This is the documentation for Cloudera Enterprise 5.8.x. Documentation for other versions is available at Cloudera Documentation.

Data at Rest Encryption Requirements

Encryption comprises several components, each with its own requirements. See Cloudera Navigator Data Encryption Overview for more information on the components, concepts, and architecture for encrypting data at rest.

Continue reading:

Product Compatibility Matrix

See Product Compatibility Matrix for Cloudera Navigator Encryption for the individual compatibility matrices for each Cloudera Navigator encryption component.

Entropy Requirements

Cryptographic operations require entropy to ensure randomness.

You can check the available entropy on a Linux system by running the following command: 
$ cat /proc/sys/kernel/random/entropy_avail
The output displays the entropy currently available. Check the entropy several times to determine the state of the entropy pool on the system. If the entropy is consistently low (500 or less), you must increase it by installing rng-tools and starting the rngd service. Run the following commands on RHEL 6-compatible systems: 
$ sudo yum install rng-tools
$ sudo echo 'EXTRAOPTIONS="-r /dev/urandom"' >> /etc/sysconfig/rngd
$ sudo service rngd start
$ sudo chkconfig rngd on
For RHEL 7, run the following commands: 
$ cp /usr/lib/systemd/system/rngd.service /etc/systemd/system/
$ sed -i -e 's/ExecStart=\/sbin\/rngd -f/ExecStart=\/sbin\/rngd -f -r \/dev\/urandom/' /etc/systemd/system/rngd.service
$ systemctl daemon-reload
$ systemctl start rngd
$ systemctl enable rngd

Make sure that the hosts running Key Trustee Server, Key Trustee KMS, and Navigator Encrypt have sufficient entropy to perform cryptographic operations.

Key Trustee Server Requirements

Recommended Hardware and Supported Distributions

Cloudera recommends that the Key Trustee Server be installed on a dedicated server or virtual machine (VM) that is not used for any other purpose. The backing PostgreSQL database must be installed on the same host as the Key Trustee Server, and must not be shared with any other services. For high availability, the active and passive Key Trustee Servers must not share physical resources. See Resource Planning for Data at Rest Encryption for more information.

The recommended minimum hardware specifications are as follows:

  • Processor: 1 GHz 64-bit quad core
  • Memory: 8 GB RAM
  • Storage: 20 GB on moderate- to high-performance disk drives

Key Trustee Server supports the following Linux distributions:

  • RHEL and CentOS: 6.4, 6.5, 6.6, 6.7, 7.1, 7.2

Cloudera Manager Requirements

Installing and managing Key Trustee Server using Cloudera Manager requires Cloudera Manager 5.4.0 and higher. Key Trustee Server does not require Cloudera Navigator Audit Server or Metadata Server.

SELinux Requirements

SELinux must be disabled for Key Trustee installation and operation. Modify /etc/selinux/config to set SELINUX=disabled and reboot the system for the change to take effect.

umask Requirements

Key Trustee Server installation requires the default umask of 0022.

Network Requirements

For new Key Trustee Server installations (5.4.0 and higher) and migrated upgrades (see Migrate Apache Web Server to CherryPy for more information), Key Trustee Server requires the following TCP ports to be opened for inbound traffic:

  • 11371

    Clients connect to this port over HTTPS.

  • 11381 (PostgreSQL)

    The passive Key Trustee Server connects to this port for database replication.

For upgrades that are not migrated to the CherryPy web server, the pre-upgrade port settings are preserved:

  • 80

    Clients connect to this port over HTTP to obtain the Key Trustee Server public key.

  • 443 (HTTPS)

    Clients connect to this port over HTTPS.

  • 5432 (PostgreSQL)

    The passive Key Trustee Server connects to this port for database replication.

TLS Certificate Requirements

To ensure secure network traffic, Cloudera recommends obtaining Transport Layer Security (TLS) certificates specific to the hostname of your Key Trustee Server. To obtain the certificate, generate a Certificate Signing Request (CSR) for the fully qualified domain name (FQDN) of the Key Trustee Server host. The CSR must be signed by a trusted Certificate Authority (CA). After the certificate has been verified and signed by the CA, the Key Trustee Server TLS configuration requires:

  • The CA-signed certificate
  • The private key used to generate the original CSR
  • The intermediate certificate/chain file (provided by the CA)

Cloudera recommends not using self-signed certificates. If you use self-signed certificates, you must use the --skip-ssl-check parameter when registering Navigator Encrypt with the Key Trustee Server. This skips TLS hostname validation, which safeguards against certain network-level attacks. For more information regarding insecure mode, see Registration Options.

