Encryption and Security Considerations for VACM

VACM can optionally utilize the OpenSSL encryption libraries to create secure communications connections in virtually all aspects of operation. The only exceptions are in modules which require direct interfaces to hardware over LAN where SSL protocol version 1 encryption may not be available on the remote hardware. To enable encryption support, you must first ensure that the OpenSSL libraries are installed on your Node Controller. If you are going to use any modules which require agent daemons, you must also ensure the OpenSSL libraries are installed on every remote system you wish to manage and monitor. Once the libraries are installed, pass the --enable-ssl commandline option to the autogen.sh configuration script, and make sure to verify in the output that OpenSSL was detected. VACM itself has a number of security features which ensure that only authorized administrators may manage or monitor systems. Each administrator must have a valid Nexxus user account. The account can only be logged into from authorized internet addresses, and once authenticated and authorized, the user may only execute commands that have been authorized for the particular user.

In order to utilize an SSL connection, you will need to generate a key and a certificate file on the nexxus machine as well as on any nodes which will be managed using sysstatd or user_admd.

To generate a cerificate and key on the nexxus machine:

openssl req -x509 -newkey rsa:1024 -keyout /usr/lib/vacm/vacm.key -out \ /usr/lib/vacm/vacm.cert

After filling in all the information you will have a valid SSL certificate file and key file available to VACM. The problem now arises that you will have to enter a passphrase every time you wish to start nexxus. This is not always the desirable effect in a cluster environment. You can unwrap the passphrase from the key with the following commands, but you should bear in mind that there are serious security implications in doing this. Please ensure that this is truly necessary in your environment.

openssl rsa -in /usr/lib/vacm/vacm.key -out /usr/lib/vacm/vacm.key.unwrapped mv /usr/lib/vacm/vacm.key /usr/lib/vacm/vacm.key.wrapped mv /usr/lib/vacm/vacm.key.unwrapped /usr/lib/vacm/vacm.key

Similarly, on the node side:

openssl req -x509 -newkey rsa:1024 -keyout /etc/vacm.key -out \ /etc/vacm.cert

As with the nexxus key file, you may want to unwrap the password on this key. The following should do it.

openssl rsa -in /etc/vacm.key -out /etc/vacm.key.unwrapped mv /etc/vacm.key /etc/vacm.key.wrapped mv /etc/vacm.key.unwrapped /etc/vacm.key