Installing Cloudera Navigator Encrypt

Prerequisites

See Data at Rest Encryption Requirements for more information about encryption and Navigator Encrypt requirements.

Setting Up an Internal Repository

You must create an internal repository to install or upgrade Navigator Encrypt. For instructions on creating internal repositories (including Cloudera Manager, CDH, and Cloudera Navigator encryption components), see Creating and Using a Package Repository for Cloudera Manager.

Installing Navigator Encrypt (RHEL-Compatible)

  1. Install the Cloudera Repository

    Add the internal repository you created. See Modifying Clients to Find the Repository for more information.

    Import the GPG key by running the following command:
    $ sudo rpm --import http://archive.gazzang.com/gpg_gazzang.asc
  2. Install Kernel Libraries

    For Navigator Encrypt to run as a kernel module, you must download and install the kernel development headers. Each kernel module is compiled specifically for the underlying kernel version. Running as a kernel module allows Navigator Encrypt to provide high performance and completely transparency to user-space applications.

    To determine your current kernel version, run uname -r.

    To install the development headers for your current kernel version, run:
    $ sudo yum install kernel-headers-$(uname -r) kernel-devel-$(uname -r)
    For OEL with the Unbreakable Enterprise Kernel (UEK), run:
    $ sudo yum install kernel-uek-headers-$(uname -r) kernel-uek-devel-$(uname -r)
    If yum cannot find these packages, it displays an error similar to the following:
    Unable to locate package <packagename>.
    In this case, do one of the following to proceed:
    • Find and install the kernel headers package by using a tool like RPM Pbone .
    • Upgrade your kernel to the latest version. If you upgrade the kernel, you must reboot after upgrading and select the kernel from the grub menu to make it active.
  3. (RHEL or CentOS Only) Install dkms
    Because of a broken dependency in all versions of RHEL or CentOS, you must manually install the dkms package:
    $ sudo yum install http://repository.it4i.cz/mirrors/repoforge/redhat/el6/en/x86_64/rpmforge/RPMS/dkms-2.1.1.2-1.el6.rf.noarch.rpm
  4. Install Navigator Encrypt
    Install the Navigator Encrypt client using the yum package manager:
    $ sudo yum install navencrypt
    If you attempt to install Navigator Encrypt with incorrect or missing kernel headers, you see a message like the following:
    Building navencryptfs 3.8.0 DKMS kernel module...
    
    #################### BUILDING ERROR ####################
    
    
    
    Creating symlink /var/lib/dkms/navencryptfs/3.8.0/source ->
                     /usr/src/navencryptfs-3.8.0
    
    DKMS: add completed.
    Error! echo
    Your kernel headers for kernel 3.10.0-229.4.2.el7.x86_64 cannot be found at
    /lib/modules/3.10.0-229.4.2.el7.x86_64/build or /lib/modules/3.10.0-229.4.2.el7.x86_64/source.
    
    #################### BUILDING ERROR ####################
    
    Failed installation of navencryptfs 3.8.0 DKMS kernel module !

    To recover, see Navigator Encrypt Kernel Module Setup.

Installing Navigator Encrypt (SLES)

  1. Install the Cloudera Repository

    Add the internal repository you created. See Modifying Clients to Find the Repository for more information.

    Import the GPG key by running the following command:
    $ sudo rpm --import http://archive.gazzang.com/gpg_gazzang.asc
  2. Install NTP
    The Network Time Protocol (NTP) service synchronizes system time. Cloudera recommends using NTP to ensure that timestamps in system logs, cryptographic signatures, and other auditable events are consistent across systems. Install and start NTP with the following commands:
    $ sudo zypper install ntp
    # /etc/init.d/ntp start
  3. Install the Kernel Module Package and Navigator Encrypt Client

    Install the kernel module package (KMP) and Navigator Encrypt client with zypper:

    $ sudo zypper install cloudera-navencryptfs-kmp-<kernel_flavor>
    $ sudo zypper install navencrypt

    Replace <kernel_flavor> with the kernel flavor for your system. Navigator Encrypt supports the default, xen, and ec2 kernel flavors.

