search

rnurgaliyev / kmip-server-dsm

KMIP Server for Synology DSM
MIT License
98 stars 15 forks source link

readme

KMIP Server for Synology DSM

This container implements a private KMIP server for Synology DSM to store the Encryption Key Vault. By default, DSM offers you to store your vault on the same hard drives where you have encrypted data, which is a big security risk, or to store it on another Synology NAS somewhere online, which might not be convenient for most setups. This KMIP server is very easy to use and can be started on a small computer like Raspberry Pi, where you can have your own way to protect the KMIP server itself, for example, store it on LUKS partition and do not automatically mount it on reboot.

The minimum version of Synology DSM that works properly with this KMIP server is DSM 7.2-64570.

Latest Synology DSM which was checked to be compatible with this KMIP server is DSM 7.2.2-72806.

Based on PyKMIP project.

Installation

You will need a Linux computer/board/VM running Git, and Podman or Docker. There are no other requirements. This container does not pollute your system and only touches files in the directory it was launched from.

  1. Clone this repository

    $ git clone https://github.com/rnurgaliyev/kmip-server-dsm
$ cd kmip-server-dsm

  2. Review configuration file with your favorite text editor (important!)

    $ vim ./config.sh

Building and runnning container manually

  1. Build and run the container using docker compose. I don't provide binary images because you don't want to trust your secrets to unknown binaries. Instead, study the contents of this repository to feel comfortable, and build a KMIP server yourself. 
    $ docker compose up -d

Where is my data stored?

All keys and certificates are stored in the certs directory, and the KMIP database itself is stored in the state directory. Both directories are mounted in the KMIP server container. You can stop and remove a running container, but your certificates and data will not be lost. It is in your best interest to keep this repository with these directories in a safe place, such as an encrypted file system or RAM disk. You can always wipe the contents of these directories and start from scratch if you have recovery keys for your NAS volumes.

Synology DSM configuration

Shortly after the container is started for the first time, some SSL keys and certificates in the certs directory. You will need to copy these files to your NAS:

Connect to your DSM web interface and go to Control Panel -> Security -> Certificate. Click Add, then Add a new certificate, enter KMIP in the Description field, then Import certificate. Select the file client.key for Private Key, client.crt for Certificate and ca.crt for Intermediate Certificate. Then click on Settings and select the newly imported certificate for KMIP.

Switch to the 'KMIP' tab and configure the 'Remote Key Client'. Hostname is the address of this KMIP server, port is 5696, and select the ca.crt file again for Certificate Authority.

You should now have a fully functional remote Encryption Key Vault.

Troubleshooting

On DSM side:

  1. Connect to your NAS via SSH
  2. Check logs of kmip service: 
    $ sudo journalctl -u kmip.service -ef

On KMIP server side:

  1. Jump into the container (replace podman with docker if needed): 
    $ podman exec -ti dsm-kmip-server /bin/sh
  2. Check pykmip logs: 
    $ cat /var/log/pykmip/server.log

Tips on creating encrypted storage on Raspberry Pi

These are tips on how to create an encrypted filesystem on Raspberry Pi where you can store your KMIP server. These steps can be adapted for any other type of computer or VM.

  1. Download Ubuntu Server image for Raspebby Pi from the Ubuntu website.

  2. Write the image to an SD card. Before rebooting, plug the SD card into existing Linux machine. We will play with partitioning table a little bit. Assuming your SD card is /dev/sdc:

    $ xz -d ubuntu-22.04.2-preinstalled-server-arm64+raspi.img.xz
$ sudo dd if=./ubuntu-22.04.2-preinstalled-server-arm64+raspi.img of=/dev/sdc status=progress

  3. Assuming your SD card is /dev/sdc, start fdisk:

    
$ sudo fdisk /dev/sdc

Welcome to fdisk (util-linux 2.38.1). Changes will remain in memory only, until you decide to write them. Be careful before using the write command.

Command (m for help): 


4. List partitions and note where the second partition starts, we will need this
address later:

Command (m for help): p Disk /dev/sdc: 58,63 GiB, 62948114432 bytes, 122945536 sectors Disk model: Micro blackhole based storage Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x12c9124a

Device Boot Start End Sectors Size Id Type /dev/sdc1 * 2048 526335 524288 256M c W95 FAT32 (LBA) /dev/sdc2 526336 8074399 7548064 3,6G 83 Linux

Command (m for help): 

Note that `/dev/sdc2` starts at 526336.

5. Delete the second partition:

Command (m for help): d Partition number (1,2, default 2): 2

Partition 2 has been deleted.


