Vormetric Data Firewall for AWS. All-in-Cloud Installation Guide

Transcription

1 Vormetric Data Firewall for AWS All-in-Cloud Installation Guide Document Version 1.2 January 29, 2014

2 All-in-Cloud Installation Guide Vormetric Data Security All-in-Cloud Installation Guide Document Version 1.2 January 29, Produced in the United States of America Copyright (C) Vormetric, Inc. All rights reserved. NOTICES, LICENSES, AND USE RESTRICTIONS Vormetric is a registered trademark of Vormetric, Inc. in the United States (U.S.) and certain other countries. Microsoft, Windows, Windows XP, Windows NT, SQL Server and the Windows logo are trademarks of Microsoft Corporation in the U.S., other countries, or both. UNIX is a registered trademark of The Open Group in the U.S. and other countries. Linux is a trademark of Linus Torvalds in the U.S., other countries, or both. Oracle, Oracle ASM, Solaris, SPARC, Oracle Enterprise Linux and Java are registered trademarks of Oracle Corporation and/or its affiliates. IBM, IBM logo, ibm.com, AIX, DB2, PowerPC, DB2 Universal Database are trademarks of International Business Machines Corporation in the U.S., other countries, or both. Intel, Intel logo, Intel Xeon, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the U.S. and other countries. HP-UX is registered trademark of Hewlett-Packard Company in the U.S., other countries, or both. Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered trademarks or trademarks of Adobe Systems Incorporated in the U.S., other countries, or both. X Window System is a trademark of the Massachusetts Institute of Technology. Red Hat and Red Hat Enterprise Linux, are trademarks of Red Hat, Inc., registered in the United States and other countries. SUSE and SLES are a registered Trademarks of Novell, Inc.All other products described in this document are trademarks of their respective holders. The Software and documentation contains confidential and proprietary information that is the property of Vormetric, Inc. The Software and documentation are furnished under Vormetric's Standard Master License Software Agreement (Agreement) and may be used only in accordance with the terms of the Agreement. No part of the Software and documentation may be reproduced, transmitted, translated, or reversed engineered, in any form or by any means, electronic, mechanical, manual, optical, or otherwise. Licensee shall comply with all applicable laws and regulations (including local laws of the country where the Software is being used) pertaining to the Software including, without limitation, restrictions on use of products containing encryption, import or export laws and regulations, and domestic and international laws and regulations pertaining to privacy and the protection of financial, medical, or personally identifiable information. Without limiting the generality of the foregoing, Licensee shall not export or re-export the Software, or allow access to the Software to any third party including, without limitation, any customer of Licensee, in violation of U.S. laws and regulations, including, without limitation, the Export Administration Act of 1979, as amended, and successor legislation, and the Export Administration Regulations issued by the Department of Commerce. Any provision of any Software to the U.S. Government is with "Restricted Rights" as follows: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS , and in subparagraphs (a) through (d) of the Commercial Computer-Restricted Rights clause at FAR , and in similar clauses in the NASA FAR Supplement, when applicable. The Software is a "commercial item" as that term is defined at 48 CFR 2.101, consisting of "commercial computer software" and "commercial computer software documentation", as such terms are used in 48 CFR and is provided to the U.S. Government and all of its agencies only as a commercial end item. Consistent with 48 CFR and DFARS through , all U.S. Government end users acquire the Software with only those rights set forth herein. Any provision of Software to the U.S. Government is with Limited Rights. Vormetric is Vormetric, Inc. at 2545 N 1st St., San Jose, CA, , (408) VORMETRIC, INC., PROVIDES THIS SOFTWARE AND DOCUMENTATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT OF THIRD PARTY RIGHTS, AND ANY WARRANTIES ARISING OUT OF CONDUCT OR INDUSTRY PRACTICE. ACCORDINGLY, VORMETRIC DISCLAIMS ANY LIABILITY, AND SHALL HAVE NO RESPONSIBILITY, ARISING OUT OF ANY FAILURE OF THE SOFTWARE TO OPERATE IN ANY ENVIRONMENT OR IN

3 All-in-Cloud Installation Guide CONNECTION WITH ANY HARDWARE OR TECHNOLOGY, INCLUDING, WITHOUT LIMITATION, ANY FAILURE OF DATA TO BE PROPERLY PROCESSED OR TRANSFERRED TO, IN OR THROUGH LICENSEE'S COMPUTER ENVIRONMENT OR ANY FAILURE OF ANY TRANSMISSION HARDWARE, TECHNOLOGY, OR SYSTEM USED BY LICENSEE OR ANY LICENSEE CUSTOMER. VORMETRIC SHALL HAVE NO LIABILITY FOR, AND LICENSEE SHALL DEFEND, INDEMNIFY, AND HOLD VORMETRIC HARMLESS FROM AND AGAINST, ANY SHORTFALL IN PERFORMANCE OF THE SOFTWARE, OTHER HARDWARE OR TECHNOLOGY, OR FOR ANY INFRINGEMENT OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS, AS A RESULT OF THE USE OF THE SOFTWARE IN ANY ENVIRONMENT. LICENSEE SHALL DEFEND, INDEMNIFY, AND HOLD VORMETRIC HARMLESS FROM AND AGAINST ANY COSTS, CLAIMS, OR LIABILITIES ARISING OUT OF ANY AGREEMENT BETWEEN LICENSEE AND ANY THIRD PARTY. NO PROVISION OF ANY AGREEMENT BETWEEN LICENSEE AND ANY THIRD PARTY SHALL BE BINDING ON VORMETRIC. Protected by U.S. patents: 6,678,828 6,931,530 7,143,288 7,283,538 7,334,124 Vormetric Data Security includes a restricted license to the embedded IBM DB2 database. That license stipulates that the database may only be used in conjunction with the Vormetric Security Server. The license for the embedded DB2 database may not be transferred and does not authorize the use of IBM or 3rd party tools to access the database directly.

