See below for installing the Policy Agent on Linux.

Make sure you have completed the prerequisites described in Linux Installation Prerequisites.

Downloading the installation file

See below for installing the Policy Agent installation file.

To download the Policy Agent installation file

  1. Log in to the Cryptographic Security Platform Vault for VM Encryption webGUI or the Cryptographic Security Platform Vault for Databases webGUI with Cloud Admin privileges.
  2. Click Workloads.
  3. Click Actions > Download Policy Agent.
  4. Click the Download link associated with the following file:
    hcs-client-agent-rel.number-build.number.run
     

Creating a certificate for the registration process

Create a certificate that you can install on the VM and use during the registration process.

Skip this section if you want to use Simplified or Automated Authentication.

To create a certificate for the registration process

  1. Select the Cloud VM Set with which you want to associate the VM.
  2. Click Actions > Create New Certificate.
  3. If desired, enter a passphrase for the certificate. If you enter a passphrase here, you will need to enter that passphrase when you install the certificate on the VM.
  4. Enter a date on which this certificate should expire.

  5. Click Create. Cryptographic Security Platform Vault downloads a .cert file to the default download location. 

    Do not rename the downloaded certificate. The certificate name includes additional information, and a renamed certificate will fail.


  6. Log in to the target system as root.

  7. Go the directory containing the following file: 

    1. hcs-client-agent-rel.number-build.number.run



     

  8. # sh ./hcs-client-agent-rel.number-build.number.run [install -y] [-P Installation_Path]

    Where -y tells the installer to use the default installation directory (/opt/hcs) without prompting, and -P specifies the installation directory.

    Important:  

    • hcs-client-agent-rel.number-build.number.run extracts itself to the /tmp directory. Make sure that you have executable permissions to /tmp.

    • If you run the installer and get the following error:

      ./install.sh: Permission denied

      then you can must use a different directory for the temporary directory using the environment variable TMPDIR as follows: 

      #> TMPDIR=$HOME

      When uninstalling the Linux Policy Agent you will also need to use a different directory.

    The following examples both install the Policy Agent in the directory /opt/hcs, but in the first one the user is prompted for the installation directory and in the second the installer uses that directory without prompting:

    # sh ./hcs-client-agent-10.5.1-12345.run
Verifying archive integrity... All good.
Uncompressing hcs-client-agent.run.............
HyTrust Agent will be installed in /opt/hcs
Specify location for installing HyTrust Agent (/opt/hcs): <Enter>
Run once hcld
Starting hcld... done

You can now install online encryption driver, the process is described in the Admin Guide
Please see the following section of Admin Guide for details
  — Administration Guide > Data Encryption > Linux Encryption Overview
					
Installation successful
    # sh ./hcs-client-agent-10.5.1-12345.run install -y
Verifying archive integrity... All good.
Uncompressing hcs-client-agent.run.............
HyTrust Agent will be installed in /opt/hcs
Run once hcld
Starting hcld... done

You can now install online encryption driver, the process is described in the Admin Guide
Please see the following section of Admin Guide for details
  — Administration Guide > Data Encryption > Linux Encryption Overview				

Installation successful

    The following example installs the Policy Agent in the specified directory /opt/test without prompting:

    # sh ./hcs-client-agent-10.5.1-12345.run install -y -P /opt/test
Verifying archive integrity... All good.
Uncompressing hcs-client-agent.run.............
HyTrust Agent will be installed in /opt/test
Run once hcld
Starting hcld... done

You can now install online encryption driver, the process is described in the Admin Guide
Please see the following section of Admin Guide for details
  — Administration Guide > Data Encryption > Linux Encryption Overview				

Installation successful

  9. Register the VM with Cryptographic Security Platform Vault using the following command:

    hcl register [-a] [-h vm-name] [-d "vm-description"] [-p cert-passphrase] [-o one-time-passphrase] [-z cvm-set] [-v vault_id] [-n mapping-name] [-N] kc-hostname[:port],kc-hostname2[:port],... [cert-file.cert]

    where:

    • -a—Indicates that you want to authenticate the VM through the command line or the script instead of through a certificate file. Use this option if you are using Simplified or Automated Authentication. If you created a certificate in Cryptographic Security Platform Vault, omit this option and specify the certificate name in cert-file.cert.

