Please Note:

Integrations and Solutions
CTE Agent for AIX Integration Guide
- Using CTE with Oracle
  - CTE on Oracle ACFS Overview
  - Creating an Oracle ASM Disk Group for Guarding
  - Oracle RAC ASM
    - Important ASM Commands and Concepts
    - Determining Best Method for Encrypting Disks
    - General Prerequisites
    - Specific Prerequisites
  - About Oracle RAC ASM Raw Devices
  - Oracle RAC ASM Multi-Disk Online Method
  - Oracle RAC ASM Multi-Disk Offline Method (Backup/Restore)
  - Surviving the Reboot and Failover Testing
  - Basic Troubleshooting Techniques
- Using CTE with PowerTech Antivirus
CTE Agent for Linux Integration Guides
- Installing CTE on Hadoop
  - Overview
  - Implementing CTE on HDFS
    - Create an Encryption Zone in HDFS Name Space for AWS EMR
    - Using the Original Information from HDFS
    - Create an HDFS Host Group and GuardPoint in CipherTrust Manager
    - Adding a New DataNode to a CTE-protected HDFS
    - Configure NameNodes
    - Take a DataNode Offline and Perform Data Transformation
    - Implementing CTE on HDFS on a Single Host
  - Deploy Cloudera Hadoop on CTE
  - HDFS Upgrade with CTE
    - Configure the Hadoop Cluster for CTE
    - Create a CipherTrust Configuration Group
    - Update the Hadoop-env Template with CTE Settings
    - Modify the HDFS IOCTL
    - Change the HDFS File Rename Check
    - User Information Push
    - Uninstalling CTE for the Hadoop Cluster
  - CTE Installation and Configuration
    - Configuring Hadoop to Use CTE
  - Deleting Metadata in HDFS when Migrating Out of LDT
- Using CTE with Oracle
  - Basic Troubleshooting Techniques
    - Verifying Database Encryption
  - Using CTE LDT with Oracle
  - Oracle RAC ASM and ASMLib
    - Important ASM Commands and Concepts
    - Determining Best Method for Encrypting Disks
    - General Prerequisites
    - Specific Prerequisites
  - Oracle RAC ASMLib Multi-Disk Online Method
  - About Oracle RAC ASM Raw Devices
  - Oracle RAC ASM Multi-Disk Online Method
  - Oracle RAC ASM Multi-Disk Offline Method (Backup/Restore)
  - Surviving the Reboot and Failover Testing
  - Using CTE with Oracle ASM Filter Driver
    - Audience
    - Enable Oracle ASMFD for CTE
    - Configure CTE and create a guarded Oracle ASMFD
    - Convert a baseline ASMFD disk group to a CTE guarded ASMFD disk group using the Offline method
    - Convert a baseline ASMFD disk group to a CTE guarded ASMFD disk group using the Online method
    - Uninstall/ Upgrade CTE with active ASMFD Setup
  - Using Oracle with CTE-U
- Integrating and Configuring EDB
- Integration with Pacemaker
  - Performing CTE maintenance with an LDT GuardPoint in a Pacemaker Setup
  - Using CTE with Pacemaker
- Using CTE with SQL Server on Linux on Red Hat 8
- Configuring Support for SAP HANA
- Using CTE with GlusterFS
- NetApp Snapshot Directory
- Using CTE with Quantum StorNext
  - Overview of using CTE with Quantum StorNext
  - CTE and Quantum StorNext Compatibility
  - Setting up CTE and Quantum StorNext Integration
  - Stop secfs Before Upgrading StorNext LAN Clients
- Using CTE with McAfee Endpoint Security for Linux Threat Prevention
- Using CTE with Trend Micro Deep Security Software
- CTE for Cloud Object Storage
  - Overview
  - System and Software Requirements
  - Client Software Requirements
  - CTE COS S3 Installation Overview
  - Install Required Linux Packages
  - Install CTE with COS Service
  - Configure the AWS CLI to use the COS Root CA Certificate
  - Configure the AWS CLI Network Proxy
  - Configure CTE COS S3
  - Configure a CTE COS S3 Role for Guarded Buckets
    - Secure an S3 Bucket with the CTE COS S3 Role
    - Disable the CTE COS S3 Role for an S3 Bucket
  - Guard an AWS Bucket
  - Additional COS Proxy Root CA Certificate Information
  - Protecting Python Programs with CTE
  - Enable COS on an Agent with no COS Service
  - Creating a COS Policy
  - Uninstall COS from an Agent
- CTE-Efficient Storage for Linux
  - Introduction to CTE-Efficient Storage
    - CTE-Efficient Storage Enhanced Storage Arrays
    - Efficient Storage Device Header and CTE Private Region
    - Device Size
    - ES GuardPoint Encryption Keys
    - Policy Requirements for ES GuardPoints
  - Guarding an Efficient Storage Device on Linux
    - Requirements for Efficient Storage GuardPoints on Linux
    - Initialize Linux Efficient Storage Devices
    - Guard the Linux Device with an ES GuardPoint
      - Data Relocation on Existing Linux Devices
      - Data Transformation on Existing Linux Devices
    - Example of Creating an ES GuardPoint on an Existing Linux Device
  - Guarding a CTE-Efficient Storage Device with Multiple IO Paths on Linux
  - Linux System and ES GuardPoint Administration
    - voradmin ESG Commands on Linux
    - Viewing Device Status and the ES Header on Linux