4 Contents Preface.... i Intended audience.. i Typographical conventions i Service updates and support information... ii Sales and Support... ii 1 Overview 1 Assumptions.. 1 Installation Process Vormetric Data Security on Amazon VPC... 3 Installing a Data Security Manager (DSM) in the Amazon VPC.. 3 Installing Protected Hosts in the Amazon VPC 23 3 Vormetric Data Security on Amazon EC2 Classic.. 29 To install a Data Security Manager (DSM) in EC2 Classic. 29 To Install Protected hosts in EC2 Classic 56 4 Additional Help 63 Document Version 1.2 All-in-Cloud Installation Guide

5 PREFACE.... This document describes how to install the Vormetric Data Firewall for Amazon Web Services in your AWS account. DOCUMENTATION VERSION RELEASE NOTES.... The following table describes the documentation changes made for each document release. Documentation Changes Documentation Version Date Changes 1.0 9/10/13 Initial Release /25/13 Added chapter on installing VDS in Amazon VPC /28/14 Removed instructions on connecting to instances using MindTerm. Suggested using PuTTY. Cleaned up minor issues. Fixed external hyperlinks. INTENDED AUDIENCE The All-in-Cloud Installation Guide is intended for system administrators who install the Vormetric DSM and connect it to the network. TYPOGRAPHICAL CONVENTIONS In this guide, text that uses any of the following conventions has the special meaning described in the table: Typographical Conventions Convention Usage Example double underscore A double underscore indicates a keyboard or mouse action to take Click User Bold A label in GUI requiring some action. Click Add User Set Document Version 1.2 All-in-Cloud Installation Guide

6 ii DOCUMENTATION VERSION RELEASE NOTES Typographical Conventions Convention Usage Example Italics fixed width (courier new) Italics fixed width quotes Name of a pop-up, panel, or view. New term or concept. Emphasis keyboard or mouse input command line input or output File names, paths, and directories Code examples Variable in code, path or command line to be replaced with a real value. File extensions Literal Values Attribute values Terms used in special senses The Create User pop-up opens. Administrators are assigned to domains. Do not click reboot. Type root in the Uname field. -bash-4.1# useradd demo-user2 /vipdata2/helloworld.txt If(y=x)THEN GOTO STOP cd c:/users/username/desktop GregsPort.js,.ext Enter more true false, hot standby failover SERVICE UPDATES AND SUPPORT INFORMATION Vormetric's Master Software License and Hardware Purchase Agreement ( MSLA ) defines software updates and upgrades, support and services, and governs the terms under which they are provided. Any statements made in this guide or collateral documents that conflict with the definitions or terms in Vormetric's MSLA, shall be superseded by the definitions and terms of the MSLA. Any references made to upgrades in this guide or collateral documentation can apply either to a software update or upgrade. SALES AND SUPPORT For support and troubleshooting issues: help.vormteric.com questions to cloudsupport@vormetric.com. For Vormetric Sales: (888) sales@vormetric.com Document Version 1.2 All-in-Cloud Installation Guide

7 1 OVERVIEW The Vormetric Data Firewall, henceforth called Vormetric Data Security or VDS, consists of a Data Security Manager (DSM) and File System Agents that reside in your AWS hosts. The DSM is the central server that stores and manages the encryption keys, data access policies, administrative domains, and administrator profiles for your protected hosts. File System Agents are installed on each host containing data to be protected. Once you install the agent on the host and register it with the DSM it is called a protected host. VDS security administrators can create data access policies for that host that specify who can access what files, at what times, with what commands, and then whether that data is encrypted. The agents communicate with the DSM and enforce data access policies on that host. These concepts are explored further in the AWS All-in-Cloud Getting Started Guide. Figure 1: Vormetric Data Security Architecture with protected hosts ASSUMPTIONS.... This documentation assumes knowledge of network configuration. The system administrator must have root permissions for the systems on which VDS software is installed. Document Version 1.2 All-in-Cloud Installation Guide Overview

