Open topic with navigation

Verifying the Current VM Configuration

This procedure describes how to verify that the VM is ready for root and swap drive encryption. Because issues during root drive encryption can hang the VM, it is critical to make sure everything is properly configured before you start.

1. If the VM uses a dynamic IP address and you cannot change it to use a static IP address, make sure the Reauthentication on IP Change property is set to No. To do so:

   1. Log into the KeyControl webGUI on any node in the cluster using an account with Cloud Admin privileges.
   2. In the top menu bar, click Cloud.
   3. Click the VMs tab and select the VM you want to work with from the list.
   4. Click the Expand button (>) at the end of the row to access the details for the specific VM.
   5. Look at the value for Reauthentication on IP Change. If it is set to Yes, click the word Yes, select No in the field, then click Save.
2. Make sure you have separate boot and swap partitions. To do so:
   1. Log into the VM as an Administrator.

   2. Enter the command hcl status. For example:

      # hcl status
      Summary
      ---------------------------------------------------
      KeyControl: 10.238.32.74:443
      KeyControl list: 10.238.32.74:443
      Status: Connected
      
      Registered Devices
      ---------------------------------------------------
      Disk Name         Clear          Cipher      Status
      ---------------------------------------------------
      Available Devices
      ---------------------------------------------------
      Disk Name           Device Node     Size (in MB)
      ---------------------------------------------------
      Other Devices
      ---------------------------------------------------
      Disk Name           Device Node     Status
      ---------------------------------------------------
      sda3                /dev/sda3       Mounted (swap)
      sda2                /dev/sda2       Mounted (/boot)
      sda1                /dev/sda1       Mounted (/)  

      You can see that the VM is registered with the KeyControl server (the Status shows Connected), there are the root (/) and swap devices that we want to encrypt and you can see that there is a separate boot disk. The root and swap disks are listed under Other Devices since they are in use.

What to Do Next 

Encrypt the boot disk as described in Encrypting Linux Root and Swap Drives.

Open topic with navigation