk files to.

   5. Under Virtual processors, select the number of virtual processors. We recommend 4 processors.

      Virtual CipherTrust Managers launch in Community Edition, a trial mode which only allows up to four processors. You must purchase and apply a k470 license to use more than four processors.

   6. Under Memory, select the amount of startup memory, and a minimum and maximum range of dynamic memory. We recommend 4 GB as a minimum for startup memory.

   7. Under Network, select a virtual switch.

   8. Under Storage, click Add and Browse. Navigate to the Virtual CipherTrust Manager VDHX file, and select it.

10. Select Create to create the VM.

11. Start the VM. In the Virtual Machines list, hover over the new VM, enable the checkbox for it on the left, and select Start. Watch the State column to verify that the VM is Running.

12. Proceed to connect to the launched Virtual CipherTrust Manager.

Azure Stack Hub Deployment

1. In a browser, login to Azure Stack Hub portal with your Microsoft account.

2. Select Storage Account. Choose an appropriate storage account.

3. Under Blob service, select Containers. Create a new container or select an existing one.

4. Select Upload.

   The Upload blob box opens on the right side of the browser.

5. Navigate to the Virtual CipherTrust Manager VHDX file on your local system, select it, and click Upload.

6. Search for "images" to navigate to the Images page.

7. Select Add.

8. Provide the necessary values for the new image:

   1. Select a Subscription.

   2. Select a Resource group.

   3. Enter a Name.

   4. Select a Region.

   5. For the OS Type, select Linux.

   6. For Storage blob, browse in Storage accounts > Containers to the Virtual CipherTrust Manager VDHX file, and select it.

   7. For the Account Type select Standard HDD.

9. Select Review + Create, and then Create.

10. Once the deployment is complete, select Go to resource.

11. Select + Create VM.

    Note

    If you wish to use cloud-init to apply settings before launch, you must use REST, PowerShell, or Azure CLI to deploy the VM, as described in Azure Stack Hub documentation. A cloud-init deployment is recommended to encrypt Virtual CipherTrust Manager instances be encrypted at launch time to ensure secrets are never exposed.

12. Provide the necessary values for the new virtual machine (VM), keeping the default values for other fields:

    1. Provide a Name

    2. Select a Size. We recommend 4 CPUs and 16 GB RAM.

    3. For OS disk type, select Standard HDD.

    4. Under Administrator account, keep the Authentication type as SSH Public Key. Change the Username to ksadmin, and paste in an SSH key.

       Note

       We support OpenSSH format for the public key, and OpenSSH, PKCS1, or PKCS8 format for the private key. The supported key algorithm is RSA. We recommend RSA 4096, with RSA 2048 as a minimum size for adequate security. You can generate this key using 'PuTTYgen' or similar utility. Save this SSH Public Key at a safe location. You will need this key for future SSH access.

    5. For Select inbound ports, enable HTTP (80), HTTPS (443), and SSH(22).

13. Select Review + Create, and then Create.

14. Proceed to connect to the launched Virtual CipherTrust Manager.

Connect to the Launched Virtual CipherTrust Manager

1. In the Azure Stack HCI or Azure Stack Hub interface, use the Connect option to navigate to the launched VM. You can see the CipherTrust Manager web console GUI, and the IP/Hostname.

2. If you have not provided an SSH key before launching, you are prompted to replace the default SSH Public Key.

   

   As the initial KeySecure admin (ksadmin) you must paste in your SSH Public Key in the box provided and then select Add.

   Note

   We support OpenSSH format for the public key, and OpenSSH, PKCS1, or PKCS8 format for the private key. The supported key algorithm is RSA. We recommend RSA 4096, with RSA 2048 as a minimum size for adequate security. You can generate this key using 'PuTTYgen' or similar utility. Save this SSH Public Key at a safe location. You will need this key for future SSH access.

   After replacing the default SSH Public Key, the Log In screen appears. For more options to replace the default SSH Public Key, see Starting Services After Deployment.

3. Log in using the initial default credentials: Username = admin, Password = admin

   The following notice is displayed:

   

   Note

   If the default credentials do not work, you may need to retrieve an autogenerated password, as described in Changing the Initial Password.

4. Enter a new password using this default Password Policy:

   Min length: 8
   Max length: 30
   Min number of upper cases: 1
   Min number of lower cases: 1
   Min number of digits: 1
   Min number of other characters: 1
   

   A new Login screen appears.

5. Using your new password, log in again. The CipherTrust Manager Web Page appears.

   

6. At this point, it's strongly recommended to configure an NTP server.

   1. Navigate to Admin Settings > NTP.

   2. Enter in an NTP Server hostname.

   3. For an authenticated NTP Server, enter in a symmetric key value in the NTP Key field.

   4. Click the +Add NTP Server button.

   See Network Time Protocol Server Configuration for more details.

   Congratulations! You have successfully deployed your Virtual CipherTrust Manager.

7. If you did not apply disk encryption with cloud-init, it is available after first launch with ksctl. Because installation specific secrets are generated the first time a Virtual CipherTrust Manager instance is launched, it is recommended that the instance be encrypted at launch time to ensure these secrets are never exposed.