8 INSTALLATION PROCESS 2 You need the following to complete this manual: An Amazon Web Services (AWS) account and experience creating AWS Elastic Cloud Compute (EC2) instances. Experience working in the command line interface of your host operating system. Knowledge of how to open TCP and ICMP port connections on your protected hosts. INSTALLATION PROCESS.... The installation process described in this guide requires that you use CentOS 6.3 for your protected hosts. If you would like support in protecting other platforms, contact sales@vormetric.com. Before installing VDS, you must choose to install your instances in the Amazon Virtual Private Cloud (VPC) or Amazon EC2 Classic. See the Amazon EC2 and Amazon Virtual Private Cloud (VPC) for a discussion on the differences. Once you have decided on the AWS platform, go the respective chapters: Chapter 2, Installing Vormetric Data Security in the Amazon VPC, on page 3. Chapter 3, Installing Vormetric Data Security in Amazon EC2 Classic, on page 29. Document Version 1.2 All-in-Cloud Installation Guide Overview

9 INSTALLING VORMETRIC DATA SECURITY 2 IN THE AMAZON VPC This chapter describes how to install Vormetric Data Security (VDS) in the Amazon Web Services (AWS) Virtual Private Cloud (VPC). Before proceeding, create a VPC and subnet in your AWS account where you will install the DSM and protected hosts. See the Amazon Virtual Private Cloud User Guide for information on VPCs and how to create them. This chapter consists of the following steps: Installing a Data Security Manager (DSM) in the Amazon VPC on page 3 Installing Protected Hosts in the Amazon VPC on page 23 Note: Images and layout may have been updated by Amazon since this document was published. INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC.... Installing DSM on a VPC consists of the following procedures: Create a VPC and subnet in your AWS account where you will install the DSM and protected hosts. See the Amazon Virtual Private Cloud User Guide for information on VPCs and how to create them. Create an Amazon EC2 Key Pair. See Amazon EC2 Key Pairs. Choose 1-Click or EC2 Classic to launch your DSM AMI (step 1). Launch the DSM AMI with 1-Click (step 2) or EC2 Console (step 3). Configure the DSM (step 5). Get the DSM Deployment Details (step 6). Test the DSM installation (step 7). 1: Choose a launch method for your Vormetric DSM AMI in the Amazon marketplace. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

10 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 4 There are two ways to launch a Vormetric DSM AMI, the 1-Click Launch and the Launch with EC2 Console. a: Go to the Amazon marketplace and search for "Vormetric". The Vormetric Data Firewall for AWS - 5 Client page appears. Figure 2: Vormetric AWS website b: Click Continue. The Launch on EC2 page is displayed. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

11 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 5 Figure 3: Launch on EC2 page The next step describes the 1-Click Launch. If you prefer to launch with the EC2 Console, go to step 4: Launch DSM instance with EC2 Console. 2: Launch the DSM instance with 1-Click Launch. (If you prefer to launch with the EC2 Console, skip this step and go to step 4.) Before launching the instance, set the parameters in the 1-Click Launch tab: Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

12 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 6 Figure 4: 1-Click Launch parameters a: Set 1-Click Launch parameters. Version. Select version. Region. Choose your desired region. Figure 5: Region EC2 Instant Type: Standard Large (m1.large) is the appropriate size. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

13 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 7 Figure 6: EC2 Instant Type VPC Settings: Choose the previously created VPC or click Create a VPC. Figure 7: VPC Settings Subnet. Choose the previously created subnet or click Create a subnet. Figure 8: Subnet Settings Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

14 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 8 Security Group: Choose Create new based on seller settings. This choice will create a security group called Vormetric Data Firewall for - 5 Client. The Security Group rules should be the same as shown in Table 1, VDS Security Group Rules, on page 11. Figure 9: Security Group Key Pair: Choose a previously created key pair. Make sure you have access to the key file as you will need this later. Figure 10: Key Pair b: Click Launch with 1-Click. An overview of the instance is displayed. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

15 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 9 Figure 11: Instance overview Note the Key Pair and the Instance ID. These will be used later. c: Go to AWS Management Console to see the instance. Search for the instance using the Instance ID. Figure 12: DSM instance in dashboard Give the instance a name. Right click the instance, select Add/edit tags, and type a name. For example: DSM-1. d: Make sure All ICMP is added to the Security Group. Amazon may restrict Internet Control Message Protocol (ICMP) in the default configuration, so you may have to add ICMP in the security group. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

16 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 10 In the EC2 Dashboard, click on Security Groups. In the Viewing: pulldown, select VPC Security Groups. Select the Vormetric Data Firewall for AWS 5 Client... security group. Click the Inbound tab, click the Create a new rule pull-down, and select All ICMP. Figure 13: Security Group view Click Add Rule. The ICMP port is added to the Security Group. Click Apply Rules Changes. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

