See below for installing the Policy Agent on Linux.

Downloading the installation file

See below for installing the Policy Agent installation file.

To download the Policy Agent installation file

1. Log in to the Cryptographic Security Platform Vault for VM Encryption webGUI or the Cryptographic Security Platform Vault for Databases webGUI with Cloud Admin privileges.
2. Click Workloads.
3. Click Actions > Download Policy Agent.
4. Click the Download link associated with the following file:
   hcs-client-agent-rel.number-build.number.run
    

Creating a certificate for the registration process

Create a certificate that you can install on the VM and use during the registration process.

To create a certificate for the registration process

1. Select the Cloud VM Set with which you want to associate the VM.
2. Click Actions > Create New Certificate.
3. If desired, enter a passphrase for the certificate. If you enter a passphrase here, you will need to enter that passphrase when you install the certificate on the VM.
4. Enter a date on which this certificate should expire.

5. Click Create. Cryptographic Security Platform Vault downloads a .cert file to the default download location. 

   Do not rename the downloaded certificate. The certificate name includes additional information, and a renamed certificate will fail.

Copying the installer

Copy the hcs-client-agent-rel.number-build.number.run installation file to the Linux machine.

Running the installer

Log in to the target Linux system as root, and run the following command in the directory containing the installation file.

Where: 

• -y tells the installer to use the /opt/hcs default installation directory without prompting.

• -P specifies the installation directory.

Make sure that you have executable permissions to /tmp because the installer extracts itself to the /tmp directory. If you get the following error:

Use the TMPDIR variable to select a different temporary directory. For example: 

The following example prompts the user for the installation directory.

The following example installs the Policy Agent in the /opt/hcs default directory.

The following example installs the Policy Agent in the specified directory /opt/test without prompting:

Registering the virtual machine into Vault.

Run the following command to register the virtual machine with Cryptographic Security Platform Vault.

Where:

• -a—Indicates that you want to authenticate the VM through the command line or the script instead of through a certificate file. Use this option if you are using Simplified or Automated Authentication. If you created a certificate in Cryptographic Security Platform Vault, omit this option and specify the certificate name in cert-file.cert.

• -c—Allows you to register this VM as a clone of the original VM.

• -h—The name of the VM that will be displayed in the Cryptographic Security Platform Vault webGUI (Default: hostname).
• -d—A description of the VM that will be displayed in the Cryptographic Security Platform Vault webGUI.
• -p—The passphrase assigned to the certificate when it was created. If you do not specify this parameter and the certificate has an associated passphrase, the registration process prompts you for the passphrase. Applies to Standard Authentication only.

• -v—The Vault ID of the Vault that will be displayed in Vault Management. If you do not specify the vault_id, you will be asked to enter vault_id.

• -o—The one-time passphrase that will be used to encrypt the initial communication between this VM and the existing Cryptographic Security Platform Vault cluster. If you do not specify this parameter, the registration process prompts you for the one-time passphrase. Applies to Standard Authentication only. 

  The passphrase is valid for 15 minutes from the time it is created. Authenticate the VM in the Cryptographic Security Platform Vault during this time. Authentication will fail after the passphrase has expired.

• -z—The name of the Cloud VM Set defined in the Cryptographic Security Platform Vault cluster to which you want to assign this VM. Applies to Simplified or Automated Authentication only (the -a option must be specified on the hcl register command).
• -n—The name of the Cluster Node Mapping that you want to associate with this VM. If you do not specify this option and one or more Cluster Node Mappings have been configured, the Policy Agent prompts you to select a Node Mapping from the list. If you do not want to use a Node Mapping, you must manually respond to this prompt. This option is mutually exclusive with the -N option, described below, and it requires that the -a option must be specified on the hcl register command.
• -N—Tells the Policy Agent that you do not want to use a Cluster Node Mapping, even if one is available. If you specify both -N and -n, the Policy Agent ignores the -n option and does not assign a Node Mapping to the VM. Applies to Simplified or Automated Authentication only (the -a option must be specified on the hcl register command).

• kc-hostname[:port],kc-hostname2[:port],... (required) — The list of IP addresses or hostnames for the Cryptographic Security Platform Vault nodes with which you want to register the VM. You must specify at least one Cryptographic Security Platform Vault node in this list. You must also specify a port if the Cryptographic Security Platform Vault nodes use anything other than the default port (443). 

  If you are using the -n option to specify a Cluster Node Mapping, this IP address will be the Cryptographic Security Platform Vault node that the VM contacts to retrieve the Node Mapping information. After the Node Mapping has been retrieved, the Policy Agent ignores any other IP addresses in this list and only registers the VM with the Cryptographic Security Platform Vault nodes contained in the Node Mapping.

• cert-file.cert—The name of the certificate file you copied to the target system if you are using Standard Authentication. If you are running the hcl register command from a directory other than the one where the .cert file resides, specify the full path to the .cert file as part of this option. If you did not create a certificate file in Cryptographic Security Platform Vault, omit this option and use the -a option instead.

The following command registers a VM with the "hq-vm-4" name, the "HQ Linux Server Alpha" description, and two nodes.

The following command registers a VM without prompting the user.

The following command registers a VM with the "hq-vm-4" name, the "HQ Linux Server Alpha" description, and prompts the user for the admin account information, the cloud VM Set, and the cluster node mapping.

The following command sets the name, description, cloud VM set, and cluster node mapping without prompting user.