====== KMIP for key management ======
  * Follow the guide to install [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_kmip?version=7|KMIP]] on a Synology NAS server and client
===== Certificates =====
  - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, and are valid for 10 years. These certificates also work for Synology clients connecting to a [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]] not hosted on a synology NAS.
  - Login to your NAS on the command line with SSH and elevate to root
  - Download Synology's official KMIP certificate script:<code>wget supweb.synology.com/support_web/kc_tool/how_to_gen_cert_for_kmip_services/gen_kmip_certs.sh</code>
  - Run the script as root:<file>bash gen_kmip_certs.sh kmip_certs</file>The second parameter //kmip_certs// is the name of a shared folder the script will create to store the certificates
  - Upload the generated scripts in ''/volume1/kmip_certs'' to your local computer you use to access your DSMs through your web browser, after which you can remove the shared folder and it's content
  - The script will generate the following certificates:<code>ca-key.pem
ca.pem
client-fullchain.pem
client-key.pem
client.pem
server-fullchain.pem
server-key.pem
server.pem</code>
===== DSM as Server =====
  - go to //Control Panel > Security > Certificate//
  - Click //Add//, choose //Import Certificate//, and upload:
    * Private key: ''server-key.pem''
    * Certificate: ''server.pem''
    * Leave Intermediate certificate empty
  - Click Settings (in the Certificate tab), find the //KMIP dropdown menu//, select this new server certificate, and click OK
  - Go to //Control Panel > Security > KMIP// and select //Set as remote key server//
  - Under //Manage Client Connection//, click //Manage > Add//
  - Upload the client files you generated:
    * Client certificate: ''client.pem''
    * Certificate authority: ''ca.pem''
  - Add a port forward for port 5696 to your server NAS

===== DSM as Client =====
  - go to //Control Panel > Security > Certificate//
  - Click //Add//, choose //Import Certificate//, and upload:
    * Private key: ''client-key.pem''
    * Certificate: ''client.pem''
    * Leave Intermediate certificate empty
  - Click Settings (in the Certificate tab), find the //KMIP dropdown menu//, select this new client certificate, and click OK
  - Go to //Control Panel > Security > KMIP// and select //Set as remote key client//
  - Enter the server's IP address and port 5696
  - Upload the certificate authority file ''ca.pem'' and click **Next**. Wait until you see the connection is successful.
  - Now you need to go to **Storage Manager --> Storage** and click //Global Settings//. Scroll down to **Encryption Key Vault** and click //Reset// (important!) to make the switch to the KMIP Server permanent and move the encryption keys.
  - Go to **Control Panel --> Security --> KMIP**, check //Set as remote key client//, and make sure your KMIP Server with uploaded Synology certificates is running (either Synology DSM, or PyKMIP on Debian, or a commercial KMIP Server)
  - Enter the following credentials:{{ :syno:kmip-credentials.jpg?600 |KMIP Credentials}}

===== How to gain access to encrypted volumes when the KMIP Server was unavailable during DSM boot =====
  * If you can re-establish connection to the KMIP Server you can do the following:
    - SSH into DSM
    -  if you want to continue using the KMIP Server:<code>reboot
shutdown -r now</code>
    - if you do not want to continue using the KMIP Server:<file>sudo /usr/syno/sbin/synoencvolume --auto-unlock-get-keys</file>
    - Log into DSM and open Storage Manager. You can now access DSM through it's web interface, but you cannot access your files.
    - Reset the Encryption Key Vault in the //Global Settings// of the **Storage Manager** using the recovery key to disconnect your NAS from the KMIP Server.
    - If your locked volume is not the same volume where your user home directories reside you can go to the **Storage Manager** and select the locked volume, then click the ellipsis (...) icon, and select //Unlock//. Upload your ''.rkey'' recovery file. The system will prompt you to enter a new vault password to recreate and repair the local key vault.

