Welcome!

PHP Authors: Liz McMillan, Carmen Gonzalez, Hovhannes Avoyan, Lori MacVittie, Trevor Parsons

Blog Feed Post

Using the Porticor Agent

The Porticor Agent enables you to encrypt disks on your server, using Porticor’s highly secure key management technology.

The Agent connects to a key management appliance – a Porticor virtual machine deployed in your cloud account, which is responsible to safeguard your master key so that you do not have to trust anybody else with your keys, not even Porticor. The Agent is provisioned with an API key, which allows it to access its own managed crypto keys, but not the master key. All disk encryption takes place locally on the server that runs the Agent, and the disk-encryption keys are split between the key management appliance and the Porticor Virtual Key Management (PVKM) service.

Installing the Agent

  1. Download the agent from this link (for Debian/Ubuntu) or this link (for RHEL, CentOS or Amazon Linux).
  2. Install the package on your application server:
    On Ubuntu, run dpkg -i package-name.deb
    On Red Hat, CentOS and Amazon Linux, run yum install package-name.rpm
  3. Configure the appliance:
    • You will need the address of a Porticor appliance that’s in your cloud account. Go to the PVKM’s main management page, select an appropriate appliance and note down its DNS address (typically ending with d.porticor.net). If no such appliance exists, you will have to start one.
    • You will also need an API key, which you can obtain from the PVKM’s API key management page.
    • On AWS, we strongly recommend to enter your cloud credentials into the Porticor appliance. Go to the Protected File Systems and enter the AWS Key ID and Secret Key.
    • From your application server (where you installed the Porticor agent) run sudo porticor_agent initialize appliance-addr –api-key-id key-id and enter the secret key when prompted. Please do not cut-and-paste from this page, or you might get an incorrect dash in front of “api-key-id”.
    • The agent is ready to go.

Agent Commands

The agent provides a single command porticor_agent, which in turn provides numerous subcommands. All subcommands must be run with root permissions. For example:

sudo porticor_agent status

Command Syntax

All options in brackets [ are optional. All options in double-quotes " must be quoted if they consist of multiple words.

Below is the list of subcommands:

help
List the agent's commands.
status
Display a status summary.
initialize appliance-addr [--agent-name "name"] –api-key-id key-id [--api-secret-key secret-key] [--persist-key] [--no-ip-validation]
Initialize the agent. The agent will connect to the given appliance using the provided API key. If the secret part of the key is not given on the command line, you will be prompted for it. The agent’s configuration is written to /etc/porticor-agent/agent-config.json. The appliance must be available for the initialization to complete successfully. During initialization, the current server’s entropy pool (/dev/random) is refreshed. You can use −−agent-name to name the agent. Use −−persist-key if you want the agent’s key to be saved on disk so that it can survive a reboot. On AWS, you may use −−no-ip-validation if you prefer not to tie API keys to a particular server instance.
reconfigure appliance-addr –api-key-id key-id [--api-secret-key secret-key]
Similar to initialize, to be used when the agent has already been initialized. This is useful if you want to switch to a different appliance, or another API key.
deconfigure [--force]
Remove the agent’s configuration without uninstalling it. The –force option eliminates the confirmation prompt.
secure-disk device-name “comment”
Set up a new disk for encryption. The device name is a block device, e.g. /dev/sdb. Important: make sure the device is empty before using it. You can add a comment between quotes, such as “My project’s MySQL data disk”.
secure-mapped-disk file-name size ["comment"]
Set up a new disk for encryption. This command uses a file-mapped disk (also known as “loop device”) instead of a block device. A new file of the specified size (given in gigabytes) is created and mapped. You can add a comment between quotes, such as “My project’s MySQL data disk”.
After you have set up the disk, you can use the mkfs /dev/mapper/hl-xxxx and mount /dev/mapper/hl-xxxx mount-point commands to respectively format and mount it. The mapper address is displayed by the list-disks command.
lock-disk disk-name
Lock a disk and forget its key. The key is removed from the appliance but retained on the Porticor Key Management service. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command.
unlock-disk disk-name
Retrieve the disk’s key from the Key Management service and ready it for use. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. You may need to remount the disk using the mount command.
remove-disk [--force] disk-name
Permanently remove the encrypted disk, and forget its encryption key. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. This operation cannot be undone! The –force argument overrides the confirmation prompt.
edit-comment disk-name “new comment”
Replaces the comment associated with the disk. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. The comment must be quoted.
list-disks
List all the disks managed by the agent.

