Welcome!

PHP Authors: Liz McMillan, Carmen Gonzalez, Hovhannes Avoyan, Lori MacVittie, Trevor Parsons

Blog Feed Post

Using the Porticor Agent

The Porticor Agent enables you to encrypt disks on your server, using Porticor’s highly secure key management technology.

The Agent connects to a key management appliance – a Porticor virtual machine deployed in your cloud account, which is responsible to safeguard your master key so that you do not have to trust anybody else with your keys, not even Porticor. The Agent is provisioned with an API key, which allows it to access its own managed crypto keys, but not the master key. All disk encryption takes place locally on the server that runs the Agent, and the disk-encryption keys are split between the key management appliance and the Porticor Virtual Key Management (PVKM) service.

Installing the Agent

  1. Download the agent from this link (for Debian/Ubuntu) or this link (for RHEL, CentOS or Amazon Linux).
  2. Install the package on your application server:
    On Ubuntu, run dpkg -i package-name.deb
    On Red Hat, CentOS and Amazon Linux, run yum install package-name.rpm
  3. Configure the appliance:
    • You will need the address of a Porticor appliance that’s in your cloud account. Go to the PVKM’s main management page, select an appropriate appliance and note down its DNS address (typically ending with d.porticor.net). If no such appliance exists, you will have to start one.
    • You will also need an API key, which you can obtain from the PVKM’s API key management page.
    • On AWS, we strongly recommend to enter your cloud credentials into the Porticor appliance. Go to the Protected File Systems and enter the AWS Key ID and Secret Key.
    • From your application server (where you installed the Porticor agent) run sudo porticor_agent initialize appliance-addr –api-key-id key-id and enter the secret key when prompted. Please do not cut-and-paste from this page, or you might get an incorrect dash in front of “api-key-id”.
    • The agent is ready to go.

Agent Commands

The agent provides a single command porticor_agent, which in turn provides numerous subcommands. All subcommands must be run with root permissions. For example:

sudo porticor_agent status

Command Syntax

All options in brackets [ are optional. All options in double-quotes " must be quoted if they consist of multiple words.

Below is the list of subcommands:

help
List the agent's commands.
status
Display a status summary.
initialize appliance-addr [--agent-name "name"] –api-key-id key-id [--api-secret-key secret-key] [--persist-key] [--no-ip-validation]
Initialize the agent. The agent will connect to the given appliance using the provided API key. If the secret part of the key is not given on the command line, you will be prompted for it. The agent’s configuration is written to /etc/porticor-agent/agent-config.json. The appliance must be available for the initialization to complete successfully. During initialization, the current server’s entropy pool (/dev/random) is refreshed. You can use −−agent-name to name the agent. Use −−persist-key if you want the agent’s key to be saved on disk so that it can survive a reboot. On AWS, you may use −−no-ip-validation if you prefer not to tie API keys to a particular server instance.
reconfigure appliance-addr –api-key-id key-id [--api-secret-key secret-key]
Similar to initialize, to be used when the agent has already been initialized. This is useful if you want to switch to a different appliance, or another API key.
deconfigure [--force]
Remove the agent’s configuration without uninstalling it. The –force option eliminates the confirmation prompt.
secure-disk device-name “comment”
Set up a new disk for encryption. The device name is a block device, e.g. /dev/sdb. Important: make sure the device is empty before using it. You can add a comment between quotes, such as “My project’s MySQL data disk”.
secure-mapped-disk file-name size ["comment"]
Set up a new disk for encryption. This command uses a file-mapped disk (also known as “loop device”) instead of a block device. A new file of the specified size (given in gigabytes) is created and mapped. You can add a comment between quotes, such as “My project’s MySQL data disk”.
After you have set up the disk, you can use the mkfs /dev/mapper/hl-xxxx and mount /dev/mapper/hl-xxxx mount-point commands to respectively format and mount it. The mapper address is displayed by the list-disks command.
lock-disk disk-name
Lock a disk and forget its key. The key is removed from the appliance but retained on the Porticor Key Management service. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command.
unlock-disk disk-name
Retrieve the disk’s key from the Key Management service and ready it for use. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. You may need to remount the disk using the mount command.
remove-disk [--force] disk-name
Permanently remove the encrypted disk, and forget its encryption key. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. This operation cannot be undone! The –force argument overrides the confirmation prompt.
edit-comment disk-name “new comment”
Replaces the comment associated with the disk. The disk-name argument is a name of the form hl-1234abcd, as displayed by the list-disks command. The comment must be quoted.
list-disks
List all the disks managed by the agent.

Agent Security

In normal use, no long-term secrets are kept on the agent. Whenever the agent is configured using the API key, this key is replaced by a short-term, policy-constrained key, and only that second key is retained. The short-term key allows API calls to originate only from a single cloud instance, and allows for the instance to change its IP address. By default, the secret part of this key is not kept on disk, and so cannot be recovered by snapshot attacks. This means that your provisioning system should refresh the API key using the enter-key command whenever the server reboots. Note that the instance restriction policy is only available if the agent is installed on an AWS server, and requires that any agents should be collocated within the same subnet as their Porticor appliance.

The post Using the Porticor Agent appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

IoT & Smart Cities Stories
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
In an era of historic innovation fueled by unprecedented access to data and technology, the low cost and risk of entering new markets has leveled the playing field for business. Today, any ambitious innovator can easily introduce a new application or product that can reinvent business models and transform the client experience. In their Day 2 Keynote at 19th Cloud Expo, Mercer Rowe, IBM Vice President of Strategic Alliances, and Raejeanne Skillern, Intel Vice President of Data Center Group and G...
DXWorldEXPO LLC announced today that All in Mobile, a mobile app development company from Poland, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. All In Mobile is a mobile app development company from Poland. Since 2014, they maintain passion for developing mobile applications for enterprises and startups worldwide.
DXWorldEXPO | CloudEXPO are the world's most influential, independent events where Cloud Computing was coined and where technology buyers and vendors meet to experience and discuss the big picture of Digital Transformation and all of the strategies, tactics, and tools they need to realize their goals. Sponsors of DXWorldEXPO | CloudEXPO benefit from unmatched branding, profile building and lead generation opportunities.
Founded in 2000, Chetu Inc. is a global provider of customized software development solutions and IT staff augmentation services for software technology providers. By providing clients with unparalleled niche technology expertise and industry experience, Chetu has become the premiere long-term, back-end software development partner for start-ups, SMBs, and Fortune 500 companies. Chetu is headquartered in Plantation, Florida, with thirteen offices throughout the U.S. and abroad.
The standardization of container runtimes and images has sparked the creation of an almost overwhelming number of new open source projects that build on and otherwise work with these specifications. Of course, there's Kubernetes, which orchestrates and manages collections of containers. It was one of the first and best-known examples of projects that make containers truly useful for production use. However, more recently, the container ecosystem has truly exploded. A service mesh like Istio addr...
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time t...
SYS-CON Events announced today that DatacenterDynamics has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY. DatacenterDynamics is a brand of DCD Group, a global B2B media and publishing company that develops products to help senior professionals in the world's most ICT dependent organizations make risk-based infrastructure and capacity decisions.