Red Hat Security: Linux in Physical, Virtual, and Cloud

Install Tang servers on serverb, serverc, and serverd. Open the firewall on those nodes to allow the default port for tang servers (80/TCP).

1. Log in to serverb as student. No password is required.

   [student@workstation ~]$ ssh student@serverb
   [student@serverb ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 

3. Install the tang package.

   [root@serverb ~]# yum install tang
   ...output omitted...
   Is this ok [y/d/N]: y
   ...output omitted...
   Installed:
   tang.x86_64 0:6-1.el7
   ...output omitted...
   Complete!
   

4. Enable socket activation for the Tang server.

   [root@serverb ~]# systemctl enable tangd.socket --now
   Created symlink from /etc/systemd/system/multi-user.target.wants/tangd.socket to /usr/lib/systemd/system/tangd.socket.

5. Open the 80/TCP port for the Tang server. When done, log out from serverb.

   [root@serverb ~]# firewall-cmd --zone=public --add-service=http
   success
   [root@serverb ~]# firewall-cmd --zone=public --add-service=http \
   > --permanent
   success
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   [student@workstation ~]$ 

6. Perform the same steps for serverc and serverd.

   Note

   You can install and configure the Tang servers on serverb, serverc, and serverd with the /home/student/RH415/labs/luks-nbde/install_tang.yml Ansible Playbook. On workstation as student, change the working directory to /home/student/RH415/labs/luks-nbde, and run the install_tang.yml playbook with the ansible-playbook command as follows:

   [student@workstation ~]$ cd ~/RH415/labs/luks-nbde
   [student@workstation luks-nbde]$ ansible-playbook install_tang.yml

On servera, associate the LUKS-encrypted partition on /dev/vdb1 with the Tang servers on serverb, serverc, and serverd. Configure SSS encryption so that at least two Tang servers must be available to decrypt the partition.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Install the packages required to configure servera as a Clevis client.

   [root@servera ~]# yum install clevis clevis-luks clevis-dracut
   ...output omitted...
   Is this ok [y/d/N]: y
   
   ...output omitted...
   Installed:
     clevis.x86_64 0:7-4.el7               clevis-dracut.x86_64 0:7-4.el7
     clevis-luks.x86_64 0:7-4.el7
   ...output omitted...
   Complete!

4. Associate the LUKS-encrypted partition on /dev/vdb1 with the Tang servers on serverb, serverc, and serverd. Configure the SSS encryption so the three Tang servers must be available to decrypt the partition.

   [root@servera ~]# cfg=$'{"t":3,"pins":{"tang":[\n
   > {"url":"http://serverb.lab.example.com"},\n
   > {"url":"http://serverc.lab.example.com"},\n
   > {"url":"http://serverd.lab.example.com"}]}}'
   [root@servera ~]# clevis luks bind -d /dev/vdb1 sss "$cfg"
   The advertisement contains the following signing keys:
   
   4R1tkfaTw-67bW0uxTAmTprUPoo
   
   Do you wish to trust these keys? [ynYN] Y
   The advertisement contains the following signing keys:
   
   gks_IaVo1yog0KuQei95rg_yGns
   
   Do you wish to trust these keys? [ynYN] Y
   The advertisement contains the following signing keys:
   
   vA5xAeUiKPqvkg4UyR4TemzXoAw
   
   Do you wish to trust these keys? [ynYN] Y
   You are about to initialize a LUKS device for metadata storage.
   Attempting to initialize it may result in data loss if data was
   already written into the LUKS header gap in a different format.
   A backup is advised before initialization is performed.
   
   Do you wish to initialize /dev/vdb1? [yn] y
   Enter existing LUKS password: redhatRHT

   Note

   To avoid errors, you can copy and paste the previous command from the /home/student/RH415/labs/luks-nbde/tang-conf.txt file on workstation.

Enable clevis-luks-askpass.path to support non-root LUKS-encrypted partitions.

[root@servera ~]# systemctl enable clevis-luks-askpass.path
Created symlink from /etc/systemd/system/remote-fs.target.wants/clevis-luks-askpass.path to /usr/lib/systemd/system/clevis-luks-askpass.path.

Configure the encrypted partition to automatically decrypt and mount on the /encrypted directory at boot time.

1. Modify the /etc/crypttab file to open the encrypted partition at boot time.

   [root@servera ~]# vi /etc/crypttab
   encryptedvdb1       /dev/vdb1  none   _netdev

2. Update the /etc/fstab file to mount the encrypted partition on the /encrypted directory. When done, log out from servera.