    • -c—Allows you to register this VM as clone of the original VM.

    • -h—The name of the VM that will be displayed in the Cryptographic Security Platform Vault webGUI (Default: hostname).
    • -d—A description of the VM that will be displayed in the Cryptographic Security Platform Vault webGUI.
    • -p—The passphrase assigned to the certificate when it was created. If you do not specify this parameter and the certificate has an associated passphrase, the registration process prompts you for the passphrase. Applies to Standard Authentication only.

    • -v—The Vault ID of the Vault that will be displayed in Vault Management. If you do not specify the vault_id, you will be asked to enter vault_id ..

    • -o—The one-time passphrase that will be used to encrypt the initial communication between this VM and the existing Cryptographic Security Platform Vault cluster. If you do not specify this parameter, the registration process prompts you for the one-time passphrase. Applies to Standard Authentication only.

      Note: The passphrase is valid for 15 minutes from the time it is created. Make sure you authenticate the VM in Cryptographic Security Platform Vault during this time. Authentication will fail after the passphrase has expired.

    • -z—The name of the Cloud VM Set defined in the Cryptographic Security Platform Vault cluster to which you want to assign this VM. Applies to Simplified or Automated Authentication only (the -a option must be specified on the hcl register command).
    • -n—The name of the Cluster Node Mapping that you want to associate with this VM. If you do not specify this option and one or more Cluster Node Mappings have been configured, the Policy Agent prompts you to select a Node Mapping from the list. If you do not want to use a Node Mapping, you must manually respond to this prompt. This option is mutually exclusive with the -N option, described below, and it requires that the -a option must be specified on the hcl register command.
    • -N—Tells the Policy Agent that you do not want to use a Cluster Node Mapping, even if one is available. If you specify both -N and -n, the Policy Agent ignores the -n option and does not assign a Node Mapping to the VM. Applies to Simplified or Automated Authentication only (the -a option must be specified on the hcl register command).

    • kc-hostname[:port],kc-hostname2[:port],... (required) — The list of IP addresses or hostnames for the Cryptographic Security Platform Vault nodes with which you want to register the VM. You must specify at least one Cryptographic Security Platform Vault node in this list. You must also specify a port if the Cryptographic Security Platform Vault nodes use anything other than the default port (443).

      If you are using the -n option to specify a Cluster Node Mapping, this IP address will be the Cryptographic Security Platform Vault node that the VM contacts to retrieve the Node Mapping information. After the Node Mapping has been retrieved, the Policy Agent ignores any other IP addresses in this list and only registers the VM with the Cryptographic Security Platform Vault nodes in the contained in the Node Mapping.

    • cert-file.cert—The name of the certificate file you copied to the target system if you are using Standard Authentication. If you are running the hcl register command from a directory other than the one where the .cert file resides, specify the full path to the .cert file as part of this option. If you did not create a certificate file in Cryptographic Security Platform Vault, omit this option and use the -a option instead.

Registration Examples with Standard Authentication

If the VM name is "hq-vm-4", the description is "HQ Linux Server Alpha", and you want to register it using Standard Authentication with two Cryptographic Security Platform Vault nodes at 10.238.32.74 and 10.238.32.75, you would enter:

# hcl register -h hq-vm-4 -d "HQ Linux Server Alpha" 10.238.32.74,10.238.32.75 \
      ad85837b-9862-11e1-afd5-000c29de5d41_120507163538.cert
You need to specify a passphrase that will be used for authentication
Enter passphrase (min 16 characters): passphrase16chars
			
Registered as hq-vm-4 with node(s) 10.238.32.74,10.238.32.75
Please login to the node to complete the authentication of this node

