Black Box EncrypTight User manual

BL A C K B OX®
EncrypTight acts as a transparent overlay that
integrates easily into any existing network
architecture, providing encryption rules and keys
to EncrypTight Enforcement Points.
EncrypTight consists of a suite of tools that performs various tasks of
appliance and policy management, including Policy Manager (PM),
Key Management System (KMS), and EncrypTight Enforcement Points
(ETEPs).
EncrypTight Getting Started Guide
ET0010A
ET0100A
ET1000A
Order toll-free in the U.S.: Call 877-877-BBOX (outside U.S. call 724-746-5500)
FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax [phone]
Mailing address: Black Box Corporation, 1000 Park Drive, Lawrence, PA 15055-1018
Web site: www.blackbox.com • E-mail: [e-mail]
Customer
Support
Information

1
EncrypTight — Getting Started
This guide is intended as a jump start to using the EncrypTight system. This guide assumes that you have
already installed and cabled your ETEPs and at least one ETKMS. It describes how to configure the
ETEPs and the ETKMS and the basic methods for creating Layer 2 and Layer 3 policies.
This guide includes the following topics:
●Before You Begin
●Overview - Elements of the EncrypTight System
●Setting Up ETEPs
●Configuring the ETKMS
●Starting the EncrypTight Software
●Installing the EncrypTight License
●Configuring Appliances in ETEMS
●Creating a Layer 2 Policy
●Creating a Layer 3 Policy
Before You Begin
The EncrypTight system is a licensed product. After you install the EncrypTight software, contact
Customer Support to acquire your license key. You will need to provide the EncrypTight ID. To view the
EncrypTight ID, choose Edit > License. Contact Customer Support at:
Phone: [phone]
Fax: [phone]
Email: [e-mail]
Overview - Elements of the EncrypTight System
The EncrypTight system includes:
●EncrypTight Enforcement Points (ETEPs)
ETEPs are encryption appliances that enforce the security policies that you create in the EncrypTight
Policy Manager (ETPM). In ETPM, encryption appliances are referred to as Policy Enforcement
Points (PEPs).
●One or two EncrypTight Key Management Systems (ETKMS)
The ETKMS generates encryption keys and distribute the policies to the ETEPs.

Setting Up ETEPs
2EncrypTight — Getting Started
●EncrypTight software, including EncrypTight Element Management System (ETEMS) and
EncrypTight Policy Manager (ETPM).
ETEMS is an element manager that you use to configure the ETEPs. ETPM is the policy generation
and management tool.
Setting Up ETEPs
In order to use the ETEPs, after you connect the appropriate cables, you must log in through the serial
port and use CLI commands to assign an IP address, network mask, and default gateway for the
management port. You can also set the date and time.
Logging In Through a Serial Link
Initial setup is performed through a serial link to the RS-232 port.
To log in to the CLI via a serial link:
1 Connect the RS-232 serial port directly to a PC or workstation.
2 Open a terminal session through a VT-100 terminal emulation program such as HyperTerminal. Enter
the connection name, the appropriate serial port (usually COM1 or COM2), and the following serial
port parameters:
3 In the terminal session window, press ENTER. The login prompt displays.
4 At the login prompt, type the default user name admin and press ENTER. User names and
passwords are case-sensitive.
5 At the password prompt, type the default password admin and press ENTER.
6 When you are successfully logged in, the command line prompt displays as shown below (password
text is not displayed).
pep login: admin
Password:
Last login: Tue Jan 29 19:18:59 2010 on ttyS0
Welcome admin it is Tue Jan 29 19:37:12 UTC 2010
admin>
It is recommended that you change the default passwords when you configure the ETEP for operation
using ETEMS. See the EncrypTight documentation for more information about user management.
Baud Speed 38,400
Parity None
Data Bits 8
Stop Bits 1
Flow Control None