6. Create a new partition. Make sure you start the new partition on the same
sector where the old one was. Decide how much space you want to leave for the
encrypted storage and enter it in the `Last sector` with a minus sign, in the
example below I left 8 gigabytes at the end of the disk:

Command (m for help): n Partition type p primary (1 primary, 0 extended, 3 free) e extended (container for logical partitions) Select (default p): p Partition number (2-4, default 2): 2 First sector (526336-122945535, default 526336): 526336 Last sector, +/-sectors or +/-size{K,M,G,T,P} (526336-122945535, default 122945535): -8G

Created a new partition 2 of type 'Linux' and of size 50,4 GiB. Partition #2 contains a ext4 signature.

Do you want to remove the signature? [Y]es/[N]o: No

Command (m for help): 

Be sure to answer NO when you are asked if you want to remove the existing file
system signature.

7. Now create the last partition, that you will use for your encrypted storage.
Just hit `ENTER` on all questions:

Command (m for help): n Partition type p primary (2 primary, 0 extended, 2 free) e extended (container for logical partitions) Select (default p):

Using default response p. Partition number (3,4, default 3): First sector (106168320-122945535, default 106168320): Last sector, +/-sectors or +/-size{K,M,G,T,P} (106168320-122945535, default 122945535):

Created a new partition 3 of type 'Linux' and of size 8 GiB.

Command (m for help): 


8. Now you have an SD card with boot, root, and data partition, which you will
use later for an encrypted file system. Check that everything looks good and
write the changes to disk:

Command (m for help): p Disk /dev/sdc: 58,63 GiB, 62948114432 bytes, 122945536 sectors Disk model: Micro blackhole based storage Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x12c9124a

Device Boot Start End Sectors Size Id Type /dev/sdc1 * 2048 526335 524288 256M c W95 FAT32 (LBA) /dev/sdc2 526336 106168319 105641984 50,4G 83 Linux /dev/sdc3 106168320 122945535 16777216 8G 83 Linux

Command (m for help): w The partition table has been altered. Calling ioctl() to re-read partition table. Syncing disks.


9. Last step before booting your Raspberry Pi with this SD card is to expand
root file system:

$ sudo resize2fs /dev/sdc2 resize2fs 1.47.0 (5-Feb-2023) Resizing the filesystem on /dev/sdc2 to 13205248 (4k) blocks. The filesystem on /dev/sdc2 is now 13205248 (4k) blocks long.


10. Boot your Raspberry Pi and do a basic initial setup. Check that you can see
the third partition you created above and make sure it is not mounted anywhere:

$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS loop0 7:0 0 59.1M 1 loop /snap/core20/1826 loop1 7:1 0 109.6M 1 loop /snap/lxd/24326 loop2 7:2 0 43.2M 1 loop /snap/snapd/18363 loop3 7:3 0 59.1M 1 loop /snap/core20/1832 sda 8:0 0 111.8G 0 disk ├─sda1 8:1 0 256M 0 part /boot/firmware ├─sda2 8:2 0 104.1G 0 part / └─sda3 8:3 0 7.5G 0 part 


11. You can now create an encrypted file system:

$ sudo cryptsetup luksFormat /dev/sda3

WARNING!

This will overwrite data on /dev/sda3 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES Enter passphrase for /dev/sda3: Verify passphrase: Ignoring bogus optimal-io size for data device (33553920 bytes).


12. You can now open /dev/sda3, create filesystem on it and mount it:

$ sudo cryptsetup open /dev/sda3 myvault Enter passphrase for /dev/sda3:

$ sudo mkfs.ext4 /dev/mapper/myvault mke2fs 1.46.5 (30-Dec-2021) Creating filesystem with 1949046 4k blocks and 487680 inodes Filesystem UUID: 9e9183a9-5d51-4782-9990-d99eb48dfc87 Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done Writing superblocks and filesystem accounting information: done

$ sudo mount /dev/mapper/myvault /mnt


13. You now have encrypted storage in `/mnt`. Check it with `df -h`:

$ df -h Filesystem Size Used Avail Use% Mounted on tmpfs 781M 3.1M 778M 1% /run /dev/sda2 103G 18G 81G 18% / tmpfs 3.9G 200K 3.9G 1% /dev/shm tmpfs 5.0M 0 5.0M 0% /run/lock /dev/sda1 253M 148M 105M 59% /boot/firmware tmpfs 781M 80K 781M 1% /run/user/1001 /dev/mapper/myvault 7.3G 24K 6.9G 1% /mnt


Now you can clone this repository to a protected space on your Raspberry Pi.
This file system will not be automatically unsealed after reboot, and you will
need to unseal it with a password and mount it. After that, just restart the
KMIP server container with `run-container.sh`.

## Disclaimer

Everything in this repository is provided to you "as is". I am not affiliated
with Synology or the PyKMIP project. I take no responsibility for lost data or
security issues.