Using Proxy with ProtectV Clients

ProtectV 4.7.0 and earlier versions had a standalone ProtectV Manager that could work as Gateway for ProtectV clients. As the ProtectV Manager is now an integral part of the new key manager, CipherTrust Manager, the Gateway functionality is no longer available natively from ProtectV Manager.

This section describes how to achieve the external Gateway functionality using third party tools with ProtectV Clients and the CipherTrust Manager appliance. This document demonstrates the use of the SOcket CAT (socat) utility. Other similar proxy servers can also be used as Gateway.

This section covers the following information:

1. Solution

2. Configuring the CipherTrust Manager Proxy

3. Verifying the Proxy Configuration

4. Registering Clients with the Proxy

5. Verifying the Encryption Status

Solution

The external ProtectV Gateway functionality can be achieved with ProtectV for the CipherTrust Manager by using tools such as the SOcket CAT (socat) utility. Using the socat utility, Ubuntu machines will be configured as the CipherTrust Manager proxy (acting as external Gateways). These machines should be reachable from the CipherTrust Manager. ProtectV clients’ requests for encryption keys to the CipherTrust Manager will be forwarded through one of these proxies. For demonstration purpose, two Ubuntu machines are used, as shown in the image below. Configure as many proxies as required in your setup.

Configuring the CipherTrust Manager Proxy

To configure the CipherTrust Manager proxy:

1. Log on to the Ubuntu machine as root.

2. Install the socat utility by running:

   sudo apt-get install socat
   

3. Configure the proxy by running:

   socat TCP-LISTEN:443,fork,reuseaddr TCP:<keysecure ip>:443
   

Here, is the IP address of the CipherTrust Manager.

Proxy is now configured on the Ubuntu machine.

Verifying the Proxy Configuration

After configuring the proxy, verify whether it works correctly. On a Windows machine, try browsing the CipherTrust Manager using a proxy machine's IP address. For example, entering https://<Proxy Machine's IP address>/ in the Internet browser should open the CipherTrust Manager console. This confirms that the CipherTrust Manager proxy is configured successfully.

After the proxy is configured, you can register ProtectV clients with it instead of the CipherTrust Manager.

Registering Clients with the Proxy

To register a client with the proxy:

1. Log on to the ProtectV client as root/administrator.

2. Install the ProtectV client.

3. Register the client with the proxy.

   pvreg <registration token> <keysecure ip> <server fingerprint>
   

   Here, <keysecure ip> is the IP address of the proxy machine.

   Refer to "Registering ProtectV Linux Clients" and "Registering ProtectV Windows Clients" sections in the ProtectV Clients Administrator Guide for details on pvreg parameters.

   On Windows, after pvreg.exe is run and the client is registered with the CipherTrust Manager, volume encryption starts. All partitions of the client will be encrypted. Encryption of your partitions might take some time.

4. (Linux) Verify the registration. Check whether the reginfo file exists at /boot/pvstore. If it exists, the client registration is successful. By default, all volumes/partitions except the boot partition, which cannot be encrypted, are designated for encryption.

5. (Linux) Reboot the client after successful registration. All partitions (except the boot partition) of the client will be encrypted.

Check the encryption status, as described in Verifying the Encryption Status.

Verifying the Encryption Status

On Linux, after the ProtectV client is installed, registered, and the instance is rebooted, it takes some time for each partition to encrypt. Verify the encryption status by running the pvinfo command.

On Windows, as soon as the client is registered with the proxy, encryption of partitions starts. It takes some time for each partition to encrypt. Verify the encryption status by using the local management console (LocalMC.exe).