Deploying a GREP11 server as a Hyper Protect Container Runtime instance

4.3.1 Generate compose package

Complete the following steps to generate the compose package.

1. Upload grep11server image to a docker registry

   To build Secure Execution VM, it is required to upload the grep11server image to a docker registry. Both us.icr.io and https://index.docker.io/v1/ are supported docker registries. For example,

   API_KEY=<API-KEY>
   docker login --username iamapikey -p $API_KEY us.icr.io
   docker tag sys-hpcs-team-grep11-docker-local.artifactory.swg-devops.com/grep11-c16:grep11server_s390x-1.1.2.1 us.icr.io/crypto-appliance/grep11server:s390x-1.1.2.1
   docker push us.icr.io/crypto-appliance/grep11server:s390x-1.1.2.1
   
   USERNAME=<USERNAME>
   PASSWORD=<PASSWORD>
   docker login --username $USERNAME -p $PASSWORD docker.io
   docker tag sys-hpcs-team-grep11-docker-local.artifactory.swg-devops.com/grep11-c16:grep11server_s390x-1.1.2.1 docker.io/hexiaohu/grep11server:s390x-1.1.2.1
   docker push docker.io/hexiaohu/grep11server:s390x-1.1.2.1
   

2. Update the image tag in docker-compose.yml

   Update the image tag in docker-compose.yml to the value that reflects the image tag of docker registry. For example,

   ...
       image: us.icr.io/crypto-appliance/grep11server:s390x-1.1.2.1@sha256:54334c919a93c45f70d0252d8518d24b64255a88a073b35239f95d056d444ab8
   ...
   

3. Generate base64 value of compose.tgz

   Compact all of config files together with docker-compose.yml into compose.tgz and get the base64 value of compose.tgz. Note: Ensure that the compose.tgz file contains only directories and regular files. Links or pipes are not supported.

   rm -f compose.tgz compose.b64
   tar -czvf compose.tgz docker-compose.yml c16client.yaml grep11server.yaml c16server-ca.pem c16server-client.pem c16server-client.key grep11-ca.pem grep11-server.key grep11-server.pem
   base64 -i compose.tgz | tr -d '\n' > compose.b64
   

4.3.2 Create a logDNA instance

Create a logDNA instance on IBM Cloud and get the following access point value Ingestion Key. For more information, see Getting started with Log Analysis and Getting ingestion keys.

Ingestion Key: <Ingestion Key Value>
Service Endponit: <Endpoint of service instance, eg. syslog-a.us-south.logging.cloud.ibm.com:6514>

4.3.3 Prepare contract

• Prepare workload.yaml, the following is an example:

  Update the auths section to indicate the logon method of the docker registry, in which the grep11server image is located. Using us.icr.io as an example:

  type: workload
  auths:
    us.icr.io:
      password: ${API_KEY}
      username: iamapikey
  compose:
    archive: ${COMPOSE_VALUE}
  volumes:
    testvolume:
      mount: "/mnt/data"
      seed: "workload_seed"
      filesystem: "ext4"
  

  Where

  • API_KEY: Is the docker registry access token.
  • COMPOSE_VALUE: is the base64 encode of file compose.tgz.

• Prepare the env.yaml, the following is an example:

  type: env
  logging:
    logDNA:
      ingestionKey: ${INGESTIONKEY}
      hostname: ${LOGDNA_ENDPOINT}
      port: ${LOGDNA_PORT}
  volumes:
    testvolume:
      seed: "env_seed"
  

  Where

  • INGESTIONKEY: Is the logDNA Ingestion key value.
  • LOGDNA_ENDPOINT: Is the logDNA service instance hostname, example: syslog-a.us-south.logging.cloud.ibm.com.
  • LOGDNA_PORT: Is the logDNA service port, example: 6514

• Generate an encrypted contract. CONTRACT_KEY is the file path of the encryption certificate, you can download the encryption certificate and extracting the public key.

