Installing Cloudera Navigator Key Trustee Server

You can install Navigator Key Trustee Server using Cloudera Manager with parcels or using the command line with packages. See Parcels for more information on parcels.

Prerequisites

See Data at Rest Encryption Requirements for more information about encryption and Key Trustee Server requirements.

Setting Up an Internal Repository

You must create an internal repository to install or upgrade the Cloudera Navigator data encryption components. For instructions on creating internal repositories (including Cloudera Manager, CDH, and Cloudera Navigator encryption components), see the following topics:

Installing Key Trustee Server

Installing Key Trustee Server Using Cloudera Manager

If you are installing Key Trustee Server for use with HDFS Transparent Encryption, the Set up HDFS Data At Rest Encryption wizard installs and configures Key Trustee Server. See Enabling HDFS Encryption Using the Wizard for instructions.

(Recommended) Create a new cluster in Cloudera Manager containing only the host that Key Trustee Server will be installed on. Cloudera recommends that each cluster use its own KTS instance. Although sharing a single KTS across clusters is technically possible, it is neither approved nor supported for security reasons—specifically, the increased security risks associated with single point of failure for encryption keys used by multiple clusters. For a better understanding of additional security reasons for this recommendation, see Data at Rest Encryption Reference Architecture. See Adding and Deleting Clusters for instructions on how to create a new cluster in Cloudera Manager.
Important: The Add Cluster wizard prompts you to install CDH and other cluster services. To exit the wizard without installing CDH, select a version of CDH to install and continue. When the installation begins, click the Cloudera Manager logo in the upper left corner and confirm you want to exit the wizard. This allows you to create the dedicated cluster with the Key Trustee Server hosts without installing CDH or other services that are not required for Key Trustee Server.
Add the internal parcel repository you created in Setting Up an Internal Repository to Cloudera Manager following the instructions in Configuring Cloudera Manager Server Parcel Settings.
Download, distribute, and activate the Key Trustee Server parcel on the cluster containing the Key Trustee Server host, following the instructions in Managing Parcels.
Important: The KEYTRUSTEE parcel in Cloudera Manager is not the Key Trustee Server parcel; it is the Key Trustee KMS parcel. The parcel name for Key Trustee Server is KEYTRUSTEE_SERVER.
After you activate the Key Trustee Server parcel, Cloudera Manager prompts you to restart the cluster. Click the Close button to ignore this prompt. You do not need to restart the cluster after installing Key Trustee Server.

After installing Key Trustee Server using Cloudera Manager, continue to Securing Key Trustee Server Host.

Installing Key Trustee Server Using the Command Line

Install the EPEL Repository
Dependent packages are available through the Extra Packages for Enterprise Linux (EPEL) repository. To install the EPEL repository, install the epel-release package:
1. Copy the URL for the epel-release-<version>.noarch file for RHEL 6 or RHEL 7 located in the How can I use these extra packages? section of the EPEL wiki page.
2. Run the following commands to install the EPEL repository:
```
sudo wget <epel_rpm_url>
sudo yum install epel-release-<version>.noarch.rpm
```
  Replace <version> with the version number of the downloaded RPM (for example, 6-8).
If the epel-release package is already installed, you see a message similar to the following:
```
Examining /var/tmp/yum-root-jmZhL0/epel-release-6-8.noarch.rpm: epel-release-6-8.noarch
/var/tmp/yum-root-jmZhL0/epel-release-6-8.noarch.rpm: does not update installed package.
Error: Nothing to do
```
Confirm that the EPEL repository is installed:
```
sudo yum repolist | grep -i epel
```
(RHEL 7 Only) Enable the extras Repository
Key Trustee Server requires the python-flask package. For RHEL 6, this package is provided in the EPEL repository. For RHEL 7, it is provided in the RHEL extras repository. To enable this repository, run the following command:
```
sudo subscription-manager repos --enable=rhel-7-server-extras-rpms
```
Install the PostgreSQL 9.3 Repository
Note: Cloudera Navigator Key Trustee Server currently supports only PostgreSQL version 9.3. If you have a different version of PostgreSQL installed on the Key Trustee Server host, remove it before proceeding or select a different host on which to install Key Trustee Server.
To install the PostgreSQL 9.3 repository, run the following command:
```
sudo yum install http://yum.postgresql.org/9.3/redhat/rhel-6-x86_64/pgdg-redhat93-9.3-3.noarch.rpm
```
Important: If you are using CentOS, add the following line to the CentOS base repository:
```
exclude=python-psycopg2*
```
By default, the base repository is located at /etc/yum.repos.d/CentOS-Base.repo. If you have an internal mirror of the base repository, update the correct file for your environment.
Install the Cloudera Repository
Add the internal repository you created. See Configuring Hosts to Use the Internal Repository for more information.
Import the GPG key by running the following command:
```
sudo rpm --import http://repo.example.com/path/to/RPM-GPG-KEY-cloudera
```
Install the CDH Repository
Key Trustee Server and Key HSM depend on the bigtop-utils package, which is included in the CDH repository. For instructions on adding the CDH repository, see Configuring a Local Package Repository.
Install NTP
The Network Time Protocol (NTP) service synchronizes system time. Cloudera recommends using NTP to ensure that timestamps in system logs, cryptographic signatures, and other auditable events are consistent across systems. Install and start NTP with the following commands:
```
sudo yum install ntp
sudo service ntpd start
## For RHEL/CentOS 7, use 'sudo systemctl start ntpd' instead ##
```
Install Key Trustee Server
Run the following command to install the Key Trustee Server:
```
sudo yum install keytrustee-server
```
Installing the Key Trustee Server also installs required dependencies, including PostgreSQL 9.3. After the installation completes, confirm that the PostgreSQL version is 9.3 by running the command createuser -V.
Configure Services to Start at Boot
Ensure that ntpd, keytrustee-db, and keytrusteed start automatically at boot:
```
sudo chkconfig ntpd on
sudo chkconfig keytrustee-db on
sudo chkconfig keytrusteed on
```
The chkconfig command provides no output if successful.