    - File System Mount Points on Linux
    - Linux System Utilities for Signing
  - Changing the Encryption Key on Linux ESG Devices
  - Resizing Guarded Efficient Storage Devices
    - Example: Resizing a Linux Device
  - Use Cases involving Efficient Storage GuardPoints
    - Use Case 1: Single Encryption Key
    - Use Case 2: Device-Level GuardPoints
    - Use Case 3: Directory-Level GuardPoints
      - Challenges with Root Access on Linux
    - Best Practices for the Migration of a legacy Raw Device Guardpoint to an Efficient Storage Guardpoint
    - Migration Prerequisites
    - Migration
    - Use Case 4: Using CTE-Efficient Storage with LVM
  - Alerts and Errors on Linux
- CTE with Teradata Database Appliances
  - IDT-Capable GuardPoints and Teradata Database Appliances
  - Requirements and Considerations
  - Guarding a Teradata Database Device
    - Install CTE on the Teradata Database Appliance
    - Identify the Devices to Be Guarded
    - Select the Initial Configuration Method
    - Initialize and Guard the Database Devices Using the Standard Initialization Method
    - Initialize and Guard the Teradata Database Devices Using the Backup/Restore Method
  - Changing the Encryption Key on Teradata Devices
  - Access Rules to Apply on the Teradata Database Appliance
  - Replication of IDT Metadata Files Across Members of a Clique
  - Best Practices
  - Uninstalling CTE from the Teradata Cluster
  - Alerts and Errors
  - Generating IDT-capable Metadata for Teradata Storage Expansion
- Integrating CTE with an Exasol Database
- Integrating CTE with a Couchbase Database
- Integrating CTE with an EnterpriseDB Postgres Advanced Server
- Integrating CTE with a MongoDB database
- Integrating CTE with an Apache Cassandra database
- Integrating CTE with a Neo4j Database
CTE Agent for Windows Integration Guides
- Using CTE with Microsoft SQL AlwaysOn and SQL File Tables
  - Using CTE with Microsoft SQL
    - Using CTE with SQL
    - Using CTE with SQL FileTables
      - Supported FileTables Use Cases
      - Unsupported FileTables Use Cases
    - Installing CTE on Microsoft SQL AlwaysOn
    - Data Transformation (Encryption in place)
    - Copy/Restore
    - SQL Server Policy Tuning
  - Using LDT with Microsoft SQL
    - Using LDT with SQL AlwaysOn
    - Using LDT with SQL FILESTREAM
- CTE with DFSR
  - Overview
  - Creating Required DFSR Policy Components
  - Using the Standard Encryption Method
    - Creating Standard Policies for DFSR
    - Creating Standard GuardPoints with the DFSR Hub and Spoke Topology
    - Creating Standard GuardPoints with the DFSR Full Mesh Topology
  - Using the CTE-LDT Encryption Method
    - Creating a CTE-LDT Policy for DFSR
    - Creating a CTE-LDT GuardPoint for DFSR
- Secure Start
  - Secure Start Overview
  - Prerequisites
  - Encrypt by Moving the AD Service into a Guarded Directory
  - Encrypt Data in Place with Offline Transformation
  - Encrypt with an LDT Transformation Policy
  - Configure the Time Out Failure
  - Recover a Server After it Loses Connection to the Key Manager
  - Other Use Cases
  - Best Practices for Encrypting and Protecting the AD Service
- Exchange DAG
  - Exchange DAG Overview
  - CTE Policies for Exchange DAG
    - Creating a Policy for CTE-LDT Encryption with CipherTrust Manager
    - Creating Policies for Standard Encryption with CipherTrust Manager
  - Encrypting with CTE-LDT in an Exchange DAG Environment
  - Encrypting with a Standard CTE Policy in the Exchange DAG Environment
  - Decrypting with CTE-LDT in an Exchange DAG Environment
- Storage Spaces Direct
- Using CTE with Quantum StorNext
  - Overview of using CTE with Quantum StorNext
  - CTE and Quantum StorNext Compatibility
  - Setting up CTE and Quantum StorNext Integration
- CTE-Efficient Storage for Windows
  - Introduction to CTE-Efficient Storage
    - CTE-Efficient Storage Enhanced Storage Arrays
    - Efficient Storage Device Header and CTE Private Region
    - Device Size
    - ES GuardPoint Encryption Keys
    - Policy Requirements for ES GuardPoints
  - Guarding an Efficient Storage Device on Windows
    - Requirements for Efficient Storage GuardPoints on Linux
    - Limitations for ES GuardPoints on Windows
    - Initialize Windows CTE-Efficient Storage Devices
    - Guard the Windows Device with an ES GuardPoint
  - Windows System and ES GuardPoint Administration
  - Changing the Encryption Key for a Windows ES GuardPoint
  - Resizing Guarded Efficient Storage Devices
  - Use Cases involving Efficient Storage GuardPoints
    - Use Case 1: Single Encryption Key
    - Use Case 2: Device-Level GuardPoints
    - Use Case 3: Directory-Level GuardPoints
    - Use Case 4: Full Device Protection
  - Alerts and Errors on Windows
- Encrypt Microsoft OneDrive files with CTE