  WORKLOAD="$(pwd)/workload.yaml"
  CONTRACT_KEY=${CONTRACT_KEY}
  PASSWORD="$(openssl rand 32 | base64 -w0)"
  ENCRYPTED_PASSWORD="$(echo -n "$PASSWORD" | base64 -d | openssl rsautl -encrypt -inkey $CONTRACT_KEY -certin | base64 -w0 )"
  ENCRYPTED_WORKLOAD="$(echo -n "$PASSWORD" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -pass stdin -in "$WORKLOAD" | base64 -w0)"
  echo "workload: \"hyper-protect-basic.${ENCRYPTED_PASSWORD}.${ENCRYPTED_WORKLOAD}\"" > contract_encrypt.txt
  ENV="$(pwd)/env.yaml"
  CONTRACT_KEY=${CONTRACT_KEY}
  PASSWORD="$(openssl rand 32 | base64 -w0)"
  ENCRYPTED_PASSWORD="$(echo -n "$PASSWORD" | base64 -d | openssl rsautl -encrypt -inkey $CONTRACT_KEY  -certin | base64 -w0)"
  ENCRYPTED_ENV="$(echo -n "$PASSWORD" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -pass stdin -in "$ENV" | base64 -w0)"
  echo "env: \"hyper-protect-basic.${ENCRYPTED_PASSWORD}.${ENCRYPTED_ENV}\"" >> contract_encrypt.txt
  

4.3.4 Create a Secure Execution VM

You can create a Secure Execution VM either on Hyper Protect Virtual Servers on premises or on Hyper Protect Virtual Servers for IBM Virtual Private Cloud (VPC).

• On premises

  Follow Setting up and configuring IBM Hyper Protect Virtual Servers to deploy GREP11 server as a Secure Execution VM on HPVS on-premises.

  Notes:

  • User-Data content should reference to the generated contract from Step 4.3.3 Prepare contract.
  • You must configure iptables to open required ports for GREP11 server, following step 11 in Setting up and configuring IBM Hyper Protect Virtual Servers.

• On Cloud

  Log in to IBM Cloud to create a Secure Execution VM. For more information, see Creating virtual server instances, and IBM Hyper Protect Container Runtime image.

  Notes:

  • Choose the generated contract from Step 4.3.3 Prepare contract.
  • You must create a data volume and bind it with this VM. It can be a smallest size of 10GB.
  • You must configure security policy group for the network VPC to open required ports.

4.3.5 Verify GREP11 server deployment

You can use the nmap tool to verify the on premises or on Cloud deployment by checking the port status of GREP1 server. If the port status is open, the grep11server runs normally. For example,

nmap -A -T4 -p 9876 <SE_VM_IP>
For example:
    nmap -A -T4 -p 9876 169.48.158.229
    nmap -A -T4 -p 9876 150.238.54.207
$ nmap -A -T4 -p 9876 169.48.158.229
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-06 08:44 CST
Nmap scan report for 169.48.158.229
Host is up (0.19s latency).
PORT     STATE SERVICE VERSION
9876/tcp open  ssl/sd?
| ssl-cert: Subject: commonName=169.48.158.229/organizationName=IBM/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:127.0.0.1:9876, DNS:localhost:9876, DNS:9.47.152.236:9876, DNS:9.47.152.179:9876, DNS:150.238.54.207:9876, DNS:169.48.158.229:9876, IP Address:127.0.0.1, IP Address:169.48.158.229, IP Address:9.47.152.236, IP Address:9.47.152.179, IP Address:150.238.54.207
| Not valid before: 2022-08-04T01:11:10
|_Not valid after:  2024-08-03T01:11:10
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 44.30 seconds

4.3.6 View logs from logDNA instance console

Open the console of the configured logDNA instance and monitor realtime logs to check status of the Secure Execution VM.

No special capability is required by the GREP11 server container.

You can view the logs of GREP11, which the client for the Crypto Express Network API for Secure Execution Enclaves server, from the container logs. GREP11 logs can be configured to be collected by external log server, for example, the Rsyslog server.