Using In-transit TLS Encryption

Internet access is required to download the RPM installation package. If the destination instance doesn't have internet access, you can download the RPM to a staging instance on your network and then use the scp command to securely copy the RPM from the staging instance to the destination instance.

The scp command requires an SSH key pair to authenticate a remote user. If your instances are UNIX-style systems, you probably already have the ssh-keygen utility installed. To check if it's installed, open a shell or terminal and type ssh-keygen on the command line. If it's not installed, you can obtain OpenSSH for UNIX from http://www.openssh.com/portable.html.

1. (Optional) Create a directory for the RPM installation package on the destination instance. For example: 

   sudo mkdir -p /<rpm_directory_name>

2. Download the oci-fss-utils package from cloud-infrastructure-file-storage-downloads.html to the directory on the destination instance or to a staging instance on your network.

   If you downloaded the package directly to the destination instance, skip the next step and proceed directly to Task 2: Install the OCI-FSS-UTILS package on Oracle Linux or CentOS.

   If you downloaded the package to a staging instance, proceed to the next step in these instructions.

3. Open a terminal window on the staging instance, and use the scp command to securely copy the RPM from the staging instance to the destination instance. For example:

   scp -i <private_key> <downloaded_file_name> <username>@<destination_public_ip_address>:/<rpm_directory_name>

   After the RPM package is downloaded to the target instance, proceed to Task 2: Install the OCI-FSS-UTILS package on Oracle Linux or CentOS.

1. Open a terminal window on the destination instance.

2. If the file name of the downloaded package doesn't include the package version and architecture, use the following command to identify the RPM file to be installed:

   rpm -qp <downloaded_file_name>

   After the package is identified, rename the file using the RPM returned by the query. For example:

   mv <downloaded_file_name> $(rpm -qp <downloaded_file_name>).rpm

3. Install the package using the following command:

   sudo yum localinstall oci-fss-utils-<version>.rpm

The package creates a namespace called ns1 in your instance, which contains a default network interface for ethernet traffic. A network interface pair is created for each mount target.

After the package has finished installing, proceed to Task 3: Mount the file system with the encryption command.

1. Open a terminal window in your instance.

2. Create a mount point by typing the following, replacing yourmountpoint with the local directory from which you want to access your file system.

   sudo mkdir -p /mnt/yourmountpoint
   						

3. Mount the file system using the following command:

   sudo mount -t oci-fss 10.x.x.x:/fs-export-path /mnt/yourmountpoint

   Replace 10.x.x.x: with the local subnet IP address assigned to your mount target, fs-export-path with the export path you specified when associating the file system with the mount target, and yourmountpoint with the path to the local mount point. The export path is the path to the file system (relative to the mount target IP address).

   If you have installed oci-fss-utils version 2.0-1 or above, you can mount the file system in FIPS approved mode by including -o fips in the mount command. For example:

   sudo mount -t oci-fss -o fips 10.x.x.x:/fs-export-path /mnt/yourmountpoint

   Important
   
   DNS hostnames are not currently supported for mounting file systems with the mount -t oci-fss command. You must use the mount target IP address.

   Example output from the mount -t oci-fss command:

   Created symlink from /etc/systemd/system/multi-user.target.wants/oci-fss-2.service to /usr/lib/systemd/system/oci-fss-2.service.

   Each time you mount a file system using this command, a new oci-fss service is initiated with an incrementing sequence number between 2 and 255. For example, oci-fss-2.service, oci-fss-3.service, and so on.

   Tip
   
   

   You can use the resvport option to restrict the client to using a specific reserved port. For example:

   sudo mount -t oci-fss -o resvport=900 10.x.x.x:/fs-export-path /mnt/yourmountpoint

Auto-mount ensures that a file system is automatically re-mounted on an instance if it is rebooted.

1. Open a terminal window on the instance. Mount the file system as described in Task 2: Install the OCI-FSS-UTILS package on Oracle Linux or CentOS.

2. Open the /etc/fstab file for editing: 

   cd /etc

   vi fstab

3. Add the following line to the fstab file:

   10.x.x.x:/fs-export-path /mnt/yourmountpoint oci-fss x-systemd.requires=oci-fss-init.service,defaults,nofail 0 0

   Replace 10.x.x.x: with the local subnet IP address assigned to your mount target, fs-export-path with the export path you specified when associating the file system with the mount target, and yourmountpoint with the path to the local mount point.

   If you have installed oci-fss-utils version 2.0-1 or above, you can mount the file system in FIPS approved mode by including -o fips in the mount command. For example:

   10.x.x.x:/fs-export-path /mnt/yourmountpoint oci-fss x-systemd.requires=oci-fss-init.service,defaults,nofail,fips 0 0

   Important
   
   DNS hostnames are not currently supported for mounting file systems with the mount -t oci-fss command. You must use the mount target IP address.
   Tip
   
   

   You can use the resvport option to restrict the client to using a specific reserved port. For example:

   10.x.x.x:/fs-export-path /mnt/yourmountpoint oci-fss x-systemd.requires=oci-fss-init.service,defaults,nofail,resvport=900 0 0

When you unmount a file system, you must use another oci-fss-utils command to ensure that the associated local network namespace is removed:

1. Open a terminal window on the instance.

2. Use the following command to unmount the file system:

   sudo umount -t oci-fss /mnt/yourmountpoint

   Replace yourmountpoint with the path to the local mount point.

1. First, unmount all mounted file systems. For instructions, see To unmount a file system.
2. Open a terminal window on the instance.

3. Type the following command to uninstall the oci-fss package:

   sudo yum remove oci-fss-utils

1. Open Windows PowerShell on your target instance and use the following command to install the Windows NFS Client:

   Install-WindowsFeature NFS-Client

   After the client is installed, proceed to Task 2: Download and Install stunnel.

1. Download and install stunnel from https://www.stunnel.org/downloads.html.

   Note
   
   The last installation step requests certificate information. Entering a value here is optional.

   By default, stunnel is installed to the following directory: C:\Program Files (x86)\stunnel

2. Open the file C:\Program Files (x86)\stunnel\config\stunnel.cfg for editing and specify the following configuration:

   [mount]
       client=yes
       accept=127.0.0.1:2048
       connect=10.0.1.155:2051
    
   [nfs]
       client=yes
       accept=127.0.0.1:2049
       connect=10.0.1.155:2051
    
   [nlm]
       client=yes
       accept=127.0.0.1:2050
       connect=10.0.1.155:2051
    
   [rpcbind]
       client=yes
       accept=127.0.0.1:111
       connect=10.0.1.155:2051

3. Start stunnel using C:\Program Files (x86)\stunnel\bin\tstunnel.exe.

   Proceed to Task 3: Mount and Test Your Connection.

Open a command prompt and type the following series of commands:

1. Mount the file system:

   mount \\127.0.0.1\fss z:

2. Test the connection to the file system by listing the contents of the directory:

   dir z:

3. Unmount the file system:

   umount z: