Introduced in OneFS 9.1, SyncIQ encryption is integral in protecting data in-flight during inter-cluster replication over the WAN. This helps prevent man-in-the-middle attacks, mitigating remote replication security concerns and risks.
SyncIQ encryption helps to secure data transfer between OneFS clusters, benefiting customers who undergo regular security audits and/or government regulations.
- SyncIQ policies support end-to-end encryption for cross-cluster communications.
- Certificates are easy to manage with the SyncIQ certificate store.
- Certificate revocation is supported through the use of an external OCSP responder.
- Clusters now require that all incoming and outgoing SyncIQ policies be encrypted through a simple configuration change in the SyncIQ global settings.
SyncIQ encryption relies on cryptography, using a public and private key pair to encrypt and decrypt replication sessions. These keys are mathematically related: Data encrypted with one key is decrypted with other key, confirming the identity of each cluster. SyncIQ uses the common X.509 Public Key Infrastructure (PKI) standard which defines certificate requirements.
A Certificate Authority (CA) serves as a trusted 3rd party, which issues and revokes certificates. Each cluster’s certificate store has the CA, it’s certificate, and the peer’s certificate, establishing a trusted ‘passport’ mechanism.
A SyncIQ job can attempt either an encrypted or unencrypted handshake:
Under the hood, SyncIQ utilizes TLS protocol version 1.2 and OpenSSL version: 1.0.2o. Customers are responsible for creating their own X.509 certificates, and SyncIQ peers must store each other’s end entity certificates. A TLS authentication failure will cause the corresponding SyncIQ job to immediately fail, and a CELOG event notifies the user of a SyncIQ encryption failure.
One the source cluster, the SyncIQ job’s coordinator process passes the target cluster’s public cert to its primary worker (pworker) process. The target monitor and sworker threads receive a list of approved source cluster certs. The pworkers can then establish secure connections with their corresponding sworkers (secondary workers).
SyncIQ traffic encryption is enabled on a per-policy basis. The CLI includes the ‘isi certificates’ and ‘isi sync certificates’ commands for the configuration of TLS certificates:
# isi cert -h
Description:
Configure cluster TLS certificates.
Required Privileges:
ISI_PRIV_CERTIFICATE
Usage:
isi certificate <subcommand>
[--timeout <integer>]
[{--help | -h}]
Subcommands:
Certificate Management:
authority Configure cluster TLS certificate authorities.
server Configure cluster TLS server certificates.
settings Configure cluster TLS certificate settings.
The following policy configuration fields are included:
| Config Field | Detail |
| –target-certificate-id <string> | The ID of the target cluster certificate being used for encryption. |
| –ocsp_issuer_certificate-id <string> | The ID of the certificate authority that issued the certificate whose revocation status is being checked. |
| –ocsp-address <string> | The address of the OCSP responder to which to connect. |
| –encryption-cipher-list <string> | The cipher list being used with encryption. For SyncIQ targets, this list serves as a list of supported ciphers. For SyncIQ sources, the list of ciphers will be attempted to be used in order. |
In order to configure a policy for encryption the ‘–target-certificate-id’ must be specified. The users will input the ID of the desired certificate as is defined in the certificate manager. If self-signed certificates are being utilized, then they will have been manually copied to their peer cluster’s certificate store.
For authentication, there is a strict comparison of the public certs to the expected values. If a cert chain (that has been signed by the CA) is selected to authenticate the connection, the chain of certificates will need to be added to the cluster’s certificate authority store. Both methods use the ‘SSL VERIFY FAIL IF NO PEER CERT’ option when establishing the SSL context. Note that once encryption is enabled (by setting the appropriate policy fields), modification of the certificate IDs is allowed. However, removal and reverting to unencrypted syncs will prompt for confirmation before proceeding.
We’ll take a look at the SyncIQ encryption configuration procedures and options in the second article of this series.