Isilon: OneFS How to Configure SyncIQ Policies to Use SSL Encryption

摘要: Steps on how to create, validate, and use SSL certificates with SyncIQ policies in 8.2 and later.

本文适用于 本文不适用于 本文并非针对某种特定的产品。 本文并非包含所有产品版本。
查看其他资源

说明

In relation to Dell KB article 153928: DSA-2020-039: Dell Isilon OneFS Security Update for a SyncIQ Vulnerability and the requirement to use SyncIQ along side with SSL encryption.

Below are steps on how to configure that in a LAB.

Note:    

  1. Certificates used below are created in a lab using the OpenSSL utility. However, customers are free to use their own certificates based on their specific security requirements.
  2. In our example, the validity period is set to 365 days (one year). Follow up-to-date industry standards and local security policies when entering the length of the validity period, key type, key size, and hashing algorithm
  3. All certificates generated, including the Certificate Authority (CA) certificate, must have a unique Common Name (CN) value.


Procedure:      

  1. Create a CA self-signed certificate:       
Source-1# mkdir /ifs/data/Isilon_Support/synciq_certs
Source-1# chmod 700 /ifs/data/Isilon_Support/synciq_certs
Source-1# cd /ifs/data/Isilon_Support/synciq_certs
Source-1# openssl req -new -newkey rsa:4096 -sha256 -nodes -out ca.csr -keyout ca.key
Source-1# openssl x509 -days 365 -trustout -signkey ca.key -req -in ca.csr -out ca.crt
Signature ok
subject=/C=XX/ST=Some-State/L=city/O=XXXX/OU=section/CN=isilon.lab
Getting Private key
Source-1# openssl x509 -in ca.crt -outform PEM -out ca.pem
Source-1# ls ca*
ca.crt  ca.csr  ca.key  ca.pem
  1. Create a source certificate "child cert" and sign it against the CA created in step 1.
Source-1# openssl req -new -newkey rsa:4096 -sha256 -nodes -out source.csr -keyout source.key
Source-1# openssl x509 -days 365 -req -in source.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out source.crt
Signature ok
subject=/C=XX/ST=Some-State/L=city/O=XXXX/OU=section/CN=source.isilon.lab
Getting CA Private Key
Source-1# openssl x509 -in source.crt -outform PEM -out source.pem
Source-1# ls source*
source.crt      source.csr      source.key      source.pem
Source-1# openssl verify -CAfile ca.pem source.pem
source.pem: OK
  1. Create a target certificate "child cert" and sign it against the CA created in step 1.
Source-1# openssl req -new -newkey rsa:4096 -sha256 -nodes -out target.csr -keyout target.key
Source-1# openssl x509 -days 365 -req -in target.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out target.crt
Signature ok
subject=/C=XX/ST=Some-State/L=city/O=XXXX/OU=section/CN=target.isilon.lab
Getting CA Private Key
Source-1# openssl x509 -in target.crt -outform PEM -out target.pem
Source-1# ls target*
target.crt      target.csr      target.key      target.pem
Source-1# openssl verify -CAfile ca.pem target.pem
target.pem: OK
  1. Copy required certificates and keys to the Target cluster. 
Target-1# mkdir /ifs/data/Isilon_Support/synciq_certs
Source-1# scp target.* xxx.xxx.xxx.xxx:/ifs/data/Isilon_Support/synciq_certs
Source-1# scp source.pem xxx.xxx.xxx.xxx:/ifs/data/Isilon_Support/synciq_certs
Source-1# scp ca.pem xxx.xxx.xxx.xxx:/ifs/data/Isilon_Support/synciq_certs

On Source Cluster:     

  1. Create a SyncIQ policy for testing:     
Source-1# mkdir /ifs/data/<test-dir-name>
Source-1# isi sync policies create --name=Test_SSL --source-root-path=/ifs/data/<test-dir-name> --target-host=xxx.xxx.xxx.xxx --target-path=/ifs/data/<test-dir-name> --action=sync
  1. Import the CA certificate to the Isilon Certificate store. 
Source-1# isi certificate authority import --name=CA_Sync --certificate-path=/ifs/data/Isilon_Support/synciq_certs/ca.pem 
  1. Import the source certificate and the key into the SyncIQ Server Certificate Store, then update the global SyncIQ configuration with the ID of the imported certificate.
Source-1# isi sync certificates server import --certificate-path=/ifs/data/Isilon_Support/synciq_certs/source.pem --certificate-key-path=/ifs/data/Isilon_Support/synciq_certs/source.key
Source-1# isi sync certificates server list -v
          ID: e0a3377a5ed27808bbd8eba759d90335060ac53dc6f4da1f15fcb6c44ac743a8
        Name:
 Description:
     Subject: C=XX, ST=Some-State, L=city, O=XXXX, OU=section, CN=source.isilon.lab
      Issuer: C=XX, ST=Some-State, L=city, O=XXXX, OU=section, CN=isilon.lab
      Status: valid
  Not Before: 2020-05-03T08:27:42
   Not After: 2025-05-03T08:27:42
Fingerprints
            Type: SHA1
           Value: b5:d1:21:30:a6:b5:ed:79:65:7d:e6:e3:6f:10:a8:23:63:81:2b:1c