17 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 11 Figure 14: ICMP All added to security group e: The DSM AMI can take minutes to instantiate depending on the AWS load. Skip step 4: Launch DSM instance with EC2 Console.the next step since you just performed a 1-Click Launch. 3: Allocate a new EIP address for VPCs and associate it with the DSM instance. This step is required for 1-Click installation. In the AWS EC2 Dashboard, click on Elastic IPs. Click Allocate New Address, select EIP used in VPC and Yes, Allocate. Select this new address, click Associate Address, select the DSM instance on which to associate the EIP and click Associate. Use this EIP address to set up your SSH session. 4: Launch DSM instance with EC2 Console. If you launched with 1-Click Launch (step 2), skip this step. a: Create a new EC2 security group with the following port rules. Table 1: VDS Security Group Rules Protocol Port (service) Source ICMP All /0 TCP 22 (SSH) /0 TCP 443 (HTTPS) /0 TCP /0 TCP /0 TCP 8080 (HTTP*) /0 TCP 8443 (HTTPS*) /0 Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

18 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 12 Protocol Port (service) Source TCP /0 TCP /0 TCP /0 UDP /0 UDP /0 UDP /0 In your EC2 Dashboard click on Security Groups > Create Security Groups to bring up this pop-up: Figure 15: Create Security Group pop-up Enter a Name and Description. Select the VPC that you created for the DSM and your protected hosts. Click Yes, Create. b: Add the port rules. In the EC2 Dashboard, click Security Groups, then Viewing: VPC Security Groups. Select the security group you just created. Click the Inbound tab. In the Create a new rule pull-down, select All ICMP. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

19 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 13 Figure 16: Security Group Inbound tab Click Add Rule to add rule to the security group. Figure 17: Security Group Add Rule button Do this for all the ports in the table. For TCP Ports, select Custom TCP rule. For UDP Ports, select Custom UPD rule. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

20 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 14 Figure 18: Security Group with all the rules Click Apply Rule Changes. Click the Refresh button in the top right corner. c: On the Vormetric website in the AWS Marketplace. Click on the Launch with EC2 Console tab. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

21 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 15 Figure 19: Vormetric website in the AWS Marketplace d: Select your desired region and click Launch with EC2 Console. Step 2: Choose and Instance Type page opens. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

22 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 16 Figure 20: Instance Type Click General purpose > m1.large then click Next: Configuration Instance Details. Step 3: Configure Instance Details Instance Details opens. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

23 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 17 Figure 21: Instance details e: Enter Instance details. Use the following values: Network: Select a VPC that you created earlier or click Create a new VPC. Subnet: Select a VPC that you created earlier or click Create a new subnet. Check Automatically assign a public IP address to your instances. This public IP address is how you will later access the DSM to configure it and to get the DSM details. Note: Another way to access the DSM is to create an EIP used in VPC and associate it to the DSM instance after it is created. All other values can be kept as is. Click Next: Add Storage. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

24 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 18 Step 4, Add Storage page opens. Figure 22: Advanced Instance Options f: No changes are required here. Click Next: Tag Instance. Step 5: Tag Instance opens. Figure 23: Tag Instance Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

25 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 19 Enter a name for this instance (example: Host -1), then click Next: Configure Security Group. Step 6: Configure Security Group opens. Figure 24: Security groups g: Highlight the security group that you had created earlier (step 3a: Create a new EC2 security group with the following port rules.) and click Review and Launch. h: Review the instance parameters and click Launch. Select an existing key pair of create a new key pair pop-up opens. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

26 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 20 Figure 25: Key pairs i: Select Choose from your existing Key Pair (if you have one) or Create a new Key Pair. Download the key and remember your key path (location of the.pem file) as you will need this later. Check the Acknowledgment checkbox and click Launch Instances. The instance is launched. j: Return to the EC2 Instances page to view your newly created instance. AWS returns you to the EC2 Management Console. Click Instances. Figure 26: Instance view of new DSM Search for the name of your DSM. The DSM instance is now running. 5: Configure the DSM. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

27 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 21 The DSM configuration script is on the DSM instance. The script starts when you connect to your DSM instances with an SSH client. There are many ways to start an SSH session, see Connecting to Linux/UNIX Instances from Windows Using PuTTY. Note: You may have to wait minutes after the DSM is instantiated (see Figure 27) before you can make an SSH connection to the DSM. If you try to make an SSH connection and you get a pop-up that reads Connection Refused, then continue waiting. a: Connect an SSH client to your DSM instance and login with the user name: ec2-user. This automatically starts the DSM configuration script. Use the following values to start the SSH session. Host Name (or IP address). Use the Public DNS or an EIP address. Your Public DNS is displayed under the Description tab in the Instance view. Figure 27: Public DNS Private key path: Enter the path of the.pem (or.ppk if you are using PuTTY) file that you generated earlier (Figure 25: Key pairs ). In the PuTTY Configuration pop-up, under Category, click the + icon next to SSH, select Auth, then enter the path to your.ppk file in the Private key file for authentication: field b: Log in as ec2-user. This starts the configuration program. You will see a terminal window that displays the following: Welcome to the Vormetric Data Security Manager configuration wizard Please enter the information below to configure your Security Manager instance Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

