Differences between revisions 4 and 18 (spanning 14 versions)
⇤ ← Revision 4 as of 2017-12-24 16:53:04 →
Size: 349
Editor: Kristian Kallenberg
Comment:
← Revision 18 as of 2017-12-24 17:31:17 → ⇥
Size: 1457
Editor: Kristian Kallenberg
Comment:
Deletions are marked like this. Additions are marked like this.
Line 4: Line 4:
Make an encryption key on each of the servers
Line 5: Line 6:
On each of the Glusterfs servers and clients run. On gluster01
Line 9: Line 10:
openssl genrsa -out glusterfs.key 2048 openssl genrsa -out gluster01.key 2048
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
Line 13: Line 15:
Now sign certificates using those keys. Sign a certificate using the key
Line 15: Line 17:
openssl req -new -x509 -key glusterfs.key -subj "/CN=gluster01" -out glusterfs.pem openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
Line 17: Line 19:

{{{
# create the server keys
openssl genrsa -out gluster01.key 2048
openssl genrsa -out gluster02.key 2048
openssl genrsa -out gluster03.key 2048
openssl genrsa -out gluster04.key 2048
# sign the server certificates
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
openssl req -new -x509 -key gluster02.key -subj "/CN=gluster02" -out gluster02.pem
openssl req -new -x509 -key gluster03.key -subj "/CN=gluster03" -out gluster03.pem
openssl req -new -x509 -key gluster04.key -subj "/CN=gluster04" -out gluster04.pem
# create the client keys
openssl genrsa -out glusterclient01.key 2048
# sign the client certificates
openssl req -new -x509 -key glusterclient01.key -subj "/CN=glusterclient01" -out glusterclient01.pem
# server certificates authorities
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem glusterclient01.pem > glusterfs.ca
# client certificates authorities
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem > glusterfs-client.ca
}}}

GlusterFS Encryption

Keys

Make an encryption key on each of the servers

On gluster01 

mkdir /etc/ssl/glusterfs
cd /etc/ssl/glusterfs
openssl genrsa -out gluster01.key 2048
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem

Certificates

Sign a certificate using the key 

openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem

# create the server keys
openssl genrsa -out gluster01.key 2048
openssl genrsa -out gluster02.key 2048
openssl genrsa -out gluster03.key 2048
openssl genrsa -out gluster04.key 2048
# sign the server certificates
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
openssl req -new -x509 -key gluster02.key -subj "/CN=gluster02" -out gluster02.pem
openssl req -new -x509 -key gluster03.key -subj "/CN=gluster03" -out gluster03.pem
openssl req -new -x509 -key gluster04.key -subj "/CN=gluster04" -out gluster04.pem
# create the client keys
openssl genrsa -out glusterclient01.key 2048
# sign the client certificates
openssl req -new -x509 -key glusterclient01.key -subj "/CN=glusterclient01" -out glusterclient01.pem
# server certificates authorities
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem glusterclient01.pem > glusterfs.ca
# client certificates authorities
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem > glusterfs-client.ca

None: GlusterFS Encryption (last edited 2021-03-26 21:25:57 by Kristian Kallenberg)