To register the VM in a single command where the .cert file resides in the directory /install/hytrust/cert, you would enter:

# hcl register -h hq-vm-4 -d "HQ Linux Server Alpha" -p certpassphrase \ 
      -o onetimepassword16chrsmin 10.238.32.74,10.238.32.75 \
      ./install/hytrust/cert/ad85837b-9862-11e1-afd5-000c29de5d41_120507163538.cert

Registered as hq-vm-4 with node(s) 10.238.32.74,10.238.32.75
Please login to the node to complete the authentication of this node

Registration Examples with Simplified Authentication

In this example, the VM name is "hq-vm-4", the description is "HQ Linux Server Alpha", and the Cryptographic Security Platform Vault node you want to use is at 10.238.66.250. You want to be prompted for the Cryptographic Security Platform Vault Cloud Admin account information, the Cloud VM Set, and the Cluster Node Mapping.

In this case, you would enter:

# hcl register -a -h hq-vm-4 -d "HQ Linux Server Alpha" 10.238.66.250

Do you want to register into a Vault?  (y/n) y
Please provide the vaultID
vaultid: d84243e7-d359-4179-9530-3497434e3192
Please provide the login details
username: CloudAdmin
password: 

Available Cloud VM Sets
--------------------------------------------------------------------------------
SF-Datacenter
--------------------------------------------------------------------------------

Please specify Cloud VM Set to which this VM should be added: SF-Datacenter
Registered as hq-vm-4 with node(s) 10.238.66.250

Completing authentication for hq-vm-4 on node(s) 10.238.66.250

Authentication complete, machine ready to use
Getting Mapping information


This VM can be added to one of the following Mappings
--------------------------------------------------------------------------------
1 : SF-Datacenter-Map
2 : West-Coast-Map
--------------------------------------------------------------------------------

Please select a numeric Mapping ID (0 to skip): 1
Mapping: SF-Datacenter-Map
server description First Node, ip 10.238.66.250, port 443
server description Second Node, ip 10.238.66.251, port 443
Updated list with nodes 10.238.66.250:443,10.238.66.251:443

To specify the name, description, Cloud VM Set and Cluster Node Mapping in a single command, you would enter:

# hcl register -a -h hq-vm-4 -v d84243e7-d359-4179-9530-3497434e3192 -d "HQ Linux Server Alpha" -z SF-Datacenter -n SF-Datacenter-Map 10.238.66.250

Please provide the login details
username: CloudAdmin
password: 
Registered as hq-vm-4 with node(s) 10.238.66.250

Completing authentication for hq-vm-4 on node(s) 10.238.66.250

Authentication complete, machine ready to use
Getting Mapping information

Mapping: SF-Datacenter-Map
server description First Node, ip 10.238.66.250, port 443
server description Second Node, ip 10.238.66.251, port 443
Updated list with nodes 10.238.66.250:443,10.238.66.251:443

Registration Example with Automated Authentication

If the VM name is "hq-vm-4", the description is "HQ Linux Server Alpha", and you want to register it using Automated Authentication with two Cryptographic Security Platform Vault nodes at 10.238.32.74 and 10.238.32.75, you would create a registration script containing the following command:

# hcl register -a -h hq-vm-4 -d "HQ Linux Server Alpha"  -v d84243e7-d359-4179-9530-3497434e3192 -u htcloudadmin -s 'DogDays123!' \
      10.238.32.74,10.238.32.75
Certificate passphrase might be required
Certificate successfully unpacked


Registered as hq-vm-4 with node(s) 10.238.32.74,10.238.32.75
Completing authentication for hq-vm-4 on node(s) 10.238.32.74,10.238.32.75
Authentication complete, machine ready to use

What to Do Next 

If you used Standard Authentication, authenticate the VM with Cryptographic Security Platform Vault as described in Authenticating a New VM. If you used Simplified or Automated Authentication, encrypt the drive as described in Data Encryption Overview.