Maintaining Cloudera Navigator Encrypt

1. To manually back up the Navigator Encrypt configuration directory (/etc/navencrypt):

   $ zip -r --encrypt nav-encrypt-conf.zip /etc/navencrypt

   The --encrypt option prompts you to create a password used to encrypt the zip file. This password is also required to decrypt the file. Ensure that you protect the password by storing it in a secure location.

2. Move the backup file (nav-encrypt-conf.zip) to a secure location.

Navigator Encrypt provides three different access modes:

• Enforcing is the default mode in which Navigator Encrypt validates access from all processes against the ACL. To protect your data, enforcing mode must be enabled.
• Permissive mode causes action="denied" messages to be logged in dmesg. It does not prevent access to the encrypted data. This mode is a dry-run feature to run and build ACL rules.
• Admin mode, as well as permissive mode, does not prevent access to the encrypted data. It allows any process to access the information because the ACL rules are not validated against the process. Admin mode does not cause action="denied" messages to be logged in dmesg.

To view the current access mode, run the following command:

$ sudo /usr/sbin/navencrypt status -d

To change the access mode, use the following command:

$ sudo /usr/sbin/navencrypt set --mode={enforcing|permissive|admin}

To start the Navigator Encrypt module there must be at least one active mount-point. To verify the mount-points status, run the following command:

$ sudo /etc/init.d/navencrypt-mount status

For RHEL 7, use systemctl instead:

$ sudo systemctl status navencrypt-mount

You can verify a key against the Navigator Encrypt module, the Navigator Key Trustee server, or both. For example:

$ sudo /usr/sbin/navencrypt key --verify
$ sudo /usr/sbin/navencrypt key --verify --only-module
$ sudo /usr/sbin/navencrypt key --verify --only-keytrustee

The master key can be changed in the event that another key-type authentication mechanism or a new master key is required. Valid master key types are single-passphrase, dual-passphrase, and RSA key files. To change the master key type, issue the following command and follow the interactive console:

$ sudo /usr/sbin/navencrypt key –-change

The following example demonstrates how to determine when a process fingerprint has been changed and must be updated:

$ sudo /usr/sbin/navencrypt acl --list
Type MASTER passphrase:
# -  Type Category    Path         Profile  Process
1 !! ALLOW @mysql *            /usr/sbin/mysqld
2 ALLOW @log * /usr/sbin/mysqld
3 !! ALLOW @apache * /usr/lib/apache2/mpm-prefork/

The /etc/init.d/navencrypt-mount command mounts all mount points that were registered with the navencrypt-prepare command and are listed in the /etc/navencrypt/ztab file. The possible operations are:

• start
• stop
• status
• restart

The following example shows how to execute navencrypt-mount status with some inactive mount points:

$ sudo /etc/init.d/navencrypt-mount status

The following example shows how to execute the navencrypt-mount stop command:

$ sudo /etc/init.d/navencrypt-mount stop

The following example shows how to execute the navencrypt-mount start command:

$ sudo /etc/init.d/navencrypt-mount start

Here is an example command used to manually mount a directory:

$ sudo /usr/sbin/mount.navencrypt /path/to_encrypted_data/ /path/to/mountpoint

Sometimes running a single operation on encrypted data is required, such as listing the encrypted files or copying a particular file. The navencrypt exec command provides an efficient method to accomplish this. In the following command example, permission is denied when the command is run without navencrypt exec:

$ ls /mnt/db_encrypted/mysql/
ls: cannot open directory /mnt/db_encrypted/mysql/: Permission denied

If the ls command is executed with navencrypt exec, access is allowed one time only:

$ sudo /usr/sbin/navencrypt exec "ls -l /mnt/db_encrypted/mysql/"

The file and directory structure of /etc/navencrypt is as follows:

$ tree /etc/navencrypt/
/etc/navencrypt/
├── control -> /etc/navencrypt/jSpi9SM65xUIIhrau1Nn8ZXmQhrrQ9e363EUz8HKiRs
├── jSpi9SM65xUIIhrau1Nn8ZXmQhrrQ9e363EUz8HKiRs
├── rules
├── ztab
locust
└── keytrustee

├── clientname

├── deposits

│   ├── dev.loop0

│   ├── media.31E5-79B9locustlocust[system ~]# . /etc/*release[system ~]# . /etc/*release

│   ├── mnt.a

│   ├── mnt.encrypted

│   └── mnt.tomount

├── pubring.gpg

├── pubring.gpg~

├── random_seed

├── secring.gpg

├── trustdb.gpg

└── ztrustee.conf

The following files and folders are part of the created file structure:

• control

  File that saves information about the mount points and corresponding Navigator Key Trustee keys.

• rules

  File that contains the ACL rules. It is encrypted with the user-provided master key.

• ztab

  File that contains information about all the mount points and their encryption type.

• keytrustee

  Directory where Navigator Key Trustee GPG keys are stored. These are generated during navencrypt register operations.

• keytrustee/deposits

  Directory where the Navigator Encrypt keys are saved. These are encrypted with the user-provided master key.