28 INSTALLING A DATA SECURITY MANAGER (DSM) IN THE AMAZON VPC 22 Add hosts to protect? (yes/no) no Enter no. The following is displayed: This security manager instance has been launched in AWS VPC. If you wish to access it by it's internal host name, - on Unix platform, please add an entry to the /etc/hosts file - on Windows platform, please add an entry to the C:\WINDOWS\system32\drivers\etc\hosts file. The instance is going to restart now. After restarting, the security manager configuration will take about 15 minutes. Please wait for it to complete. Press any key to continue Press any key. The system terminates your SSH session and starts configuration. 6: Get the DSM Deployment Details. The DSM Deployment Details provides all the information you need log on to the DSM Management Console, access the DSM CLI, and install agents on your protected hosts. Wait for the DSM configuration to complete before accessing the deployment details. This process can take up to fifteen minutes. a: Connect to the new DSM instance with an SSH session and log in as ec2-user. Note: If you log in before DSM configuration is complete, you ll get the message Configuration no Complete. Please try later. Then the terminal will close. After you log in, the DSM Deployment Details are displayed. login as: ec2-user Welcome to the Vormetric Data Security Manager. Data Security Manager details ============================= Management console URL is 1.amazonaws.com Management console internal URL is System administrator credentials are admin / Vb3]%@V$3$C2WRcY ALL administrator credentials are awsadmin / Qx2[S4GYB53wi CLI administrator credentials are cliadmin / Qa3(kpBVfu@m Please download the agent install script from FSAJTALB6TX3LPU Save these Deployment Details as you will need them later. Close the SSH terminal. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

29 INSTALLING PROTECTED HOSTS IN THE AMAZON VPC 23 7: Test the DSM installation. Wait a few minutes after you receive your DSM Deployment Details. Open a browser and enter the DSM URL listed in the Deployment Details. For example: Log in as awsadmin using the information in the Deployment details. awsadmin / Qx2[S4GYB53wi The Vormetric Data Security page opens. Figure 28: Vormetric Management Console dashboard If the DSM dashboard is not responsive--for example, when you point to a drop-down menu nothing happens, log off and wait a few minutes for the configuration process to complete. INSTALLING PROTECTED HOSTS IN THE AMAZON VPC.... A protected host is a host in the Amazon cloud whose data is protected by a Vormetric agent. VDS protects hosts running many different operating systems including various versions of Microsoft Windows, Linux and UNIX. However, the installation process described here requires that you use CentOS 6.3 for your protected hosts. If you would like support in protecting other platforms, contact sales@vormetric.com. Once your DSM is installed and configured, you can create protected hosts. Installing an agent on your host involves the following steps: Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

30 INSTALLING PROTECTED HOSTS IN THE AMAZON VPC 24 Instantiate the host you want to protect (step 1). Run the agent install and registration script on the host (step 2). Verify that the protected host is registered with the DSM (step 3). For each protected host, save the deployment information (step 4). Repeat this process for each protected host (step 4). Gather the following information for these steps: The VPC and subnet where you installed the DSM. Agent install script url. (See step 6: Get the DSM Deployment Details.) The Security Group you created. (See step 3a: Create a new EC2 security group with the following port rules.). Note: Currently we only support protected hosts running CentOS 6.3. You can use any CentOS 6.3 AMI. 1: Instantiate your protected host. AWS protected host instances can be of any size. For each DSM you can have up to five protected hosts. a: Log in to your Amazon account. b: Instantiate your protected host AMI (not the DSM AMI) using the following parameters (valid for either 1-Click or EC2 Console launching): Region. Choose one. EC2 Instance Type. Instances can be of any size. Network: Choose the same VPC where you installed the DSM. Subnet: Choose the same subnet where you installed the DSM. Check Automatically assign a public IP address to your instances. You will use this public IP address to access the host in subsequent steps. Tag Instance. Add a name for your protected host. Security Group. Use the same group you used when you instantiated the DSM (Figure 9 and Figure 24). Click Review and Launch. Key Pair. Choose a Key Pair that you previously created or create a new key pair and download the private key. Remember your private key path (location of the.pem/.ppk file) as you will need this later. Note the instance ID as this will be useful for the next step. 2: Run the agent installation and registration script on the host. After your host instance is running (the time it takes depends on the size of the host and the AWS EC2 load), connect to it with an SSH Client to download the agent installation and registration script. This script installs the agent and registers it with the DSM. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