   [root@servera ~]# vi /etc/fstab
   ...output omitted...
   /dev/mapper/encryptedvdb1   /encrypted       xfs    _netdev        1 2
   [root@servera ~]# logout
   [student@servera ~]# logout
   [student@workstation ~]$ 

Disable socket activation for the Tang server on serverb. Reboot servera to verify that the LUKS-encrypted partition on /dev/vdb1 is decrypted and mounted automatically on the /encrypted directory by providing the encrypted partition passphrase at boot time. The system asks for the passphrase at boot time because only two Tang servers are available.

1. Log in to serverb as student. You do not need to enter any password.

   [student@workstation ]$ ssh student@serverb
   [student@serverb ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@serverb ]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 

3. Disable socket activation for the Tang server. When done, log out from serverb.

   [root@serverb ~]# systemctl disable tangd.socket --now
   Removed symlink /etc/systemd/system/multi-user.target.wants/tangd.socket.
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   [student@workstation ~]$ 

4. Click Actions → Shutdown for servera to stop that virtual machine, and wait until the status for servera is STOPPED. When done, click Actions → Start for servera to start that virtual machine, and wait until the status for servera is STARTED.

5. Open the servera console while the system is booting. The console prompts to enter manually the passphrase for the encrypted partition. Enter redhatRHT as the passphrase.

6. On workstation, log in to servera as student. You do not need to enter any password.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]# 

7. Use the sudo -i command to change to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

8. Verify that the encrypted partition is mounted on the /encrypted directory. When done, log out from servera.

   [root@servera ~]# mount | grep /encrypted
   /dev/mapper/encryptedvdb1 on /encrypted type xfs (rw,relatime,seclabel,attr2,inode64,noquota,_netdev)
   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$ 

Enable socket activation for the Tang server on serverb. Reboot servera to verify that the LUKS-encrypted partition on /dev/vdb1 is decrypted and mounted automatically in the /encrypted directory.

1. Log in to serverb as student. You do not need to enter any password.

   [student@workstation ]$ ssh student@serverb
   [student@serverb ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@serverb ]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 

3. Enable socket activation for the Tang server. When done, log out from serverb.

   [root@serverb ~]# systemctl enable tangd.socket --now
   Created symlink from /etc/systemd/system/multi-user.target.wants/tangd.socket to /usr/lib/systemd/system/tangd.socket.
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   [student@workstation ~]$ 

4. Click Actions → Shutdown for servera to stop that virtual machine, and wait until the status for servera is STOPPED. When done, click Actions → Start for servera to start that virtual machine, and wait until the status for servera is STARTED.

5. Log in to servera as student. You do not need to enter any password.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]# 

6. Use the sudo -i command to change to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

7. Verify that the encrypted partition is mounted on the /encrypted directory.

   [root@servera ~]# mount | grep /encrypted
   /dev/mapper/encryptedvdb1 on /encrypted type xfs (rw,relatime,seclabel,attr2,inode64,noquota,_netdev)

8. Verify that the previously created file is still available in the /encrypted directory. When done, log out from servera.

   [root@servera ~]# ls /encrypted
   testfile
   [root@servera ~]# logout
   [student@servera ~]# logout
   [student@workstation ~]$ 
   

Rotate the keys for the Tang server on serverb.

1. Log in to serverb as student. You do not need to enter any password.

   [student@workstation ~]$ ssh student@serverb
   [student@serverb ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 

3. Generate new signature and exchange keys in the directory for the Tang server key database, /var/db/tang. The Tang server uses the new keys automatically for new client bindings.

   [root@serverb ~]# cd /var/db/tang
   [root@serverb tang]# jose jwk gen -i '{"alg":"ES512"}' \
   > -o signature.jwk
   [root@serverb tang]# jose jwk gen -i '{"alg":"ECMR"}' \
   > -o exchange.jwk

4. Rename the old keys with a . as a prefix. The names of your old keys may be different.

   [root@serverb tang]# mv gxB7oqYiEu3zrLayhymtD10sV9E.jwk \
   > .gxB7oqYiEu3zrLayhymtD10sV9E.jwk
   [root@serverb tang]# mv k25k6PbmgUu-pWWUb210xgBelhfQ.jwk \
   > .k25k6PbmgUu-pWWUb210xgBelhfQ.jwk