Thales CTE With Wasabi

Wasabi has been validated for use with Thales CipherTrust Transparent Encryption (CTE). Thales CTE delivers data-at-rest encryption with centralized key management, privileged user access control, and detailed data access audit logging. 

Requirements

• Active Wasabi Cloud Storage Account

• Wasabi Bucket - See our Bucket Creation Guide

• Access and Secret Key Pair - See our Access Keys Guide

• Active Cipher Trust Manager

• Access to CTE 7.3 Software

• Red Hat Enterprise Linux 7 or 8 Instance

Reference Architecture

Creating CTE User and Group

1. Create a CTE User account in your Wasabi Cloud Console. Click on Users. Click Create User.

   

2. Name the user, then select Programmatic (create API key). Click Next.

   

3. Next, click + Create A New Group, name the group CTE, then click Next at the bottom.

   

   Click + Create A New Group and name the group CTE. Then, access the group’s policies and click Next.

   

4. Verify the information, click Create User.

   

5. Download and save your newly created API Key Set for the user, which the CTE Agent will use.

   

Testing Access to Wasabi

1. Copy file to bucket.

   aws s3 cp hello.txt s3://cte-wasabi-demo/ --endpoint-url=https://s3.us-east-1.wasabisys.com

2. Verify the file exists in Wasabi.

   • via cli

   aws s3 ls s3://cte-wasabi-demo/ --endpoint-url=https://s3.us-east-1.wasabisys.com

   Note: This configuration example uses Wasabi’s us-east-1 storage region. To use other Wasabi storage regions, use the appropriate Wasabi service URL as described in our Wasabi Service URLs.

   • via Console

   

Installing AWS CLI

1. Run the following commands to install the AWS CLI.

   curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
   unzip awscliv2.zip
   sudo ./aws/install

2. Configure AWS CLI with the Wasabi User Credentials and Region where the bucket resides.

   aws configure

   

   Note: This configuration example uses Wasabi's us-east-1 storage region. To use other Wasabi storage regions, use the appropriate Wasabi service URL as described in our Wasabi Service URLs.

3. Add CTE cosCA.crt location to the configuration file

   sudo vim .aws/config
   ca_bundle = /opt/vormetric/DataSecurityExpert/agent/squid/etc/cosCA.crt

   

CipherTrust Manager Config

1. Add Registration Token

   • From the CM Console, expand Access Management and click Registration Tokens.

   

2. Click + Add Registration Token.

   

3. Click Begin.

   

4. Enter the name prefix and click Next.

   

5. Click Local under CA Type and click Create Token.

   

6. Copy the Token for later use and click Add Token.

   

   

Creating the Key

1. Click on the Keys menu, then click on +Add Key.

   

2. Enter the following details, click Add Key.

   • Key Name - name of the key

   • Check the box "XTS/CBC CS1

   • Select Encrypt and Decrypt boxes

   

Creating CTE Policy

1. From the Products Menu, click on Transparent Encryption.

   

2. Expand Policies, click Policies, then click + Create Policy.

   

3. Click + Add Security Rule.

   

4. Enter the policy details and click Next.

   • Name — name of the policy

   • Policy Type— Cloud Object Storage

   

5. Create a Security Rule

   • Action — Set to all_ops

   • Effect —Set to Permit, ApplKey. Audit is optional

   Click Add and then Next.

   

6. Create a Key Rule by clicking on + Create Key Rule.

   

7. Click the Select button for the Key Name section.

   

8. Select the key created earlier in the previous steps.

   

9. Click Add.

   

10. Click Save, and now your policy is created.

    

    

Installing CTE Agent on Linux 

Note - Required Linux Packages - https://www.thalesdocs.com/ctp/cte-con/cte/latest/integrations/lin-int/lin-int-cos/lin-int-packages/index.html

1. Run the following commands.

   sudo yum install boost-regex boost-system boost-thread libcurl libtool-ltdl libxml2 epel-release -y
   sudo yum install cryptopp log4cpp -y
   sudo yum install python3 python3-pip -y
   sudo pip3 install boto3 future
   sudo yum install lsof
   sudo yum install policycoreutils-python-utils

Installing CTE with COS Service

Note - CTE for Cloud Object Storage Documentation found here https://www.thalesdocs.com/ctp/cte-con/cte/latest/integrations/lin-int/lin-int-cos/index.html

1. Copy the CTE binary to the RHEL instance

2. Log in as Root and install the CTE Agent

   ./vee-fs-7.3.0-135-rh8-x86_64.bin

3. Enter the details of your environment.
   Be sure to answer Y to Cloud Object Storage.

   

Configuring CTE COS

Add Wasabi Credentials to the CTE COS S3.

voradmin cos s3 cred add BZUACKKCBOERAVKTG15M i52OdrknYzq0nbsq5ptEpmUYHUw0y2BRelibLPwZ
voradmin cos s3 chunk BZUACKKCBOERAVKTG15M i52OdrknYzq0nbsq5ptEpmUYHUw0y2BRelibLPwZ 8

Configuring CTE GuardPoint

1. From the Transparent Encryption Section, expand Clients and click on Clients.

   

2. Click the client name, click + Create GuardPoint.

   

3. Enter GuardPoint Settings, then click on Create.

   • Policy— Select the policy created earlier

   • Type— Auto Cloud Storage

   • URL—URL of the Wasabi bucket

   

4. After a few moments, the GuardPoint will become active.

   

5. You can verify the status of the GuardPoint from the RHEL instance with the following command.

   sudo secfsd -status guard

   

Configuring the AWS CLI Network Proxy

All communications between client applications and the AWS server must be done through the COS proxy, and the environment variable HTTPS_PROXY or https_proxy should be set. If both variables are defined, then the AWS CLI will use https_proxy.

Export HTTPS_PROXY=localhost:3128

Testing CTE COS

1. Copy the file from the RHEL instance to the Wasabi bucket.

   aws s3 cp hello.txt s3://cte-wasabi-demo/ --endpoint-url=https://s3.us-east-1.wasabisys.com

   

   Note: This configuration example uses Wasabi’s us-east-1 storage region. To use other Wasabi storage regions, use the appropriate Wasabi service URL as described in the Wasabi Service URLs.

2. At this point, you should see the ciphertext if accessing the file from the Wasabi console.

   • Click Download File and open.