Setting Up ETEPs
EncrypTight — Getting Started 3
CAUTION
Keep track of the passwords you assign. If you lose the admin password, you can lose the ability to
communicate with and manage the appliance. In some cases, restoring the unit to working order can
require factory service.
Initial ETEP Configuration
ETEPs can be managed in-line or out-of-band through a dedicated Ethernet management interface. To use
the ETEP in an EncrypTight deployment, the basic configuration includes specifying an IP address for the
management port and setting the date and time.
The Ethernet management port IP address identifies the ETEP to the management workstation. The
subnet mask is the portion of the IP address that identifies the network or subnetwork for routing
purposes.
When the ETEP management port and the management workstation or the ETKMS are on different
subnets, the ETEP uses a default gateway to route packets to the other devices. The default gateway
identifies the local router port that is on the same subnet as the ETEP Ethernet management port.
Figure 1 shows an example of a default gateway when the management station and ETEP are on different
subnets. The management station’s IP address is 192.168.1.10, and the ETEP’s management port IP
address is 192.168.10.10. To send packets between the two devices, the local port on Router #1 is
specified as the default gateway (192.168.10.1). The gateway address must match the subnet of the
management port.
Figure 1 Management Port Default Gateway
To configure the management port:
1 At the command prompt, type configure to enter configuration mode.
2Attheconfig> prompt, type management-interface.
3 To assign the management port IP address, mask, and gateway, type
ip <ip address> <subnet mask> [gateway]
ip address Management port IP address, entered in dotted decimal notation.
subnet mask IP subnet mask, entered in dotted decimal notation.

Configuring the ETKMS
4EncrypTight — Getting Started
After entering the new IP address, it takes 10-20 seconds for the ETEP to set the address on the
management port. During that time you cannot enter any CLI commands. When the operation is
complete, the man-if> prompt is displayed.
4 Auto-negotiation is enabled by default. If you want to disable auto-negotiation and manually set the
link speed and flow control, configure the autoneg command. For instructions, refer to the ETEP
Installation Guide.
5Type
exit to return to the config prompt.
6 The time zone on the ETEP is set to UTC 0 (Coordinated Universal Time), and is not user
configurable. At the config> prompt, type date <year> <month> <day> <hour>
<minutes> <seconds>
7Typeexit to return to the command prompt.
Example:
The following example sets the management port IP address, subnet mask, and gateway for the ETEP
as shown in Figure 1. It also sets the date and time. Auto-negotiation is left at its default setting of
enabled.
admin> configure
config> management-interface
man-if> ip 192.168.10.10 255.255.255.0 192.168.10.1
man-if> exit
config> date 2010 07 12 15 30 00
config> exit
Configuring the ETKMS
You can use either a local ETKMS or an external ETKMS. The local ETKMS is intended for use with
small to medium networks with no more than 10 nodes.
Although some of the essential configuration of the ETKMS is the same for both local a ETKMS and an
external ETKMS, the procedures for configuring each are different. For this reason, the basic
configuration of a local ETKMS is discussed separately.
Basic Configuration for a Local ETKMS
When you use a local ETKMS, the ETKMS software runs on the same workstation as the EncrypTight
software. Keep in mind the following information:
●Although the EncrypTight application does not need to remain open, the ETKMS software needs to
run continuously in order to renew keys and refresh policies. For this reason, install the EncrypTight
software on a reliable workstation. In addition, disable the Windows standby and hibernation modes.
gateway Specifies how to route traffic between the ETEP management port and the
management station or ETKMS. When the management port is on a different
subnet than the management station or ETKMS, specify the IP address of the
router’s local port on the same subnet as the ETEP management port (see
Figure 1). If the devices are on the same subnet, you do not need to enter a
default gateway.