31 INSTALLING PROTECTED HOSTS IN THE AMAZON VPC 25 There are many ways to start an SSH session.see Connect to Your Amazon Instance. a: Launch an SSH client on your host instance and login with the user name root. Use the following parameters to launch your SSH session. Host Name (or IP address). Enter the IP address or Public DNS of the protected host. If you installed the host using the EC2 Console, highlight the host name in the Instances view of the EC2 Dashboard. The Public DNS is displayed under the Description tab. Figure 26 shows an example of what you should see. If you launched the host with 1-Click, you need to allocate a new EIP address for VPCs and associate it with the host instance: In the AWS EC2 Dashboard, click on Elastic IPs. Click Allocate New Address, select EIP used in VPC and Yes, Allocate. Select this new address, click Associate Address and select the host instance on which to associate the EIP. Use this EIP address to set up your SSH session. Private key path: Enter the path of the.pem (or.ppk if you are using PuTTY) file that you generated earlier (Figure 25: Key pairs ). Some AMIs only allow you to first log in as ec2-user. If you can't log in as root, log in as ec2-user, then do a "sudo su -" in the terminal to run as root. b: Make sure the firewall on the protected host allows the following TCP Port connections: ICMP Ping TCP 7024 TCP 8080 TCP 8443 TCP 8444 Incoming/Outgoing Incoming Outgoing Outgoing Outgoing c: From the SSH terminal, copy and run the agent install program. Run the following commands as root user: # wget -O installer --no-check-certificate <Agent_Install_Script_url> Agent_install_script_url is part of the DSM details (6: Get the DSM Deployment Details.). (If the wget command fails with "wget not found," execute yum -y install wget and try again.) # ls installer # chmod +x installer #./installer Welcome to the Vormetric Data Security agent installer Your instance has been launched with the following security groups: <Name of your security Group> Please ensure that the security groups and firewall on this machine Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

32 INSTALLING PROTECTED HOSTS IN THE AMAZON VPC 26 allow outgoing connections to TCP ports 8443, 8444 and 8080 and ICMP ping requests and incoming connections to TCP port 7024 and ICMP ping requests before proceeding Proceed? (yes/no) yes (Installation continues until you get the following screen output.) Cleaning up... Installing agent Please enter the information below to configure your agent instance Enter hostname of the Security Manager: ip ec2.internal (Important: For hostname of the Security Manager, use the private DNS of the DSM, not the public DNS. You can get this from Figure 28: Vormetric Management Console dashboard ) Adding host ip ec2.internal to Data Security Manager. Enter password for awsadmin user on the Security Manager - &*($d($@ed9 (Get this from step 6, Get the DSM Deployment Details. on page 22) Host ip ec2.internal added to Security Manager After restarting, this instance will be registered to the Security Manager hosted at ip ec2.internal The instance is going to restart now. Continue? (yes/no) yes Type yes. The host goes down for a reboot and after a few minutes is registered with the DSM. 3: Verify that the protected host is registered with the DSM. a: Open a browser and enter the DSM URL. See step 6, Get the DSM Deployment Details. on page 22 Figure 29: Management Console Login Login as awsadmin with the password from your DSM Deployment Details. The VDS Dashboard appears: Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

33 INSTALLING PROTECTED HOSTS IN THE AMAZON VPC 27 Figure 30: VDS Dashboard b: Switch to domain, awsdomain. Click Domains > Switch Domains Figure 31: Switch domains You will have a domain called awsdomain. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

34 INSTALLING PROTECTED HOSTS IN THE AMAZON VPC 28 Figure 32: Switch to domain Select awsdomain, then click Switch to domain. c: View the hosts in the domain. Click Hosts > Hosts in the top menu bar to bring up the Hosts page. The new protected host is added and under Pushing Status it says Pending or Done. It may take a few minutes to complete registration. If it says N/A, then the registration did not complete. See Chapter 4, Additional Help, on page 64 to re-register. Figure 33: Hosts page 4: Repeat the instantiation (step 1), agent installation and registration (step 2), and verification process (step 3) for each protected host. 5: See the Vormetric Data Security on AWS: Getting Started Guide to learn how to use the product. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in the Amazon VPC

35 INSTALLING VORMETRIC DATA SECURITY 3 IN AMAZON EC2 CLASSIC This chapter describes how to install Vormetric Data Security (VDS) in the Amazon Web Services (AWS) EC2 Classic Platform. This chapter consists of the following steps: To install a Data Security Manager (DSM) in EC2 Classic on page 29 To Install Protected hosts in EC2 Classic on page 57 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC.... DSM installation in EC2 Classic consists of the following steps: Create an EIP address for your DSM and any hosts you will create (step 2). Create an AWS Identity and Access Management (IAM) user with Elastic Internet Protocol (EIP) AssociateAddress permissions (step 3). Choose a DSM AMI launch method (1-Click or EC2 Console). See step 4. Launch the DSM AMI using either the 1-Click (step 5) or EC2 Console (step 6). Configure the DSM (step 7). Get the DSM Deployment Details (step 8). Test the DSM installation (step 9). These steps are described in the following sections. Note: The following AWS snapshots were current when we wrote this document. Although the images and layout may differ if Amazon changes them in the future, the concepts and content remains the same. 1: Decide how many DSMs and protected hosts you want for this DSM installation. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

36 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 30 One commercial license allows you to install one DSM with five agents on your AWS hosts. Create and allocate one Elastic IP (EIP) address for each DSM and protected host in your system. For example, for one DSM with five protected hosts, you will need six EIP addresses. 2: Create Elastic IP (EIP) addresses in your AWS account. EIP addresses can be created any time before you configure the DSM or protected hosts. You can create these addresses now or later in the installation process. a: Log on to your AWS account and display the Amazon Web Services. Figure 34: Amazon Web Services Click EC2 to open the EC2 Dashboard. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