  4. Enable Unsupported Modules
    Edit /etc/modprobe.d/unsupported-modules and set allow_unsupported_modules to 1. For example:
    #
    # Every kernel module has a flag 'supported'. If this flag is not set loading
    # this module will taint your kernel. You will not get much help with a kernel
    # problem if your kernel is marked as tainted. In this case you firstly have
    # to avoid loading of unsupported modules.
    #
    # Setting allow_unsupported_modules 1 enables loading of unsupported modules
    # by modprobe, setting allow_unsupported_modules 0 disables it. This can
    # be overridden using the --allow-unsupported-modules command line switch.
    allow_unsupported_modules 1

Installing Navigator Encrypt (Debian or Ubuntu)

  1. Install the Cloudera Repository
    Add the internal repository you created. See Modifying Clients to Find the Repository for more information.
    • Ubuntu
      $ echo "deb http://repo.example.com/path/to/ubuntu/stable $DISTRIB_CODENAME main" | sudo tee -a /etc/apt/sources.list
    • Debian
      $ echo "deb http://repo.example.com/path/to/debian/stable $DISTRIB_CODENAME main" | sudo tee -a /etc/apt/sources.list
    Import the GPG key by running the following command:
    $ wget -O - http://archive.gazzang.com/gpg_gazzang.asc | apt-key add -

    Update the repository index with apt-get update.

  2. Install NTP
    The Network Time Protocol (NTP) service synchronizes system time. Cloudera recommends using NTP to ensure that timestamps in system logs, cryptographic signatures, and other auditable events are consistent across systems. Install and start NTP with the following commands:
    $ sudo apt-get install ntp
    $ sudo /etc/init.d/ntp start
  3. Install Kernel Headers
    Determine your kernel version by running uname -r, and install the appropriate headers:
    $ sudo apt-get install linux-headers-$(uname -r)
  4. Install the Navigator Encrypt Client
    Install Navigator Encrypt:
    $ sudo apt-get install navencrypt

Post Installation

To ensure that Navigator Encrypt and NTP start after a reboot, add them to the start order with chkconfig:
$ sudo chkconfig --level 235 navencrypt-mount on
$ sudo chkconfig --level 235 ntpd on

AES-NI and RDRAND

The Advanced Encryption Standard New Instructions (AES-NI) instruction set is designed to improve the speed of encryption and decryption using AES. Some newer processors come with AES-NI, which can be enabled on a per-server basis.

Both the eCryptfs and dm-crypt back ends for Navigator Encrypt can automatically detect and use AES-NI if it is available. If you are uncertain whether AES-NI is available on a device, run the following command to verify:
$ grep -o aes /proc/cpuinfo
To determine whether the AES-NI kernel module is loaded, run the following command:
$ sudo lsmod | grep aesni

If the CPU supports AES-NI but the kernel module is not loaded, see your operating system documentation for instructions on installing the aesni-intel module.

Navigator Encrypt needs a source of random numbers if it is using dm-crypt as its back end. Use rng-tools version 4 or higher to seed the system’s entropy pool, using the RDRAND instruction. To install and start rngd:
  1. Download the source code:
    $ sudo wget http://downloads.sourceforge.net/project/gkernel/rng-tools/4/rng-tools-4.tar.gz
  2. Extract the source code:
    tar xvfz rng-tools-4.tar.gz
  3. Enter the rng-tools-4 directory:
    $ cd rng-tools-4
  4. Run ./configure
  5. Run make
  6. Run make install
Once you have installed rng-tools, start the rngd daemon by running the following command as root:
$ sudo rngd --no-tpm=1 -o /dev/random

For improved performance, Cloudera recommends configuring Navigator Encrypt to read directly from /dev/random instead of /dev/urandom.

To configure Navigator Encrypt to use /dev/random as an entropy source, add --use-random to the navencrypt-prepare command when you are setting up Navigator Encrypt.

Uninstalling and Reinstalling Navigator Encrypt

Uninstalling Navigator Encrypt

For RHEL-compatible OSes:
$ sudo yum remove navencrypt
$ sudo yum remove navencrypt-kernel-module

These commands remove the software itself. On RHEL-compatible OSes, the /etc/navencrypt directory is not removed as part of the uninstallation. Remove it manually if required.

Reinstalling Navigator Encrypt

After uninstalling Navigator Encrypt, repeat the installation instructions for your distribution in Installing Cloudera Navigator Encrypt.

When Navigator Encrypt is uninstalled, the configuration files and directories located in /etc/navencrypt are not removed. Consequently, you do not need to use the navencrypt register command during reinstallation. If you no longer require the previous installation configuration information in the directory /etc/navencrypt, you can remove its contents.