docs: add howto to setup TLS connections #2553
Conversation
| --hostnqn nqn.2014-08.org.nvmexpress:uuid:befdec4c-2234-11b2-a85c-ca77c773af36 \ | ||
| --subsysnqn nqn.io-1 --identity 1 \ | ||
| --keydata NVMeTLSkey-1:01:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACtVQoZ: \ | ||
| --insert --keyfile /etc/nvme/tls-keys |
There was a problem hiding this comment.
Looks like the --keyfile option is currently not available for check-tls-key, but only for gen-tls-key.
There was a problem hiding this comment.
I just added this new option yesterday :)
|
I've added some more content to it, e.g. the debugging tips. I've spend some time to figure them all out. Maybe it helps others to shortcut if something isn't working. |
igaw
force-pushed
the
add-tls-doc
branch
3 times, most recently
from
904a646 to
c2c6157
Compare
|
@martin-gpy do miss something or is my wording difficult to understand? I tried to write down everything I learned in the last few weeks on this topic. But don't expect too much from me, I am not a technical doc writer :) |
| ### Recommendation for Handling TLS Keys | ||
|
|
||
| The `nvme connect` command also allows passing a TLS key directly via the | ||
| command line or a JSON config file. Avoid this method in production |
There was a problem hiding this comment.
Are we saying passing the TLS keys via the config JSON file is also a security risk, and should be avoided in production environments? Concern is the only way we can connect using different TLS keys (as well as different dhchap keys) to different subsystems at one go is via the config JSON file alone.
There was a problem hiding this comment.
I think we should state this. Generally, mixing configuration with authentication/security tokens is discourage by the security folks. This doesn't mean it is insecure per se. If no one has access to config file except root and nvme-cli, it's propably okay? I heard that the aim should be to remove/hide the tokens from the FS after it has been used. So given this I'd say it better to say it's not recommended to do so.
Just had a few minor review comments. This looks quite good now. Thanks for getting this done. |
There are couple of step necessary to get TLS working nicely. Document it how this is done. Signed-off-by: Daniel Wagner <wagi@kernel.org>
There are couple of step necessary to get TLS working nicely. Document it how this is done.