|
Size: 843
Comment:
|
Size: 1457
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 3: | Line 3: |
| == Servers == | == Keys == Make an encryption key on each of the servers |
| Line 5: | Line 6: |
| Once all this works we will continue by adding TLS encryption to the setup. === Keys === On each of the Glusterfs servers run. |
On gluster01 |
| Line 12: | Line 10: |
| openssl genrsa -out glusterfs.key 2048 | openssl genrsa -out gluster01.key 2048 openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem |
| Line 15: | Line 14: |
| === Certificates === Now sign a certificate using that key. |
== Certificates == Sign a certificate using the key |
| Line 18: | Line 17: |
| root@gluster01:/etc/ssl/glusterfs# openssl req -new -x509 -key glusterfs.key -subj "/CN=gluster01" -out glusterfs.pem root@gluster02:/etc/ssl/glusterfs# openssl req -new -x509 -key glusterfs.key -subj "/CN=gluster02" -out glusterfs.pem root@gluster03:/etc/ssl/glusterfs# openssl req -new -x509 -key glusterfs.key -subj "/CN=gluster03" -out glusterfs.pem root@gluster04:/etc/ssl/glusterfs# openssl req -new -x509 -key glusterfs.key -subj "/CN=gluster04" -out glusterfs.pem |
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem |
| Line 24: | Line 20: |
| == Clients == | {{{ # create the server keys openssl genrsa -out gluster01.key 2048 openssl genrsa -out gluster02.key 2048 openssl genrsa -out gluster03.key 2048 openssl genrsa -out gluster04.key 2048 # sign the server certificates openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem openssl req -new -x509 -key gluster02.key -subj "/CN=gluster02" -out gluster02.pem openssl req -new -x509 -key gluster03.key -subj "/CN=gluster03" -out gluster03.pem openssl req -new -x509 -key gluster04.key -subj "/CN=gluster04" -out gluster04.pem # create the client keys openssl genrsa -out glusterclient01.key 2048 # sign the client certificates openssl req -new -x509 -key glusterclient01.key -subj "/CN=glusterclient01" -out glusterclient01.pem # server certificates authorities cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem glusterclient01.pem > glusterfs.ca # client certificates authorities cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem > glusterfs-client.ca }}} |
GlusterFS Encryption
Keys
Make an encryption key on each of the servers
On gluster01
mkdir /etc/ssl/glusterfs cd /etc/ssl/glusterfs openssl genrsa -out gluster01.key 2048 openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
Certificates
Sign a certificate using the key
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
# create the server keys openssl genrsa -out gluster01.key 2048 openssl genrsa -out gluster02.key 2048 openssl genrsa -out gluster03.key 2048 openssl genrsa -out gluster04.key 2048 # sign the server certificates openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem openssl req -new -x509 -key gluster02.key -subj "/CN=gluster02" -out gluster02.pem openssl req -new -x509 -key gluster03.key -subj "/CN=gluster03" -out gluster03.pem openssl req -new -x509 -key gluster04.key -subj "/CN=gluster04" -out gluster04.pem # create the client keys openssl genrsa -out glusterclient01.key 2048 # sign the client certificates openssl req -new -x509 -key glusterclient01.key -subj "/CN=glusterclient01" -out glusterclient01.pem # server certificates authorities cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem glusterclient01.pem > glusterfs.ca # client certificates authorities cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem > glusterfs-client.ca