This is a talk I gave last week at the SF Microservices Meetup titled Policy-based Cloud Storage, Persisting Data in a Multi-Site, Multi-Cloud World. In it I cover Apcera‘s approach to storage for containers and how to use policy to manage very large scale application deployments.
I have an Ubuntu 15.04 “Vivid” workstation already set up with LUKS full disk encryption, and I have a Synology DS414 NAS with 12TB raw storage on my home network. I wanted to add a disk volume on the Synology DS414 that I could mount on the Ubuntu server, but NFS doesn’t support “at rest” encrypted file systems, and using EncFS over NFS seemed like the wrong way to go about it, so I decided to try setting up an iSCSI volume and encrypting it with LUKS. Using this type of setup, all data is encrypted both “on the wire” and “at rest”.
Log into the Synology Admin Panel and select Main Menu > Storage Manager:
- Add an iSCSI LUN
- Set Thin Provisioning = No
- Advanced LUN Features = No
- Make the volume as big as you need
- Add an iSCSI Target
- Use CHAP authentication
- Write down the login name and password you choose
On your Ubuntu box switch over to a root prompt:
Install the open-iscsi drivers. (Since I’m already running LUKS on my Ubuntu box I don’t need to install LUKS.)
apt-get install open-iscsi
Edit the conf file
Edit these lines:
node.startup = automatic node.session.auth.username = [CHAP user name on Synology box] node.session.auth.password = [CHAP password on Synology box]
Restart the open-iscsi service:
service open-iscsi restart service open-iscsi status
Start open-iscsi at boot time:
systemctl enable open-iscsi
Now find the name of the iSCSI target on the Synology box:
iscsiadm -m discovery -t st -p $SYNOLOGY_IP iscsiadm -m node
The target name should look something like “iqn.2000-01.com.synology:boxname.target-1.62332311”
Still on the Ubuntu workstation, log into the iSCSI target:
iscsiadm -m node --targetname "$TARGET_NAME" --portal "$SYNOLOGY_IP:3260" --login
Look for new devices:
At this point fdisk should show you a new block device which is the iSCSI disk volume on the Synology box. In my case it was /dev/sdd.
Partition the device. I made one big /dev/sdd1 partition, type 8e (Linux LVM):
Set up the device as a LUKS-encrypted device:
cryptsetup --verbose --verify-passphrase luksFormat /dev/sdd1
Open the LUKS volume:
cryptsetup luksOpen /dev/sdd1 backupiscsi
Create a physical volume from the LUKS volume:
Add that to a new volume group:
vgcreate ibackup /dev/mapper/backupiscsi
Create a logical volume within the volume group:
lvcreate -L 1800GB -n backupvol /dev/ibackup
Put a file system on the logical volume:
Add the logical volume to /etc/fstab to mount it on startup:
# Synology iSCSI target LUN-1 /dev/ibackup/backupvol /mnt/backup ext4 defaults,nofail,nobootwait 0 6
Get the UUID of the iSCSI drive:
ls -l /dev/disk/by-uuid | grep sdd1
Add the UUID to /etc/crypttab to be automatically prompted for the decrypt passphrase when you boot up Ubuntu:
backupiscsi UUID=693568ca-9334-4c19-8b01-881f2247ae0d none luks
If you found this interesting, you might want to check out my article Adding an external encrypted drive with LVM to Ubuntu Linux.
Hope you found this useful.
The StratoStor project I’ve been working on for the past 10 months just got a “Top 5 New Products or Technologies to Watch” award from HPCwire announced at this week’s SuperComputing 2014 (SC14) conference in New Orleans.
HPC = High Performance Computing, HPCwire is a news bureau for all things regarding High Performance Computing, and SC14 is where every major vendor of HPC equipment and products shows off their wares, so getting this bit of recognition from the readers of HPCwire is really nice.
So THANK YOU HPCwire readers, for this award.