37 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 31 Figure 35: EC2 Dashboard b: Click Elastic IPs to open the Elastic IPs view. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

38 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 32 Figure 36: Elastic IPs view c: Click Allocate New Address. Figure 37: Allocate New Address pop-up d: Select EIP used in: EC2. Then click Yes, Allocate. An unassigned EIP address appears in your Elastic IP view. Figure 38: New EIP address Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

39 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 33 e: Repeat until you have the desired number of EIP addresses. Note your EIP addresses, as you will need them during the DSM and host configuration processes. IMPORTANT: Once an EIP address is assigned to an instance, do not release or reuse it until the instances are terminated. 3: Create an Identity and Access Management User (IAM) user with EIP AssociateAddress permissions VDS requires an IAM user to ensure proper handshaking between agents and the DSM (see Amazon Web Sevices IAM page for more information). Specifically, the DSM instance needs a host name associated with a consistent IP address. To maintain IP address consistency, you must have an IAM user with EIP AssociateAddress permissions. a: Log on to your AWS account and go to the Amazon Web Services page. Figure 39: Amazon Web Services Click IAM. The IAM Dashboard appears. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

40 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 34 Figure 40: IAM Dashboard b: Create a new IAM user. Click Users to display the Users view. Figure 41: User's view showing IAM users Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

41 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 35 Click Create New Users to display the Create User pop-up. Figure 42: Create User pop-up Enter a user name, for example, DSM-Install. Make sure Generate an access key for each User is checked. Click Create (no need to create a password). Click Show User Security Credentials to display and the new IAM user credentials (Access Key ID and Secret Access Key). Copy and save these in a safe place. You will need this when you configure the DSM and hosts. You can also click Download Credentials to save it on your computer. Figure 43: IAM User Credentials Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

42 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 36 Click Close Window. The Users view is displayed with the new user. Figure 44: Users view showing a new IAM user c: Give the new user EIP AssociateAddress permissions. Select the checkbox next to the new user name and click the Permissions tab. Figure 45: IAM User Permissions view Click Attach User Policy. The Manage User Permissions pop-up is displayed. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

43 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 37 Figure 46: Manage User Permissions pop-up d: Set EIP AssociateAddress permissions. Click Custom Policy, then Select. The Policy Name and Policy Document text fields appears. Figure 47: Granting AssociateAddress permissions In Policy Name, type in a name (for example, Vormetric_EIP_Policy). In Policy Document, copy and paste the following: {"Statement": [{"Action": ["ec2:associateaddress", "ec2:describeaddresses"], "Resource": "*", "Effect": "Allow"}]} Click Apply Policy. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

44 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 38 You now have an IAM user named DSM-Install with EIP AssociateAddress permissions. IMPORTANT: Do not delete or modify this user until the instance is terminated. 4: Go to the Vormetric website in the Amazon marketplace and choose a launch method for your Vormetric DSM AMI. There are two ways to launch a Vormetric DSM AMI, the 1-Click Launch and the Launch with EC2 Console. We recommend the 1-Click Launch because it's a bit simpler. a: Go to the Amazon marketplace and search for "Vormetric". The Vormetric Data Firewall for AWS - 5 Client page appears. Figure 48: Vormetric AWS website b: Click Continue. The Launch on EC2 page is displayed. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

45 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 39 Figure 49: Launch on EC2 page The recommended 1-Click Launch is described in the next step. If you want to launch with the EC2 Console, skip the next step and go to step 6. 5: Launch the DSM instance with 1-Click Launch. (Skip this step if you want to launch with the EC2 Console.) Before launching the instance, set the parameters in the 1-Click Launch tab: Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

46 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 40 Figure 50: 1-Click Launch parameters a: Set 1-Click Launch parameters: Version. Select version. Region. Choose your desired region. Figure 51: Region EC2 Instant Type: m1.large is the appropriate size for the DSM. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

47 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 41 Figure 52: EC2 instant Type VPC Settings: Choose EC2 Classic (no VPC) Figure 53: VPC Settings Security Group: Choose Vormetric Data Firewall for - 5 Client. If this doesn t exist, choose Create new based on seller settings. This choice will create a security group called Vormetric Data Firewall for -5 Client. The security group you end up with should have the port configuration shown in Table 1 on page 45. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

48 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 42 Figure 54: Security Group Key Pair: Choose a key pair that you created. Make sure you have access to the key file as you will need this later. Figure 55: Key Pair b: Click Launch with 1-Click. An overview of the instance is displayed. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

49 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 43 Figure 56: Instance overview Note the Key Pair, Instance ID and the Security Group. These will be used later. c: Go to AWS Management Console to see the instance. Search for the instance using the Instance ID. Figure 57: DSM instance in dashboard Give the instance a name. Right click the instance, select Add/edit tags, and type a name. For example: DSM-1. d: Add All ICMP to the Security Group. Amazon restricts Internet Control Message Protocol (ICMP) in the default configuration, so you must add ICMP in the security group as described below. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