Key Trustee KMS Requirements

Recommended Hardware and Supported Distributions

The recommended minimum hardware specifications are as follows:

  • Processor: 2 GHz 64-bit quad core
  • Memory: 16 GB RAM
  • Storage: 40 GB on moderate- to high-performance disk drives

Key Trustee KMS supports the following Linux distributions:

  • RHEL and CentOS: 5.7, 5.10, 6.4, 6.5, 6.6, 6.7, 7.1, 7.2
  • Oracle Enterprise Linux: 5.7, 5.10, 5.11, 6.4, 6.5, 6.6, 6.7, 7.1, 7.2
  • SLES: 11 SP2, 11 SP3, 11 SP4
  • Debian: 7.1, 7.8
  • Ubuntu: 12.04, 14.04

The Key Trustee KMS workload is CPU-intensive. Cloudera recommends using machines with capabilities equivalent to your NameNode hosts, with Intel CPUs that support AES-NI for optimum performance.

Key HSM Requirements

The following are prerequisites for installing Navigator Key HSM:

  • Supported operating systems:
    • RHEL and CentOS: 6.4, 6.5, 6.6, 6.7, 7.1, 7.2
  • Oracle Java Runtime Environment (JRE) 7 or higher with Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files:
  • A supported HSM device:
    • SafeNet Luna
      • HSM firmware version: 6.2.1
      • HSM software version: 5.2.3-1
    • SafeNet KeySecure
      • HSM firmware version: 6.2.1
      • HSM software version: 8.0.1
    • Thales nSolo, nConnect
      • HSM firmware version: 11.4.0
      • Client software version: 2.28.9cam136
  • Key Trustee Server 3.8 or higher
      Important: You must install Key HSM on the same host as Key Trustee Server.

Root access is required to install Navigator Key HSM.

Navigator Encrypt Requirements

Operating System Requirements

  • Linux kernel 2.6.19 or higher (RHEL and CentOS can use 2.6.18-92 or higher)
  • RHEL and CentOS: 5.7, 5.10, 6.4, 6.5, 6.6, 6.7, 7.1, 7.2
  • Oracle Enterprise Linux (Red Hat Compatible Kernel): 6.4, 6.5, 6.6, 6.7, 7.1
  • Oracle Enterprise Linux (Unbreakable Enterprise Kernel 2 or 3): 6.5
  • SLES: 11 SP2, 11 SP3, 11 SP4
      Note: SLES 11 does not support the ext4 filesystem.
  • Debian: 7.1, 7.8
  • Ubuntu: 12.04, 14.04, 14.04.3
  Important: With the exception of Cloudera Navigator Encrypt, Cloudera Enterprise is supported on platforms with Security-Enhanced Linux (SELinux) enabled. However, policies need to be provided by other parties or created by the administrator of the cluster deployment. Cloudera is not responsible for policy support nor policy enforcement, nor for any issues with them. If you experience issues with SELinux, contact your OS support provider.

Supported command-line interpreters:

  • sh (Bourne)
  • bash (Bash)
  • dash (Debian)
  Note: Navigator Encrypt does not support installation or use in chroot environments.

SELinux Requirements

SELinux must be disabled for Key Trustee installation and operation. Modify /etc/selinux/config to set SELINUX=disabled and reboot the system for the change to take effect.

Network Requirements

For new Navigator Key Trustee Server (5.4.0 and higher) installations, Navigator Encrypt initiates TCP traffic over port 11371 (HTTPS) to the Key Trustee Server.

For upgrades and Key Trustee Server versions lower than 5.4.0, Navigator Encrypt initiates TCP traffic over ports 80 (HTTP) and 443 (HTTPS) to the Navigator Key Trustee Server.

Internet Access

You must have an active connection to the Internet to download many package dependencies, unless you have internal repositories or mirrors containing the dependent packages.

Maintenance Window

Data is not accessible during the encryption process. Plan for system downtime during installation and configuration.

Administrative Access

To enforce a high level of security, all Navigator Encrypt commands require administrative (root) access (including installation and configuration). If you do not have administrative privileges on your server, contact your system administrator before proceeding.

Package Dependencies

Navigator Encrypt requires these packages, which are resolved by your distribution package manager during installation:

  • dkms
  • keyutils
  • ecryptfs-utils
  • libkeytrustee
  • navencrypt-kernel-module
  • openssl
  • lsof
  • gcc
  • cryptsetup

These packages may have other dependencies that are also resolved by your package manager. Installation works with gcc, gcc3, and gcc4.

Page generated July 8, 2016.