Configuring the ETKMS
EncrypTight — Getting Started 5
The local ETKMS software cannot renew keys and refresh policy lifetimes if the workstation enters
standby or hibernation mode.
●It is strongly recommended that you assign a static IP address to the local ETKMS. If the local
ETKMS IP address does not match the management station IP address, an error is generated when
you attempt to launch the local ETKMS.
●The local ETKMS uses the time and date settings in effect on the workstation on which the
EncrypTight software is installed. Because EncrypTight is dependant on network-wide clock
synchronization, it is strongly recommended that you set up the management workstation to
synchronize with an NTP server rather than setting the date and time manually. You should use the
same time service for the EncrypTight workstation and the PEPs.
●You cannot run web server software on the same workstation as the EncrypTight software. The
ETKMS application must use port 443. Running a web service on the same workstation generates an
error message when you attempt to launch the local ETKMS.
To learn more about using a local ETKMS, see the EncrypTight User Guide.
Setting the IP address for a Local ETKMS
You set the IP address for a local ETKMS when you add the ETKMS in the ETEMS Appliance Manager.
The IP address must be the IP address of the workstation on which EncrypTight is installed.
To add a local ETKMS:
1 In the Appliance Manager, click File > New.
2 In the New Appliance editor, from the Product Family box, select ETKMS LM.
3FromtheSoftware Version box, select the appropriate software version.
4IntheAppliance Name box, enter a name for this local ETKMS.
5IntheIP Address box, enter the IP address of the workstation on which EncrypTight is installed.
6 Optionally, in the Backup IP Address box, enter the IP address of a backup ETKMS. Usually, a
backup ETKMS is used with an external ETKMS. For more information about backup ETKMSs, see
the EncrypTight User Guide.
7ClickSave.
Launching and Stopping a Local ETKMS
When you launch a local ETKMS, the ETKMS software runs as a separate application in a command line
window on the management workstation. If the management workstation running the local ETKMS
restarts, you must relaunch the local ETKMS. The local ETKMS does not have a web interface. It is
managed through ETEMS.
To launch a local ETKMS:
1 In the Appliance Manager, select the local ETKMS.
2ClickTools > Launch ETKMS LM.
The ETKMS software starts and opens a command line window.

Configuring the ETKMS
6EncrypTight — Getting Started
To stop a local ETKMS:
1 Switch to the command line window in which the local ETKMS is running.
2PressCTRL + C.
3TypeY.
Configuring an External ETKMS
After you connect the appropriate cables to the ETKMS server, you need to log in to the ETKMS, set up
the network interface with an IP address and hostname, and specify an NTP server to use. Once the
ETKMS is configured, add it to the list of appliances managed by ETEMS.
Logging Into the ETKMS
To configure the ETKMS, you must connect the monitor, keyboard, and mouse and log into the server
directly.
The ETKMS has two default user accounts, admin and root. The default password for the admin account
is admin. The default password for the root user is password. You can use the admin account to log into
the ETKMS remotely using SSH. The root user can only log into the ETKMS directly. You must log in
as root to configure the ETKMS.
To maintain the security of your system and networks, it is strongly recommended that you change the
default admin password and the default root password as one of your first tasks. The first time you log
into the ETKMS as admin, you must change the admin password.
To log into the ETKMS:
1 At the login prompt, enter a user name and press Enter.
2 At the Password prompt, enter the password and press Enter.
Change the Default Passwords
To maintain system security, it is strongly recommended that you change the default passwords for the
ETKMS administrator user (admin) and the root password periodically.
CAUTION
Keep track of the passwords you assign. If you lose these passwords, you can lose the ability to
communicate with and manage the ETKMS. In some cases, restoring the unit to working order can require
factory service.
Changing the Admin Password
The default password for the admin account is admin. Changing the default admin password is an
essential step in maintaining the security of the ETKMS and EncrypTight. The first time you log in as
admin, you must change the password. Use the following to change the password after that first log in.

