Upgrading Cloudera Navigator Encrypt

Before you begin the upgrade process, refer to Product Compatibility Matrix for Cloudera Navigator Encryption and ensure that you have the minimum requisite operating system version(s) installed.

1. Install the Cloudera Repository

   Add the internal repository you created. See Configuring Hosts to Use the Internal Repository for more information.

   Import the GPG key by running the following command:

   sudo rpm --import http://repo.example.com/path/to/gpg_gazzang.asc

2. Stop Navigator Encrypt
   Stop the Navigator Encrypt service:

   sudo service navencrypt-mount stop

   For RHEL 7, use systemctl instead:

   sudo systemctl stop navencrypt-mount

3. Upgrade Navigator Encrypt
   Upgrade the Navigator Encrypt client using yum:

   sudo yum update navencrypt

4. Start Navigator Encrypt
   Start the Navigator Encrypt service:

   sudo service navencrypt-mount start

   For RHEL 7, use systemctl instead:

   sudo systemctl start navencrypt-mount

5. If you are using an RSA master key file, change the master key to use OAEP padding:

   
   # navencrypt key --change --rsa-oaep
   ...
   >> Choose NEW MASTER key type:
    1) Passphrase (single)
    2) Passphrase (dual)
    3) RSA private key
   Select: 3
   Type MASTER RSA key file:
   Type MASTER RSA key passphrase:
   

   To check the type of padding currently in use:

   
   # navencrypt key --get-rsa-padding
   Type your Master key
   Type MASTER RSA key file:
   Type MASTER RSA key passphrase:
   
   Verifying Master Key against keytrustee (wait a moment)...
   RSA_PKCS1_OAEP_PADDING
   

1. Install the Cloudera Repository

   Add the internal repository that you created. See Configuring Hosts to Use the Internal Repository for more information.

   Import the GPG key by running the following command:

   sudo rpm --import http://repo.example.com/path/to/gpg_gazzang.asc

2. Stop Navigator Encrypt
   Stop the Navigator Encrypt service:

   sudo service navencrypt-mount stop

3. Upgrade the Kernel Module Package (KMP)

   sudo zypper update cloudera-navencryptfs-kmp-<kernel_flavor>

   Replace kernel_flavor with the kernel flavor for your system. Navigator Encrypt supports the default, xen, and ec2 kernel flavors.

4. Upgrade the Navigator Encrypt Client

   Upgrade Navigator Encrypt:

   sudo zypper update navencrypt

5. Enable Unsupported Modules
   Edit /etc/modprobe.d/unsupported-modules and set allow_unsupported_modules to 1. For example:

   
   #
   # Every kernel module has a flag 'supported'. If this flag is not set loading
   # this module will taint your kernel. You will not get much help with a kernel
   # problem if your kernel is marked as tainted. In this case you firstly have
   # to avoid loading of unsupported modules.
   #
   # Setting allow_unsupported_modules 1 enables loading of unsupported modules
   # by modprobe, setting allow_unsupported_modules 0 disables it. This can
   # be overridden using the --allow-unsupported-modules command line switch.
   allow_unsupported_modules 1

6. Start Navigator Encrypt
   Start the Navigator Encrypt service:

   sudo service navencrypt-mount start

7. If using an RSA master key file, then you should change the master key to use OAEP padding:

   
   # navencrypt key --change --rsa-oaep
   ...
   >> Choose NEW MASTER key type:
    1) Passphrase (single)
    2) Passphrase (dual)
    3) RSA private key
   Select: 3
   Type MASTER RSA key file:
   Type MASTER RSA key passphrase:

   To check the type of padding currently in use:

   
   # navencrypt key --get-rsa-padding
   Type your Master key
   Type MASTER RSA key file:
   Type MASTER RSA key passphrase:
   
   Verifying Master Key against keytrustee (wait a moment)...
   RSA_PKCS1_OAEP_PADDING

1. Install the Cloudera Repository
   Add the internal repository that you created. See Configuring Hosts to Use the Internal Repository for more information.

   • Ubuntu

     echo "deb http://repo.example.com/path/to/ubuntu/stable $DISTRIB_CODENAME main" | sudo tee -a /etc/apt/sources.list

   • Debian

     echo "deb http://repo.example.com/path/to/debian/stable $DISTRIB_CODENAME main" | sudo tee -a /etc/apt/sources.list

   Import the GPG key by running the following command:

   wget -O - http://repo.example.com/path/to/gpg_gazzang.asc | apt-key add -

   Update the repository index with apt-get update.

2. Stop Navigator Encrypt
   Stop the Navigator Encrypt service:

   sudo service navencrypt-mount stop

3. Upgrade the Navigator Encrypt Client

   Upgrade Navigator Encrypt:

   sudo apt-get install navencrypt

4. Start Navigator Encrypt
   Start the Navigator Encrypt service:

   sudo service navencrypt-mount start

5. If using an RSA master key file, then you should change the master key to use OAEP padding:

   
   # navencrypt key --change --rsa-oaep
   ...
   >> Choose NEW MASTER key type:
    1) Passphrase (single)
    2) Passphrase (dual)
    3) RSA private key
   Select: 3
   Type MASTER RSA key file:
   Type MASTER RSA key passphrase: 
   

   To check the type of padding currently in use:

   
   # navencrypt key --get-rsa-padding
   Type your Master key
   Type MASTER RSA key file:
   Type MASTER RSA key passphrase:
   
   Verifying Master Key against keytrustee (wait a moment)...
   RSA_PKCS1_OAEP_PADDING