Integrating CTE with an Exasol Database

This document describes how to integrate CTE with an Exasol database.

Test Environment

CTE Agent: 7.2.0.128
CipherTrust Manager: 2.8.0
OS: RHEL/CentOS 7.9
Exasol DB: 7.1.12
File System: LVM (raw device)

Steps

To integrate CTE with an Exasol database:

Install and Register the CTE Agent
Configure the Client Settings
Back up the Exasol Database
Delete the Exasol Database
Create a GuardPoint
Update the Secvm Device
Restore the Exasol Database
Validations

Install and Register the CTE Agent

Install the CTE Agent on the client machine where the Exasol database is configured.
Register the CTE Agent with the CipherTrust Manager.

Refer to CTE - Agent Quick Start Guide for details.

Configure the Client Settings

Log on to the CipherTrust Manager.
Open the Transparent Encryption application.
Go to Clients > Client and select the Client. This is the client machine where the Exasol database is configured.
Click Client Settings.

In the Settings field, add the hddident and cos_storage processes as authenticators.

|authenticator|/7.1.12/image/usr/opt/EXASuite-7/EXAClusterOS-7.1.12/sbin/hddident
|authenticator|/7.1.12/image/usr/opt/EXASuite-7/EXAClusterOS-7.1.12/libexec/cos_storage

Click Apply.

Back up the Exasol Database

Now, on the CTE client (like PuTTY or MobaXterm), back up the Exasol database. To do so:

Log on to an SSH client.

Run the following commands:

cd ExasolSetup/
ssh -i id_rsa -p 2233 localhost
dwad_client storage-backup PROD_A
dwad_client pdd-proc PROD_A
dwad_client stop-wait PROD_A

Delete the Exasol Database

After backing up, delete the Exasol database that includes the EXAStorage volumes and disks, and then stop the Exasol service. On an SSH client, run the following commands:

dwad_client stop-wait PROD_A i.e, dwad_client stop <DB_NAME>
dwad_client del PROD_A
csinfo -v
csvol -d -v 0
csinfo -H
cshdd -r -h /dev/exa1/lvol0 -n 11
logout
systemctl stop exasol

Create a GuardPoint

Create the required GuardPoint on the CTE client from the CipherTrust Manager GUI. While creating the GuardPoint:

Select the Type of the device as Auto Raw or Block Device.
Enter the Path of the logical volume, for example, /dev/exa1/lvol0.
Select the Policy Type as Standard.
Create a User Set named root and grant it the permission to perform all Actions and Effects.

Refer to Creating GuardPoints for details.

