[LU-15582] RFI for lustre encryption

• Status: Open
• Project: Lustre
• Affects Version/s: Lustre 2.12.8
• Type: Story
• Priority: Major
• Reporter: Ryan Seal
• Assignee: Sebastien Buisson
• Resolution: Unresolved

Environment

RHEL 7

Description

We are running a lustre cluster and have been requested to determine if communications between clients and servers is encrypted. Requesting assistance in determining with if our client and servers lustre communications is encrypted. 

Comments

[Peter Jones]

Sébastien

Could you please talk to the options in this area, both in 2.12.x and more current releases

Thanks

Peter

[Sebastien Buisson]

Hi Ryan,

In Lustre 2.12, you have two options to get the client/server communications encrypted:

• you can configure Kerberos for Lustre, with the krb5p flavor. It ensures privacy of both RPC messages and bulk data. Please refer to the Lustre documentation for full details, at https://doc.lustre.org/lustre_manual.xhtml#managingSecurity.kerberos
• you can make use of the Shared-Secret Key (SSK) feature, which provides privacy of both RPC messages and bulk data when the skpi flavor is selected. For full details, please refer to https://doc.lustre.org/lustre_manual.xhtml#lustressk.

In Lustre 2.14/2.15, you get one more option thanks to the client-side encryption feature. Its purpose is to protect data at rest, but as it is implemented on Lustre client side, most of the traffic between clients and servers gets encrypted when accessing an encrypted directory. Please note that some information remains unencrypted even for encrypted files, such as timestamps, access rights, file owner, extended attributes, but depending on your use case it might be fine.
The documentation for client-side encryption is available here:
https://doc.lustre.org/lustre_manual.xhtml#managingSecurity.clientencryption

Please let me know if you need more information.
Cheers,
Sebastien.