===== Recover an encrypted volume using an SSH shell =====
  * If you can not re-establish connection to the KMIP Server you can do the following:
    - Identify the Target Device Node
      * Synology layers its storage using Linux mdadm (RAID) and Logical Volume Management (LVM). You need to find the logical volume path:<file>sudo lvdisplay</file>
      * Look for your volume path, e.g. ''LV Path  /dev/vg1/volume_1''
    - Unlock the LUKS Container
      * Depending on what credentials you have, choose Option A or Option B
      * Option A: Using the Passphrase. Pass the LVM path to cryptsetup to open it. This will prompt you for the password:<file>sudo cryptsetup luksOpen /dev/vg1/volume_1 mapped_volume</file>
      * Option B: Using the Recovery Key (.rkey file). If you have the ''.rkey'' file saved on a USB drive or transferred via SSH to ''/tmp/volume1.rkey'', use:<file>sudo cryptsetup luksOpen /dev/vg1/volume_1 mapped_volume --key-file /tmp/volume1.rkey</file>
      * Note: mapped_volume is just a temporary virtual name you assign for the next step.
    - Mount the Filesystem
      * Synology volumes typically use the Btrfs or ext4 file systems. Create a temporary folder and mount the newly decrypted mapping:<file>sudo mkdir -p /mnt/recovery
mount /dev/mapper/mapped_volume /mnt/recovery</file>
    - Access and Rescue Your Data
      * Your data is now fully unencrypted and accessible in plain text at ''/mnt/recovery''. You can use command-line tools like ''cp'', ''rsync'', or ''tar'' to copy your files off to an external drive or another server.

===== How to Regenerate and Download a Recovery Key =====
  - Open **Storage Manager** in Synology DSM
  - Go to **Storage** and click on your encrypted volume
  - Click the //Settings// button (or the three dots/action menu next to the volume)
  - Locate the **Recovery Key** section
  - Click //Regenerate//
  - Enter your Vault Password when prompted to authorize the action
  - The new recovery key file (''.rkey'') will download automatically to your computer's default download folder
==== Links ====
  * [[https://www.google.com/search?q=did+anyone+successfully+connect+synology+nas+via+kmip+to+another+synology+nas+running+dsm+7.4&rlz=1C1CHBF_en-GBTH1186TH1186&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAtIBCTE5MjEyajBqN6gCCLACAfEFN9emBNraMWg&sourceid=chrome&ie=UTF-8&fbs=ABfTbFVyMZGZf1hfvX9uKjN_-G8cn05EoNqnRUpRtqDK_L3JtT0h7PdEdL8le1RT1QApqDkd9qUYylHBfgw4wakeGWmv-Mbbvk7Ub6Fdg7DBh9O7QsFZnQqnV9zcx0gw62oDY1ex_AdW6sBOijfYY0XJ8sj2hUtdKCTxahwspfYzssC-sJLA_YDa9IZrLaxl-SAAOY6mq7TWaFsDWE3bF68uIY9zOlZ1wg&aep=10&ntc=1&sxsrf=APpeQnuK5wlsuLaUTWsE9QuIsuh8yDmrQw%3A1787391169478&mstk=AUtExfDPfM2f40TnAL-610TT2CspEGepn6xcFrRJE0fBQYXhv5fi5Fn7T6EJOzICRpjzYwU4AuPrFY1IQpKcEoC5C2yasIJimNTh4wbJjetctoSIG17YpPPpsHoqONiDPwFAl_BJlvsqRdeYKvQnY7o12-KEb8qr67kmXdoL6beldPp94iZ2P42Jtzqb9jM8ic91q-uOFTjSoBPLRC2_mcJKXE2SbFo0jnRZBVTO0wbPksAaNC_mwajviaBxAl8NfHdgKcgyYI91WGcFQrnLVm3A1Jts-qiioo3jNLgyc7OCI5XgaC_kKrW54GjG6c0D6IIjDV8wPZnBVdP6TA&aioh=3&csuir=1&cs=1&atvm=2&udm=50&mtid=C22JatzHE72hseMPhYKfoAI|Updated security and certificate guidelines for DSM 7.4]]
  * [[https://www.google.com/search?q=instructions+for+synology+dsm+7.4+kmip&rlz=1C1CHBF_en-GBTH1186TH1186&oq=instructions+for+synology+dsm+7.4+kmip&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAjIHCAIQIRiPAtIBCDc4ODNqMGo3qAIIsAIB8QXwkKF9IYSoQw&sourceid=chrome&source=chrome.ob&ie=UTF-8|Setting up a KMIP server with DSM 7.4]]
  * [[https://www.avast.com/random-password-generator#pc|Random Password Generator]]