Differences between revisions 9 and 17 (spanning 8 versions)
Revision 9 as of 2017-12-24 17:20:44
Size: 2076
Comment:
Revision 17 as of 2017-12-24 17:31:08
Size: 1452
Comment:
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
== Keys ==
Make an encryption key on each of the servers
Line 4: Line 6:
{{{#!highlight bash
#!/bin/sh
if [ ! -e /etc/ssl/glusterfs ]
then
        mkdir -p /etc/ssl/glusterfs
fi
On gluster01
{{{
mkdir /etc/ssl/glusterfs
cd /etc/ssl/glusterfs
openssl genrsa -out gluster01.key 2048
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
}}}
Line 11: Line 14:
cd /etc/ssl/glusterfs Certificates
Sign a certificate using the key
{{{
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
}}}
Line 13: Line 20:
{{{
Line 18: Line 26:
Line 24: Line 31:
Line 27: Line 33:
Line 30: Line 35:
Line 32: Line 36:
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem glusterclient01.pem www01.pem www02.pem > glusterfs.ca cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem glusterclient01.pem > glusterfs.ca
Line 36: Line 40:

== Keys ==

On each of the Glusterfs servers and clients run.
{{{
mkdir /etc/ssl/glusterfs
cd /etc/ssl/glusterfs
openssl genrsa -out glusterfs.key 2048
}}}

== Certificates ==
Now sign certificates using those keys. Replace the `CN` so it matches the host you are siging the certificate for.
{{{
openssl req -new -x509 -key glusterfs.key -subj "/CN=gluster01" -out glusterfs.pem
}}}

== Compile ==

Compile all the certificates into one large file
{{{
scp gluster01:/etc/ssl/glusterfs/gluster.pem gluster01.pem
scp gluster02:/etc/ssl/glusterfs/gluster.pem gluster02.pem
scp gluster03:/etc/ssl/glusterfs/gluster.pem gluster03.pem
scp gluster04:/etc/ssl/glusterfs/gluster.pem gluster04.pem
scp glusterclient01:/etc/ssl/glusterfs/gluster.pem glusterclient01.pem
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem > glusterfs.ca
}}}

GlusterFS Encryption

Keys

Make an encryption key on each of the servers

On gluster01

mkdir /etc/ssl/glusterfs
cd /etc/ssl/glusterfs
openssl genrsa -out gluster01.key 2048
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem

Certificates Sign a certificate using the key

openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem

# create the server keys
openssl genrsa -out gluster01.key 2048
openssl genrsa -out gluster02.key 2048
openssl genrsa -out gluster03.key 2048
openssl genrsa -out gluster04.key 2048
# sign the server certificates
openssl req -new -x509 -key gluster01.key -subj "/CN=gluster01" -out gluster01.pem
openssl req -new -x509 -key gluster02.key -subj "/CN=gluster02" -out gluster02.pem
openssl req -new -x509 -key gluster03.key -subj "/CN=gluster03" -out gluster03.pem
openssl req -new -x509 -key gluster04.key -subj "/CN=gluster04" -out gluster04.pem
# create the client keys
openssl genrsa -out glusterclient01.key 2048
# sign the client certificates
openssl req -new -x509 -key glusterclient01.key -subj "/CN=glusterclient01" -out glusterclient01.pem
# server certificates authorities
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem glusterclient01.pem > glusterfs.ca
# client certificates authorities
cat gluster01.pem gluster02.pem gluster03.pem gluster04.pem > glusterfs-client.ca

None: GlusterFS Encryption (last edited 2021-03-26 21:25:57 by Kristian Kallenberg)