Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 83

Organization Name eg, company [Internet Widgits Pty Ltd]: Dell Equallogic

Get Dell EqualLogic PS6210XS PDF manuals and user guides View all Dell EqualLogic PS6210XS manuals
Add to My Manuals
Save this manual to your list of manuals

Page 83 highlights

# leftcert=selfCert.der # leftsendcert=never # right=192.168.0.2 # rightsubnet=10.2.0.0/16 # rightcert=peerCert.der # auto=start # conn sample-with-ca-cert # leftsubnet=10.1.0.0/16 # leftcert=myCert.pem # right=192.168.0.2 # rightsubnet=10.2.0.0/16 # rightid="C=CH, O=Linux strongSwan CN=peer name" # auto=start Begin Certificate-Based Authentication, IPv4 1. strongSwan host IP address is 10.127.238.154 2. array addresses are 10.124.65.38 (the wka) and 10.124.65.39 (eth0) 3. 2048-bit RSA keys will be generated to encrypt/decrypt the local certificates (one for the array and one for the strongSwan host) 4. a self-signed root certificate will be generated 5. local certificate requests for both the array and the strongSwan client will be generated 6. certificate requests will be "signed" with our root certificate 7. the certificates and keys will be installed on the strongSwan host, then strongSwan will be reconfigured to use certificate-based authentication Certificate Creation with OpenSSL: 1. Generate a 2048-bit RSA key. This is the "server" key, which will be used to generate a self-signed root certificate. Note that the minimum acceptable key length is 2048 bits: 1.1 draoidoir:fwoods> openssl genrsa -out server.key 2048 Generating RSA private key, 2048 bit long modulus e is 65537 (0x10001) 2. With the server key in hand, generate a self-signed root certificate: 1.15 draoidoir:fwoods> openssl req -new -x509 -days 365 -key server.key -out root-ca.crt You will be prompted to enter information that will be incorporated into the certificate request. This is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value. If you enter '.', the field will be left blank. ----Country Name (2 letter code) [AU]: US State or Province Name (full name) [Some-State]: New Hampshire Locality Name (eg, city) []: Nashua Organization Name (eg, company) [Internet Widgits Pty Ltd]: Dell Equallogic Organizational Unit Name (eg, section) []: Networking and iSCSI Common Name (e.g. server FQDN or YOUR name) []: Joe Secure Email Address []: [email protected] Now take a peek at the new root certificate: draoidoir:fwoods> openssl x509 -text -noout -in root-ca.crt Certificate: Data: Version: 3 (0x2) Serial Number: 11801568908693661699 (0xa3c7986522fae803) Signature Algorithm: sha256WithRSAEncryption About Group-Level Security 83

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322
  • 323
  • 324
  • 325
  • 326
  • 327
  • 328
  • 329
  • 330
  • 331
  • 332
  • 333
  • 334
  • 335
  • 336
  • 337
  • 338
  • 339
  • 340
  • 341
  • 342
  • 343
  • 344
  • 345
  • 346
  • 347
  • 348
  • 349
  • 350
  • 351
  • 352
  • 353
  • 354
  • 355
#
leftcert=selfCert.der
#
leftsendcert=never
#
right=192.168.0.2
#
rightsubnet=10.2.0.0/16
#
rightcert=peerCert.der
#
auto=start
# conn sample-with-ca-cert
#
leftsubnet=10.1.0.0/16
#
leftcert=myCert.pem
#
right=192.168.0.2
#
rightsubnet=10.2.0.0/16
#
rightid="C=CH, O=Linux strongSwan CN=peer name"
#
auto=start
Begin Certificate-Based Authentication, IPv4
1. strongSwan host IP address is 10.127.238.154
2. array addresses are 10.124.65.38 (the wka) and 10.124.65.39 (eth0)
3. 2048-bit RSA keys will be generated to encrypt/decrypt the local certificates (one for
the array and one for the strongSwan host)
4. a self-signed root certificate will be generated
5. local certificate requests for both the array and the strongSwan client will be generated
6. certificate requests will be "signed" with our root certificate
7. the certificates and keys will be installed on the strongSwan host, then strongSwan will
be reconfigured to use certificate-based authentication
Certificate Creation with OpenSSL:
1. Generate a 2048-bit RSA key.
This is the "server" key, which will be used to generate a
self-signed root certificate.
Note that the minimum acceptable key length is 2048 bits:
1.1 draoidoir:fwoods> openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
........
+++
..............................................................................
+++
e is 65537 (0x10001)
2. With the server key in hand, generate a self-signed root certificate:
1.15 draoidoir:fwoods> openssl req -new -x509 -days 365 -key server.key -out root-ca.crt
You will be prompted to enter information that will be incorporated into the certificate
request. This is called a Distinguished Name or a DN. There are quite a few fields but you
can leave some blank
For some fields there will be a default value. If you enter '.', the field will be left
blank.
-----
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New Hampshire
Locality Name (eg, city) []: Nashua
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Dell Equallogic
Organizational Unit Name (eg, section) []: Networking and iSCSI
Common Name (e.g. server FQDN or YOUR name) []: Joe Secure
Email Address []: [email protected]
Now take a peek at the new root certificate:
draoidoir:fwoods> openssl x509 -text -noout -in root-ca.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 11801568908693661699 (0xa3c7986522fae803)
Signature Algorithm: sha256WithRSAEncryption
About Group-Level Security
83