50 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 44 In the EC2 Dashboard, click on Security Groups. Select the Vormetric Data Firewall security group. Click the Inbound tab, click the Create a new rule pull-down, and select All ICMP. Figure 58: Security Group view Click Add Rule., then click Apply Rule Changes. The ICMP port is added to the Security Group. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

51 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 45 Figure 59: ICMP All added to security group e: The DSM AMI can take minutes to instantiate depending on the AWS load. Skip the next step since you won't need to launch with EC2 Console. 6: Launch DSM instance with EC2 Console. (If you launched with 1-Click Launch, skip this step.) a: Create a new EC2 security group with the following port rules> Table 1: DSM Security Group Port Rules Protocol Port (service) Source ICMP All /0 TCP 22 (SSH) /0 TCP 443 (HTTPS) /0 TCP /0 TCP /0 TCP 8080 (HTTP*) /0 TCP 8443 (HTTPS*) /0 TCP /0 TCP /0 TCP /0 UDP /0 UDP /0 UDP /0 In your EC2 Dashboard click on Security Groups > Create Security Group to bring up this pop-up: Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

52 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 46 Figure 60: Create Security Group pop-up Type in a Name and Description. For example, VDS_Security _Group. Select No VPC. Click Yes, Create. b: Add the port rules. In the EC2 Dashboard, click Security Groups, then Viewing: VPC Security Groups. Select the security group you just created. Click the Inbound tab. In the Create a new rule pull-down, select All ICMP. Figure 61: Security Group Inbound tab Click Add Rule to add rule to the security group. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

53 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 47 Figure 62: Security Group Add Rule button Do this for all the ports in Table 1 on page 45. For TCP Ports, select Custom TCP rule. For UDP Ports, select Custom UPD rule. Figure 63: Security Group with all the rules Click Apply Rule Changes. Click the Refresh button in the top right corner. c: On the Vormetric website in the AWS Marketplace. Click on the Launch with EC2 Console tab. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

54 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 48 Figure 64: Vormetric website in the AWS Marketplace d: Select your desired region and click Launch with EC2 Console. Step 2: Choose an Instance Type opens. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

55 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 49 Figure 65: Instance Type Click General purpose > m1.large, then click Next: Configuration Instance Details. Step 3: Configure Instance Details opens. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

56 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 50 Figure 66: Instance details e: Enter instance details. Use the following values: Network: Select Launch into EC2-Classic. All other values can be kept as is. Click Next: Add Storage. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

57 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 51 Step 4, Add Storage page opens. Figure 67: Advanced Instance Options f: No changes are required for VDS in Step 4: Add Storage. Click Next: Tag Instance. Step 5: Tag Instance opens. Figure 68: Tag Instance Enter a name for this instance (example: DSM-1), then click Next: Configure Security Group. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

58 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 52 Step 6: Configure Security Group opens. Figure 69: Security groups Click Select an existing security group, then select the security group that you had created earlier (step 6a: Create a new EC2 security group with the following port rules>) and click Review and Launch. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

59 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 53 Step 7: Review Instance Launch opens. Figure 70: Review Instance Launch g: Review the instance parameters and click Launch. Select an existing key pair or create a new key pair pop-up opens. Figure 71: Key pairs h: Select Choose from your existing Key Pair (if you have one) or Create a new Key Pair. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic

60 TO INSTALL A DATA SECURITY MANAGER (DSM) IN EC2 CLASSIC 54 Download the key and remember your key path (location of the.pem file) as you will need this later. Check the Acknowledgment checkbox and click Launch Instances. The instance is launched. i: Return to the EC2 Instances page to view your newly created instance. AWS returns you to the EC2 Management Console. Click Instances. Figure 72: Instance view of new DSM Search for the name of your DSM. The DSM instance is now running. 7: Configure the DSM. The DSM configuration script is on the DSM instance. The script starts when you connect to your DSM instances with an SSH client. There are many ways to start an SSH session, see Connect to Your Amazon Instance. Note: You may have to wait minutes after the DSM is instantiated before you can make an SSH connection to the DSM. If you try to make an SSH connection and you get a pop-up that reads Connection Refused, then continue waiting. a: Connect an SSH client to your DSM instance and login with the user name: ec2-user. This automatically starts the DSM configuration script. Use the following values to start the SSH session. Host Name (or IP address). Enter the IP address or Public DNS. Your Public DNS is displayed under the Description tab in the Instance view. See Figure 27: Public DNS. Private key path: Enter the path of the.pem (or.ppk if you are using PuTTY) file that you generated earlier (Figure 71: Key pairs ). In the PuTTY Configuration pop-up, under Category, click the + icon next to SSH, select Auth, then ent er the path to your.ppk file in the Private key file for authentication: field. Document Version 1.2 All-in-Cloud Installation Guide Installing Vormetric Data Security in Amazon EC2 Classic