            Type: SHA256
           Value: e0:a3:37:7a:5e:d2:78:08:bb:d8:eb:a7:59:d9:03:35:06:0a:c5:3d:c6:f4:da:1f:15:fc:b6:c4:4a:c7:43:a8

Source-1# isi sync settings modify --cluster-certificate-id=e0a3377a5ed27808bbd8eba759d90335060ac53dc6f4da1f15fcb6c44ac743a8
  1. Import the target certificate into the SyncIQ Peer Certificate Store.
Source-1# isi sync certificates peer import --certificate-path=/ifs/data/Isilon_Support/synciq_certs/target.pem
Source-1# isi sync certificates peer list -v
          ID: 3180c616bae639c27b422f0c4608855d6888f20327ca85e9e869733e85bf5b06
        Name:
 Description:
     Subject: C=XX, ST=Some-State, L=city, O=XXXX, OU=section, CN=target.isilon.lab
      Issuer: C=XX, ST=Some-State, L=city, O=XXXX, OU=section, CN=isilon.lab
      Status: valid
  Not Before: 2020-05-03T08:43:06
   Not After: 2025-05-03T08:43:06
Fingerprints
            Type: SHA1
           Value: 8e:12:52:c1:8c:12:1d:f8:ed:cf:da:8e:3d:3c:a3:47:21:79:43:0d

            Type: SHA256
           Value: 31:80:c6:16:ba:e6:39:c2:7b:42:2f:0c:46:08:85:5d:68:88:f2:03:27:ca:85:e9:e8:69:73:3e:85:bf:5b:06
  1. Modify the SyncIQ policy to use the ID of the imported target certificate
Source-1# isi sync policies modify --policy=Test_SSL --target-certificate-id=3180c616bae639c27b422f0c4608855d6888f20327ca85e9e869733e85bf5b06

On Target:      

  1. Import the CA certificate to the Isilon Certificate store.
Target-1# isi certificate authority import --name=CA_Sync --certificate-path=/ifs/data/Isilon_Support/synciq_certs/ca.pem
  1. Import the source certificate into the SyncIQ Peer Certificate Store.
Target-1# isi sync certificates peer import --certificate-path=/ifs/data/Isilon_Support/synciq_certs/source.pem
  1. Import the target certificate and the key into the SyncIQ Server Certificate Store, and update the global SyncIQ configuration with the ID of imported certificate.
Target-1# isi sync certificates server import --certificate-path=/ifs/data/Isilon_Support/synciq_certs/target.pem --certificate-key-path=/ifs/data/Isilon_Support/synciq_certs/target.key
Target-1# isi sync certificates server list -v
          ID: 3180c616bae639c27b422f0c4608855d6888f20327ca85e9e869733e85bf5b06
        Name:
 Description:
     Subject: C=XX, ST=Some-State, L=city, O=XXXX, OU=section, CN=target.isilon.lab
      Issuer: C=XX, ST=Some-State, L=city, O=XXXX, OU=section, CN=isilon.lab
      Status: valid
  Not Before: 2020-05-03T08:43:06
   Not After: 2025-05-03T08:43:06
Fingerprints
            Type: SHA1
           Value: 8e:12:52:c1:8c:12:1d:f8:ed:cf:da:8e:3d:3c:a3:47:21:79:43:0d

            Type: SHA256
           Value: 31:80:c6:16:ba:e6:39:c2:7b:42:2f:0c:46:08:85:5d:68:88:f2:03:27:ca:85:e9:e8:69:73:3e:85:bf:5b:06

Target-1# isi sync settings modify --cluster-certificate-id=3180c616bae639c27b422f0c4608855d6888f20327ca85e9e869733e85bf5b06


On Source:       

  1. Run the SyncIQ policy and confirm it is running to success. 
Source-1# isi sync jobs start  Test_SSL
2020-05-03T08:56:05+0000 Source-1 siq_coord[14712]coord: Job specified by name Test_SSL
2020-05-03T08:56:05+0000 Source-1 siq_coord[14712]coord[Test_SSL:1588496165]: Starting job 'Test_SSL' (e5fc89d623dda31b58437c86c59cbdfb)
2020-05-03T08:56:05+0000 Source-1 siq_coord[14712]coord[Test_SSL:1588496165]: Cipher being used for encryption: AES256-GCM-SHA384
...
...
...
2020-05-03T08:56:10+0000 Source-1 siq_coord[14712]coord[Test_SSL:1588496165]: Finished job 'Test_SSL' (e5fc89d623dda31b58437c86c59cbdfb) to xxx.xxx.xxx.xxx in 0h 0m 5s with status success and 0 checksum errors

Notes:       

  • Each cluster has one certificate acting as the cluster certificate from the server store "# isi sync settings modify --cluster-certificate-id."
  • Each policy uses by default cluster's certificate as source certificate.
  • In the peer store, update unique cluster certificate of the target cluster.
  • Configure the policy to use the right certificate of the target "imported in the peer certificate."
  • Consider the following article if extv3 used in the certificate, Dell KB article 186531: Encrypted SyncIQ policies fail with "sslv3 alert unsupported certificate."

受影响的产品

PowerScale OneFS, Isilon SyncIQ
文章属性
文章编号: 000021507
文章类型: How To
上次修改时间: 11 12月 2025
版本:  12
从其他戴尔用户那里查找问题的答案
支持服务
检查您的设备是否在支持服务涵盖的范围内。