Cloudera Docs

Registering Cloudera Navigator Encrypt

Prerequisites

Functioning Ranger KMS

After installing Navigator Encrypt on a host, you must register the host with Ranger KMS.

Master Password

The Master Key is the primary Navigator Encrypt administrator access code and is configured by the Navigator Encrypt administrator during installation. The Master Key can take any one of three different forms:
  • If you choose a passphrase (single), it must be between 15 and 32 characters long.
  • If you choose passphrase (dual), both must be between 15 and 32 characters long.
  • If you choose the RSA option, enter a path to the RSA key file, and if it has RSA passphrase, enter it for this private key.

TLS

Registration settings are maintained in /etc/navencrypt/keytrustee/ztrustee.conf under the designations TLS12, TLS12_AND_TLS13, or TLS13.

Ensure the following prerequisites are met prior to configuration:

  • Ranger KMS server-side configuration must support the designated TLS version.

  • The host running Navigator Encrypt must explicitly trust the Ranger KMS certificate (the --skip-ssl-check flag should be reserved for non-production testing environments only).

  • The Navigator Encrypt host requires libcurl version 7.61.0 or higher to support TLS 1.3 cipher list configuration.

Registering with Ranger KMS

After installing Navigator Encrypt on a host, you must register the host with Ranger KMS in order to encrypt and decrypt data. The following section lists the command options for registering your Navigator Encrypt client.

If the TLS certificate is signed by an internal CA that is not publicly recognized, then you must add the root certificate to the host certificate truststore of each Navigator Encrypt client.

Example: Use the following command examples based on deployment requirements:
TLS 1.2 Mode (Default)
sudo navencrypt register --server=https://rangerkms01.example.com:9494 --kms --skip-ssl-check -m 'https'
TLS 1.2 and TLS 1.3 Mode
sudo navencrypt register --server=https://rangerkms01.example.com:9494 --kms --skip-ssl-check -m 'https' --tls12-and-tls13
TLS 1.3 Mode
sudo navencrypt register --server=https://rangerkms01.example.com:9494 --kms --skip-ssl-check -m 'https' --tls13
TLS 1.3 Mode with Custom Cipher List
sudo navencrypt register --server=https://rangerkms01.example.com:9494 --kms --skip-ssl-check -m 'https' --tls13 --ssl-cipher-list="TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256"
Table 1. Registration Options - Ranger KMS
Command Option Explanation
--server=URL Specify the Key Manager active server url.
--passive-server=URL Specify the Key Manager passive server url.
--skip-ssl-check Skip the SSL certificate check if this option is passed.
--kms The Key Manager Server is Ranger KMS.
--scheme "<scheme>" Ranger KMS scheme that Navigator Encrypt uses for public key operations. Specify "http" or "https".
--tls12 Enforces TLS 1.2 only (default setting).
--tls12-and-tls13 Enables support for both TLS 1.2 and TLS 1.3.
--tls13 Enforces TLS 1.3 only.
--ssl-cipher-list=LIST Specifies a custom colon-separated list of supported cipher suites. The supported custom ciphers are:
  • TLS 1.3 ciphers:
    • TLS_AES_256_GCM_SHA384
    • TLS_CHACHA20_POLY1305_SHA256
    • TLS_AES_128_GCM_SHA256
  • TLS 1.2 ciphers:
    • ECDHE-ECDSA-AES256-GCM-SHA384
    • ECDHE-RSA-AES256-GCM-SHA384
    • ECDHE-ECDSA-AES128-GCM-SHA256
    • ECDHE-RSA-AES128-GCM-SHA256
    • ECDHE-ECDSA-AES256-SHA384
    • ECDHE-RSA-AES256-SHA384
    • ECDHE-ECDSA-AES128-SHA256
    • ECDHE-RSA-AES128-SHA256

Modifying TLS Settings on Registered Hosts

To update the TLS protocol mode on hosts that have already been registered:

  1. Stop the mount service: navencrypt-mount

  2. Modify the remote entry in /etc/navencrypt/keytrustee/ztrustee.conf to specify TLS12, TLS12_AND_TLS13, or TLS13.

  3. Validate the configuration: sudo navencrypt key --verify --only-keytrustee

  4. Restart the mount service: navencrypt-mount