KMIP Server (PyKMIP)

Install Phyton3, the Phyton package manager and dependencies:

sudo apt update
sudo apt install python3 python3-pip python3-venv libssl-dev libffi-dev python3-dev libsqlite3-dev

Verify the installation:
```
pip3 --version
```

Create a virtual environment and activate it:

python3 -m venv pykmip-env
source pykmip-env/bin/activate

To deactivate the virtual environment, enter deactivate within the virtual environment

To manage packages you can use:

pip3 install package_name
pip3 install --upgrade package_name
pip3 uninstall package_name

Once inside your virtual environment, upgrade pip and install the pykmip library:
```
pip install --upgrade pip
pip install pykmip
```

Verify the installation:

python3 -c "import kmip; print(kmip.__version__)"

Create folder /var/log/pykmip with ownership root:user and permissions 770
Start the server:
```
pykmip-server
```
Create the certificates as described in KMIP for key management and copy them to /home/user/certs/. They keys generated through the Synology script are valid for 10 years.

Create the configuration file /home/user/pykmip-env/server.conf:

[server]
host = 0.0.0.0
port = 5696
certificate_path = ./certs/server.pem
key_path = ./certs/server-key.pem
ca_path = ./certs/ca.pem
auth_suite = TLS1.2
logging_level = INFO
database_path=/var/lib/pykmip/pykmip.db

Create folder /etc/pykmip/ and establish a symbolic link to the server configuration:
```
ln -s /home/user/pykmip-env/server.conf /etc/pykmip/server.conf
```

Add a firewall rule to allow port 5696:

sudo ufw allow from client.wan.ip.addr to any port 5696 proto tcp

To automate setting up and activating a Python virtual environment, use direnv:
```
sudo apt update
sudo apt install direnv
```
Hook direnv to your shell by adding the following line to your shell configuration file as first instruction in the file:
```
vim ~/.bashrc
eval "$(direnv hook bash)"
```
Create a config file inside the project folder telling direnv to load Python:
```
echo "layout python" > ~/pykmip-env/.envrc
```
Authorize the script to run safely:
```
direnv allow
```
Logout then login and cd to ~/pykmip-env/ then start the KMIP Server in the background:
```
cd ~/pykmip-env
pykmip-server&
```
It is better not to add the server to systemd, so you start and stop consciously. To stop the server, find it's process id then kill the process gracefully:
```
ps aux | grep kmip
sudo kill -TERM <pid>
```
ps will list 3 processes, it is sufficient to kill the first one listed