Perform the following steps to integrate ProtectApp LUKS with the CipherTrust Manager:

1. Configuring ks_config and ks_user_config Files

2. Configuring ProtectApp LUKS Partition

Configuring ks_config and ks_user_config Files

1. The basic configuration parameters in /etc/ks_config file that are required to be changed are:

   • NAE_IP: refers to the IP address of the CipherTrust Manager

   • NAE_Port: refers to the port of the CipherTrust Manager. The default value is 9000.

   • Protocol: refers to the protocol used for communication between the client and server. The protocol can be tcp or ssl.

   • CA_File: refers to the CA certificate that was used to sign the server certificate presented by the NAE Server to the client. (for ssl only)

   • Cert_File: stores the path and filename of the client certificate. This is only used when your SSL configuration requires clients to provide a client certificate to authenticate to the CipherTrust Manager appliances. (for ssl only)

   • Key_File: refers to the private key associated with the client certificate specified in the Cert_File parameter. (for ssl only)

   • Log_Level: refers to the level of logging performed by the client. Values are not case-sensitive. The default value is WARN and can be set to DEBUG for troubleshooting.

   • Log_File: refers to the file name and full path to the log file. The user must have write permissions on this path and file.

   You can further configure the ProtectApp LUKS Provider to meet the requirements of your environment. Refer to Configuring the Properties File for more details.

2. Create a user and a key on the CipherTrust Manager. For details on creating a user and key, refer to the following links:

   • To create a user

   • To create a key

3. The basic configuration parameters in /etc/ks_user_config file that are required to be changed are:

   • key_name: refers to the key present on CipherTrust Manager to be used for ProtectApp LUKS Operations.

   • user_name: refers to the username associated with the user account to log into the CipherTrust Manager.

   • key_version: refers to the version of the key present on CipherTrust Manager to be used.

   • enable: refers to the mode of LUKS.

     • If the value of the parameter is 'yes', ProtectApp LUKS is enabled

     • If the value of the parameter is 'no', Native LUKS is enabled.

   You need to edit the /etc/ks_user_config file based on the authentication type:

   • User Based Authentication: Username and Password will be used for authentication with CipherTrust Manager. Refer to Configuring User based Authentication.

   • Passwordless Certificate Based Authentication: The Client Certificate will be used for authentication with CipherTrust Manager. Refer to Configuring Passwordless Certificate based Authentication.

4. ProtectApp LUKS is now ready to be used by executing the standard ProtectApp LUKS commands.

Configuring ProtectApp LUKS Partition

ProtectApp LUKS partition can be configured for the following:

• User Based Authentication

• Passwordless Certificate Based Authentication

Configuring ProtectApp LUKS Partition for User Based Authentication

To initialize the volume, execute the following command. It prompts for a passphrase entry only for user based authentication and sets an initial key from Ciphertrust Manager.

For Legacy Luks1, run the following command:

cryptsetup -y -v luksFormat /dev/<disk_name> --type luks1

The above commands return the following output:

Sample Output:

WARNING! ======== This will overwrite data on /dev/<disk_name> irrevocably.
Are you sure? (Type uppercase yes): YES 
Enter LUKS passphrase: 
Verify passphrase: 
Command successful.

Configuring ProtectApp LUKS Partition for Passwordless Certificate Based Authentication

To initialize the volume, execute the following command.

cryptsetup -q -v luksFormat /dev/<disk_name>

For Legacy Luks1, run the following command:

cryptsetup -q -v luksFormat /dev/<disk_name> --type luks1

The above commands return the following output:

Sample Output:

WARNING! ======== This will overwrite data on /dev/<disk_name> irrevocably.
Are you sure? (Type uppercase yes): YES  
Command successful.

To specify the Ciphers explicitly, use the option --cipher. The default Cipher is aes-xts-plain64.

Example:

cryptsetup -q -v luksFormat /dev/sdb --cipher aes-cbc-essiv:sha256

and

cryptsetup -v luksOpen /dev/sdb backup2 --cipher aes-cbc-essiv:sha256

Refer to the Sample for Boot Time Configuration.