Note: The /etc/init.d/postgresql script does not work when the PostgreSQL database is started by Key Trustee Server, and cannot be used to monitor the status of the database. Use /etc/init.d/keytrustee-db instead.

After installing Key Trustee Server, continue to Securing Key Trustee Server Host.

Securing Key Trustee Server Host

Cloudera strongly recommends securing the Key Trustee Server host to protect against unauthorized access to Key Trustee Server. Red Hat provides security guides for RHEL:

Cloudera also recommends configuring the Key Trustee Server host to allow network communication only over certain ports.

You can use the following examples to create iptables rules for an EDH cluster. Add any other ports required by your environment, subject to your organization security policies. Note that in this example port 5432 is the database port for the Key Trustee database on legacy machines (prior to release 5.5). Port 11371 is the current port on which Key Trustee communicates, and port 11381 is the database port. Exercise caution if blocking other ports, as this can cause a disruption in service. See Ports Used by Cloudera Manager and Cloudera Navigator for details about ports used with the Key Trustee Server.

# Flush iptables
iptables -F
iptables -X

# Allow unlimited traffic on loopback (localhost) connection
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established, related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Open all Cloudera Manager ports to allow Key Trustee Server to work properly

iptables -A INPUT -p tcp -m tcp --dport 5432 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 11371 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 11381 -j ACCEPT

# Drop all other connections
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# Save iptables rules so that they're loaded if the system is restarted
sed 's/IPTABLES_SAVE_ON_STOP="no"/IPTABLES_SAVE_ON_STOP="yes"/' -i /etc/sysconfig/iptables-config
sed 's/IPTABLES_SAVE_ON_RESTART="no"/IPTABLES_SAVE_ON_RESTART="yes"/' -i /etc/sysconfig/iptables-config

Leveraging Native Processor Instruction Sets

AES-NI

The Advanced Encryption Standard New Instructions (AES-NI) instruction set is designed to improve the speed of encryption and decryption using AES. Some newer processors come with AES-NI, which can be enabled on a per-server basis. If you are uncertain whether AES-NI is available on a device, run the following command to verify:

grep -o aes /proc/cpuinfo

To determine whether the AES-NI kernel module is loaded, run the following command:

sudo lsmod | grep aesni

If the CPU supports AES-NI but the kernel module is not loaded, see your operating system documentation for instructions on installing the aesni-intel module.

Intel RDRAND

The Intel RDRAND instruction set, along with its underlying Digital Random Number Generator (DRNG), is useful for generating keys for cryptographic protocols without using haveged.

To determine whether the CPU supports RDRAND, run the following command:

grep -o rdrand /proc/cpuinfo

To enable RDRAND, install rng-tools version 4 or higher:

Download the source code:

sudo wget http://downloads.sourceforge.net/project/gkernel/rng-tools/4/rng-tools-4.tar.gz

Extract the source code:
```
tar xvfz rng-tools-4.tar.gz
```
Enter the rng-tools-4 directory:
```
cd rng-tools-4
```
Run ./configure.
Run make.
Run make install.

Start rngd with the following command:

sudo rngd --no-tpm=1 -o /dev/random

Initializing Key Trustee Server

After installing Key Trustee Server, you must initialize it before it is operational. Continue to Initializing Standalone Key Trustee Server or Cloudera Navigator Key Trustee Server High Availability for instructions.

Installing Navigator Encryption

Installing Cloudera Navigator Key HSM