Welcome!

Open Source Cloud Authors: Elizabeth White, Liz McMillan, Yeshim Deniz, Zakia Bouachraoui, Pat Romanski

Blog Feed Post

Using the Porticor Agent

The Porticor Agent enables you to encrypt disks on your server, using Porticor’s highly secure key management technology.

The Agent connects to a key management appliance – a Porticor virtual machine deployed in your cloud account, which is responsible to safeguard your master key so that you do not have to trust anybody else with your keys, not even Porticor. The Agent is provisioned with an API key, which allows it to access its own managed crypto keys, but not the master key. All disk encryption takes place locally on the server that runs the Agent, and the disk-encryption keys are split between the key management appliance and the Porticor Virtual Key Management (PVKM) service.

Installing the Agent

  1. Download the agent from this link (for Debian/Ubuntu) or this link (for RHEL, CentOS or Amazon Linux).
  2. Install the package on your application server:
    On Ubuntu, run dpkg -i package-name.deb
    On Red Hat, CentOS and Amazon Linux, run yum install package-name.rpm
  3. Configure the appliance:
    • You will need the address of a Porticor appliance that’s in your cloud account. Go to the PVKM’s main management page, select an appropriate appliance and note down its DNS address (typically ending with d.porticor.net). If no such appliance exists, you will have to start one.
    • You will also need an API key, which you can obtain from the PVKM’s API key management page.
    • On AWS, we strongly recommend to enter your cloud credentials into the Porticor appliance. Go to the Protected File Systems and enter the AWS Key ID and Secret Key.
    • From your application server (where you installed the Porticor agent) run sudo porticor_agent initialize appliance-addr –api-key-id key-id and enter the secret key when prompted. Please do not cut-and-paste from this page, or you might get an incorrect dash in front of “api-key-id”.
    • The agent is ready to go.

Agent Commands

The agent provides a single command porticor_agent, which in turn provides numerous subcommands. All subcommands must be run with root permissions. For example:

sudo porticor_agent status

Command Syntax

All options in brackets [ are optional. All options in double-quotes " must be quoted if they consist of multiple words.

Below is the list of subcommands:

help
List the agent's commands.
status
Display a status summary.
initialize appliance-addr [--agent-name "name"] –api-key-id key-id [--api-secret-key secret-key] [--persist-key] [--no-ip-validation]
Initialize the agent. The agent will connect to the given appliance using the provided API key. If the secret part of the key is not given on the command line, you will be prompted for it. The agent’s configuration is written to /etc/porticor-agent/agent-config.json. The appliance must be available for the initialization to complete successfully. During initialization, the current server’s entropy pool (/dev/random) is refreshed. You can use −−agent-name to name the agent. Use −−persist-key if you want the agent’s key to be saved on disk so that it can survive a reboot. On AWS, you may use −−no-ip-validation if you prefer not to tie API keys to a particular server instance.
reconfigure appliance-addr –api-key-id key-id [--api-secret-key secret-key]
Similar to initialize, to be used when the agent has already been initialized. This is useful if you want to switch to a different appliance, or another API key.
deconfigure [--force]
Remove the agent’s configuration without uninstalling it. The –force option eliminates the confirmation prompt.
secure-disk device-name “comment”
Set up a new disk for encryption. The device name is a block device, e.g. /dev/sdb. Important: make sure the device is empty before using it. You can add a comment between quotes, such as “My project’s MySQL data disk”.
secure-mapped-disk file-name size ["comment"]
Set up a new disk for encryption. This command uses a file-mapped disk (also known as “loop device”) instead of a block device. A new file of the specified size (given in gigabytes) is created and mapped. You can add a comment between quotes, such as “My project’s MySQL data disk”.
After you have set up the disk, you can use the mkfs /dev/mapper/hl-xxxx and mount /dev/mapper/hl-xxxx mount-point commands to respectively format and mount it. The mapper address is displayed by the list-disks command.
lock-disk disk-name
Lock a disk and forget its key. The key is removed from the appliance but retained on the Porticor Key Management service. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command.
unlock-disk disk-name
Retrieve the disk’s key from the Key Management service and ready it for use. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. You may need to remount the disk using the mount command.
remove-disk [--force] disk-name
Permanently remove the encrypted disk, and forget its encryption key. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. This operation cannot be undone! The –force argument overrides the confirmation prompt.
edit-comment disk-name “new comment”
Replaces the comment associated with the disk. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. The comment must be quoted.
list-disks
List all the disks managed by the agent.

Agent Security

In normal use, no long-term secrets are kept on the agent. Whenever the agent is configured using the API key, this key is replaced by a short-term, policy-constrained key, and only that second key is retained. The short-term key allows API calls to originate only from a single cloud instance, and allows for the instance to change its IP address. By default, the secret part of this key is not kept on disk, and so cannot be recovered by snapshot attacks. This means that your provisioning system should refresh the API key using the enter-key command whenever the server reboots. Note that the instance restriction policy is only available if the agent is installed on an AWS server, and requires that any agents should be collocated within the same subnet as their Porticor appliance.

The post Using the Porticor Agent appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

IoT & Smart Cities Stories
Early Bird Registration Discount Expires on August 31, 2018 Conference Registration Link ▸ HERE. Pick from all 200 sessions in all 10 tracks, plus 22 Keynotes & General Sessions! Lunch is served two days. EXPIRES AUGUST 31, 2018. Ticket prices: ($1,295-Aug 31) ($1,495-Oct 31) ($1,995-Nov 12) ($2,500-Walk-in)
Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereal. Andrew's role at ConsenSys Enterprise is a mul...
Nicolas Fierro is CEO of MIMIR Blockchain Solutions. He is a programmer, technologist, and operations dev who has worked with Ethereum and blockchain since 2014. His knowledge in blockchain dates to when he performed dev ops services to the Ethereum Foundation as one the privileged few developers to work with the original core team in Switzerland.
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...
The challenges of aggregating data from consumer-oriented devices, such as wearable technologies and smart thermostats, are fairly well-understood. However, there are a new set of challenges for IoT devices that generate megabytes or gigabytes of data per second. Certainly, the infrastructure will have to change, as those volumes of data will likely overwhelm the available bandwidth for aggregating the data into a central repository. Ochandarena discusses a whole new way to think about your next...
CloudEXPO | DevOpsSUMMIT | DXWorldEXPO are the world's most influential, independent events where Cloud Computing was coined and where technology buyers and vendors meet to experience and discuss the big picture of Digital Transformation and all of the strategies, tactics, and tools they need to realize their goals. Sponsors of DXWorldEXPO | CloudEXPO benefit from unmatched branding, profile building and lead generation opportunities.
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence. Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more busine...
All in Mobile is a place where we continually maximize their impact by fostering understanding, empathy, insights, creativity and joy. They believe that a truly useful and desirable mobile app doesn't need the brightest idea or the most advanced technology. A great product begins with understanding people. It's easy to think that customers will love your app, but can you justify it? They make sure your final app is something that users truly want and need. The only way to do this is by ...
DXWorldEXPO LLC announced today that Big Data Federation to Exhibit at the 22nd International CloudEXPO, colocated with DevOpsSUMMIT and DXWorldEXPO, November 12-13, 2018 in New York City. Big Data Federation, Inc. develops and applies artificial intelligence to predict financial and economic events that matter. The company uncovers patterns and precise drivers of performance and outcomes with the aid of machine-learning algorithms, big data, and fundamental analysis. Their products are deployed...