Update the Secvm Device

On the SSH client:

Run the following command:

secfsd -status devmap

The output similar to the following is displayed:

Secvm Device                Native Device
------------                -------------

/dev/secvm/dev/exa1/lvol0   /dev/exa1/lvol0

In the above sample output, /dev/secvm/dev/exa1/lvol0 is the Secvm device.

Copy the Secvm device.
Delete the metadata from the /7.1.12/exa/metadata folder.
```
cd /7.1.12/exa/metadata/
rm -rf *
```
Note
It is recommended to delete the metadata before updating the Secvm device.

Update the Secvm device in the EXAConf file.

Navigate to /7.1.12/exa/etc/.
Open the EXAConf file in a text editor.

Search for Disk, and update the Devices entry with the copied Secvm device.

[Node : 11]
    PrivateNet = 10.164.13.247/24
    PublicNet =
    Name = n11
    Affinity = 11
    UUID= 159D338FDBOBA36BACF2CC104224C683D33726E8
    DockerVolume = n11
    ExposedPorts = 8563:8574, 2580:2591
    [[Disk disk1]]
        Devices = /dev/secvm/dev/exa1/lvole

Search for Checksum and set the value of Checksum as COMMIT.
Save the changes and close the file.

Start the Exasol service by running systemctl start exasol.
Verify the status of the Exasol service by running systemctl status exasol. The status must be active (running).

Restore the Exasol Database

On the CTE client, restore the Exasol database by running the following commands:

dwad_client pdd-restore PROD_A
dwad_client storage-restore PROD_A
dwad_client pdd-proc PROD_A

Validations

Start a new session on the SSH client.

Encrypt the data on the initial device by running strings /dev/exa1/lvol0|more.

f~N#
pU_t
H9rg,1
UcEa
\>,u
B ~ A
9DQ&
YsE#
kel4X
=:69m
hdHA
k\$<
|HUI|
rpt7
‘YI&?
* 8!
g#,—Bzw
_w_0aV
y7zk
B#+9
--More--

Encrypt the data on the guarded device by running strings /dev/secvm/dev/exa1/lvol0|more for the following:

Policy with all_ops action, and Permit and ApplyKey effects.

ID              =159D338FDBOBA36BACF2CC104224C683D33726E8
NAME            =/dev/secvm/dev/exa1/lvolo
STORAGE         =CSR_4096_7855104_2
FORMATED        =YES
CHECKSUM        =bcc800bd0f72aee46daf4f8cdf8fef4e

persistent (256K)

Policy with all_ops action and Permit effect.

cL]b
uzx=3
-B=IQ_
1vaT#
_"a%
YkFL
3So@
g@Cp
!HtIZ}I
RA3N2V
xC~oP(
f~N#
pU_t
H9rg,1
UcEa
\>,u
B ~ A
9DQ&
YsE#
kel4X
=:69m
hdHA
k\$<
|HUI|
rpt7
‘YI&?
* 8!
g#,—Bzw
_w_0aV
y7zk
B#+9
--More--

Policy with all_ops action and Deny effect.

[root@NOIENC1PFL-IR22 ~]# strings /dev/secvm/dev/exa1/1v010[more
strings: /dev/secvm/dev/exa1/1v010: Permission denied
[r00t@NOIENC1PFL-IR22 ~]# I

Refer to Security Rules for more information on actions and effects.

Encrypt the data on the original hard disk (excluding the disk headers) by running strings /dev/sdc|more.

creation_time = 1661854578
creation_host = "NOIENC1PFL-IR22" segment_count = 1
segment1 {
start_extent = 0
extent_count = 7680
type="striped"
stripe_count = 1
stripes "pv0", 0
[
# Generated by LVM2 version 2.02.187(2)-RHEL7 (2020-03-24): Tue Aug 30 15:46:18 2022
contents = "Text Format Volume Group"
version = 1
description=""
creation_host = "NOIENC1PFL-IR22"
creation_time = 1661854578
CLJb
uzx=3
-B=10
1wRvT#
^a%
YkFL
3So@
g@cp
;NzH <01
((6k
@x/1g
BaP>'>
tn/q
d)W2
ar1;

Note

• LDT is not tested as LDT does not support raw devices.
• Initial data transformation is not required as the data is deleted during the Exasol installation.

Integrating CTE with an Exasol Database

Test Environment

Steps

Install and Register the CTE Agent

Configure the Client Settings

Back up the Exasol Database

Delete the Exasol Database

Create a GuardPoint

Update the Secvm Device

Restore the Exasol Database

Validations

On this page

Suggest A Change