Trace:

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
syno:dsm7kmip [2026/09/01 11:55] – Bernard Condrausyno:dsm7kmip [2026/09/01 13:58] (current) – [DSM as Client] Bernard Condrau
Line 1: Line 1:
-====== NAS Installation - Synology DSM 7.4 ====== +====== KMIP for key management ======
- +
-===== KMIP for key management =====+
   * Follow the guide to install [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_kmip?version=7|KMIP]] on a Synology NAS server and client   * Follow the guide to install [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_kmip?version=7|KMIP]] on a Synology NAS server and client
-==== Certificates ==== +===== Certificates ===== 
-  - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, and are valid for 10 years. These certificates also work for Synology clients, when added to a [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]] not hosted on a synology NAS.+  - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, and are valid for 10 years. These certificates also work for Synology clients connecting to a [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]] not hosted on a synology NAS.
   - Login to your NAS on the command line with SSH and elevate to root   - Login to your NAS on the command line with SSH and elevate to root
   - Download Synology's official KMIP certificate script:<code>wget supweb.synology.com/support_web/kc_tool/how_to_gen_cert_for_kmip_services/gen_kmip_certs.sh</code>   - Download Synology's official KMIP certificate script:<code>wget supweb.synology.com/support_web/kc_tool/how_to_gen_cert_for_kmip_services/gen_kmip_certs.sh</code>
Line 17: Line 15:
 server-key.pem server-key.pem
 server.pem</code> server.pem</code>
-==== DSM as Server ====+===== DSM as Server =====
   - go to //Control Panel > Security > Certificate//   - go to //Control Panel > Security > Certificate//
   - Click //Add//, choose //Import Certificate//, and upload:   - Click //Add//, choose //Import Certificate//, and upload:
Line 31: Line 29:
   - Add a port forward for port 5696 to your server NAS   - Add a port forward for port 5696 to your server NAS
  
-==== DSM as Client ====+===== DSM as Client =====
   - go to //Control Panel > Security > Certificate//   - go to //Control Panel > Security > Certificate//
   - Click //Add//, choose //Import Certificate//, and upload:   - Click //Add//, choose //Import Certificate//, and upload:
Line 42: Line 40:
   - Upload the certificate authority file ''ca.pem'' and click **Next**. Wait until you see the connection is successful.   - Upload the certificate authority file ''ca.pem'' and click **Next**. Wait until you see the connection is successful.
   - Now you need to go to **Storage Manager --> Storage** and click //Global Settings//. Scroll down to **Encryption Key Vault** and click //Reset// (important!) to make the switch to the KMIP Server permanent and move the encryption keys.   - Now you need to go to **Storage Manager --> Storage** and click //Global Settings//. Scroll down to **Encryption Key Vault** and click //Reset// (important!) to make the switch to the KMIP Server permanent and move the encryption keys.
 +  - Go to **Control Panel --> Security --> KMIP**, check //Set as remote key client//, and make sure your KMIP Server with uploaded Synology certificates is running (either Synology DSM, or PyKMIP on Debian, or a commercial KMIP Server)
 +  - Enter the following credentials. Note that every time you edit the connection you need to upload the //Certificate Authority// file (<color red>**ca.pem**</color>).{{ :syno:kmip-credentials.jpg?600 |KMIP Credentials}}
  
-==== How to gain access to encrypted volumes when the KMIP Server was unavailable during DSM boot ====+===== How to gain access to encrypted volumes when the KMIP Server was unavailable during DSM boot =====
   * If you can re-establish connection to the KMIP Server you can do the following:   * If you can re-establish connection to the KMIP Server you can do the following:
     - SSH into DSM     - SSH into DSM
Line 53: Line 53:
     - If your locked volume is not the same volume where your user home directories reside you can go to the **Storage Manager** and select the locked volume, then click the ellipsis (...) icon, and select //Unlock//. Upload your ''.rkey'' recovery file. The system will prompt you to enter a new vault password to recreate and repair the local key vault.     - If your locked volume is not the same volume where your user home directories reside you can go to the **Storage Manager** and select the locked volume, then click the ellipsis (...) icon, and select //Unlock//. Upload your ''.rkey'' recovery file. The system will prompt you to enter a new vault password to recreate and repair the local key vault.
  
-==== Recover an encrypted volume using an SSH shell ====+===== Recover an encrypted volume using an SSH shell =====
   * If you can not re-establish connection to the KMIP Server you can do the following:   * If you can not re-establish connection to the KMIP Server you can do the following:
     - Identify the Target Device Node     - Identify the Target Device Node
Line 69: Line 69:
       * Your data is now fully unencrypted and accessible in plain text at ''/mnt/recovery''. You can use command-line tools like ''cp'', ''rsync'', or ''tar'' to copy your files off to an external drive or another server.       * Your data is now fully unencrypted and accessible in plain text at ''/mnt/recovery''. You can use command-line tools like ''cp'', ''rsync'', or ''tar'' to copy your files off to an external drive or another server.
  
-==== How to Regenerate and Download a Recovery Key ====+===== How to Regenerate and Download a Recovery Key =====
   - Open **Storage Manager** in Synology DSM   - Open **Storage Manager** in Synology DSM
   - Go to **Storage** and click on your encrypted volume   - Go to **Storage** and click on your encrypted volume
Line 81: Line 81:
   * [[https://www.google.com/search?q=instructions+for+synology+dsm+7.4+kmip&rlz=1C1CHBF_en-GBTH1186TH1186&oq=instructions+for+synology+dsm+7.4+kmip&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAjIHCAIQIRiPAtIBCDc4ODNqMGo3qAIIsAIB8QXwkKF9IYSoQw&sourceid=chrome&source=chrome.ob&ie=UTF-8|Setting up a KMIP server with DSM 7.4]]   * [[https://www.google.com/search?q=instructions+for+synology+dsm+7.4+kmip&rlz=1C1CHBF_en-GBTH1186TH1186&oq=instructions+for+synology+dsm+7.4+kmip&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAjIHCAIQIRiPAtIBCDc4ODNqMGo3qAIIsAIB8QXwkKF9IYSoQw&sourceid=chrome&source=chrome.ob&ie=UTF-8|Setting up a KMIP server with DSM 7.4]]
   * [[https://www.avast.com/random-password-generator#pc|Random Password Generator]]   * [[https://www.avast.com/random-password-generator#pc|Random Password Generator]]
- 
  

Know How

© 2007-2026 Bernard Condrau - Powered by DokuWiki