Agent Security

In normal use, no long-term secrets are kept on the agent. Whenever the agent is configured using the API key, this key is replaced by a short-term, policy-constrained key, and only that second key is retained. The short-term key allows API calls to originate only from a single cloud instance, and allows for the instance to change its IP address. By default, the secret part of this key is not kept on disk, and so cannot be recovered by snapshot attacks. This means that your provisioning system should refresh the API key using the enter-key command whenever the server reboots. Note that the instance restriction policy is only available if the agent is installed on an AWS server, and requires that any agents should be collocated within the same subnet as their Porticor appliance.

The post Using the Porticor Agent appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

IoT & Smart Cities Stories
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.
Early Bird Registration Discount Expires on August 31, 2018 Conference Registration Link ▸ HERE. Pick from all 200 sessions in all 10 tracks, plus 22 Keynotes & General Sessions! Lunch is served two days. EXPIRES AUGUST 31, 2018. Ticket prices: ($1,295-Aug 31) ($1,495-Oct 31) ($1,995-Nov 12) ($2,500-Walk-in)
Business professionals no longer wonder if they'll migrate to the cloud; it's now a matter of when. The cloud environment has proved to be a major force in transitioning to an agile business model that enables quick decisions and fast implementation that solidify customer relationships. And when the cloud is combined with the power of cognitive computing, it drives innovation and transformation that achieves astounding competitive advantage.
Machine learning has taken residence at our cities' cores and now we can finally have "smart cities." Cities are a collection of buildings made to provide the structure and safety necessary for people to function, create and survive. Buildings are a pool of ever-changing performance data from large automated systems such as heating and cooling to the people that live and work within them. Through machine learning, buildings can optimize performance, reduce costs, and improve occupant comfort by ...
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
IoT is rapidly becoming mainstream as more and more investments are made into the platforms and technology. As this movement continues to expand and gain momentum it creates a massive wall of noise that can be difficult to sift through. Unfortunately, this inevitably makes IoT less approachable for people to get started with and can hamper efforts to integrate this key technology into your own portfolio. There are so many connected products already in place today with many hundreds more on the h...
Digital Transformation: Preparing Cloud & IoT Security for the Age of Artificial Intelligence. As automation and artificial intelligence (AI) power solution development and delivery, many businesses need to build backend cloud capabilities. Well-poised organizations, marketing smart devices with AI and BlockChain capabilities prepare to refine compliance and regulatory capabilities in 2018. Volumes of health, financial, technical and privacy data, along with tightening compliance requirements by...
Charles Araujo is an industry analyst, internationally recognized authority on the Digital Enterprise and author of The Quantum Age of IT: Why Everything You Know About IT is About to Change. As Principal Analyst with Intellyx, he writes, speaks and advises organizations on how to navigate through this time of disruption. He is also the founder of The Institute for Digital Transformation and a sought after keynote speaker. He has been a regular contributor to both InformationWeek and CIO Insight...
Digital Transformation is much more than a buzzword. The radical shift to digital mechanisms for almost every process is evident across all industries and verticals. This is often especially true in financial services, where the legacy environment is many times unable to keep up with the rapidly shifting demands of the consumer. The constant pressure to provide complete, omnichannel delivery of customer-facing solutions to meet both regulatory and customer demands is putting enormous pressure on...
Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereal. Andrew's role at ConsenSys Enterprise is a mul...