Configuring the ETKMS
EncrypTight — Getting Started 7
To change the admin password:
1 Log in as admin.
2Type
passwd and press Enter.
3 At the prompt, type the current password and press Enter.
4 At the prompt, type the new password and press Enter.
The new password must be at least six characters long, contain a sufficient number of different
characters, and must not be a common dictionary word.
5 At the prompt, retype the new password and press Enter.
6Type
exit to log out from the admin account.
For example:
Localhost login: admin
Password:
[admin@localhost ~] $ passwd
(current) UNIX password:
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[admin@localhost ~] exit
Changing the Root Password
The default password for the root user is password. It is strongly recommended that you change the
default root password when you initially set up the ETKMS server. The new password for the root user
must be at least seven characters long and contain a sufficient number of different characters.
To change the root password:
1 Log in as root.
2Type
passwd and press Enter.
3 Follow the prompts to change the root password.
Remain logged in as root to complete the ETKMS configuration.
CAUTION
Keep track of the passwords you assign. If you lose these passwords, you can lose the ability to
communicate with and manage the ETKMS. In some cases, restoring the unit to working order can require
factory service.
Configure the Network Connection
You can set a static IP address using the web interface. The eth0 connection is the network connection
with a path to the management workstation containing the ETPM and to the PEPs’ management port. The
eth1 connection is inactive and unavailable. Set the network connection as required by your network
configuration.
Setting up the network connection requires running two scripts.

Configuring the ETKMS
8EncrypTight — Getting Started
To configure the network connection and hostname:
1 At the command prompt, type system-config-network.
2TabtotheEdit Devices option and press Enter.
3Tabtotheeth0 device and press Enter.
4 Make sure that DHCP is not selected (use the spacebar to clear any selection) and then enter the:
●Static IP
●Netmask
●Default Gateway IP address
5TabtoOK and press Enter.
6TabtoSave and press Enter.
7TabtoEdit DNS configuration and press Enter.
8 Enter the Hostname, Primary DNS, Secondary DNS, and Search information.
9TabtoOK and press Enter.
10 Tab to Save & Quit and press Enter.
11 At the command prompt, type /opt/etkms/bin/etc-hosts-config.sh and press Enter.
12 At the command line, restart the network service by typing service network restart and press
Enter.
13 At the command line, restart the ETKMS service by typing service etkms restart and press
Enter.
You can use the following commands to verify the IP address and hostname changes:
●At the command line, type ifconfig and press Enter to view the IP address.
●At the command line, type hostname and press Enter to view the full hostname, such as
serv4.company.com.
●Type hostname -s and press Enter to view the short hostname. In this example, if the full
hostname is serv4.company.com, the short name is serv4.
Configure Time and Date Properties
All EncrypTight components, including the ETKMS, should be synchronized with a time server. You
must be logged in as root to make these changes.
To set the time zone:
1 Edit the file
/etc/sysconfig/clock
2FortheZone value, specify the appropriate filename. Zone files are located in:
/usr/share/zoneinfo
You need to include the parent directory in the entry (for example, America/New_York).
3 Save and close the file.
To set up time synchronization:
1 Edit the file:
/etc/ntp.conf

Starting the EncrypTight Software
EncrypTight — Getting Started 9
2 Replace the lines listing the three default time servers with your preferred time server. You can
specify multiple time servers.
3 Save and close the file.
4 To set up the NTP daemon to start every time the server starts, at the command line, type:
chkconfig ntpd on
And press Enter.
Changes to the NTP settings do not take affect until you restart the NTP daemon or the entire server.
To restart the NTP daemon:
1 At the command line, type:
service ntpd restart
Starting and Stopping the ETKMS Service
The ETKMS runs as a service in Linux. Once the ETKMS is started, the ETKMS restarts after each
reboot of the Linux server.
To start the ETKMS service:
1 At the command line, type:
service etkms start
To stop the ETKMS service:
1 At the command line, type:
service etkms stop
Checking the Status of the ETKMS
You should check that the ETKMS service is running before you proceed to use EncrypTight.
To check the status of the ETKMS service:
1 At the command line, type:
service etkms status
Starting the EncrypTight Software
Only one user at a time can be logged in to ETEMS. User authentication is enabled by default. Use the
default userId and password to log in the ETEMS the first time. You can then change the default account
or disable user authentication.