vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Many security policies have a requirement to change passwords and credentials every 90 days or with similar frequency. Moreover, in the case an employee leaves the team or in (suspected) security incidents, access privileges should be changed immediately.

In this tutorial, services are utilized for different purposes, from storing files and metadata over securing application access to managing container images. Rotating the service credentials typically involves



* renaming the existing service keys,
* creating a new set of credentials with the previously used name,
* replacing the access data in existing Kubernetes secrets and applying the changes,
* and, after verification, deactivating the old credentials by deleting the old service keys.







 Expand the tutorial 

Security is never done. Try the below suggestions to enhance the security of your application.



* Replace IBM Key Protect by [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) for even greater security and control over encryption keys.







 Share resources 

If you want to work with others on resources of this solution tutorial, you can share all or only some of the components. [IBM Cloud Identity and Access Management (IAM)](https://cloud.ibm.com/docs/account?topic=account-iamoverview) enables the authentication of users and service IDs and the access control to cloud resources. For granting access to a resource, you can assign [predefined access roles](https://cloud.ibm.com/docs/account?topic=account-userroles) to either a user, a service ID, or to an [access group](https://cloud.ibm.com/docs/account?topic=account-groups). An access group can be created to organize a set of users and service IDs into a single entity. It makes it easy for you to assign access. You can assign a single policy to the group instead of assigning the same access multiple times per individual user or service ID. Thus, you can organize groups for roles on your development project and align security and project management.

You can find information on the individual services and their available IAM access roles here:
Go to the Slack channel you chose to verify that the test message is successful.
9. In the config.yaml file for the Helm chart, configure the webhook to monitor your VPN connection.



1. Change monitoring.enable to true.
2. Add private IP addresses or HTTP endpoints in the remote subnet that you want ensure are reachable over the VPN connection to monitoring.privateIPs or monitoring.httpEndpoints. For example, you might add the IP from the remote.privateIPtoPing setting to monitoring.privateIPs.
3. Add the webhook URL to monitoring.slackWebhook.
4. Change other optional monitoring settings as needed.









 Step 7: Deploy the Helm chart 

Deploy the strongSwan Helm chart in your cluster with the configurations that you chose earlier.



1. If you need to configure more advanced settings, follow the documentation provided for each setting in the Helm chart.
2. Save the updated config.yaml file.
3. Install the Helm chart to your cluster with the updated config.yaml file.

If you have multiple VPN deployments in a single cluster, you can avoid naming conflicts and differentiate between your deployments by choosing more descriptive release names than vpn. To avoid the truncation of the release name, limit the release name to 35 characters or less.

helm install vpn iks-charts/strongswan -f config.yaml
4. Check the chart deployment status. When the chart is ready, the STATUS field near in the output has a value of DEPLOYED.

helm status vpn
5. After the chart is deployed, verify that the updated settings in the config.yaml file were used.

helm get values vpn



Only strongSwan Helm chart versions that were released in the last 6 months are supported. Ensure that you consistently [upgrade your strongSwan Helm chart](https://cloud.ibm.com/docs/openshift?topic=openshift-vpnvpn_upgrade) for the latest features and security fixes.
Note that if a pod in the cluster initiates a request to the remote on-premises network, you must add logic to the pod so that it can select which VPN connection to use to access the services on the remote on-premises network.



3. Configure the remote VPN endpoint software to establish a separate VPN connection to the load balancer IP in each zone.









 Configuring the strongSwan Helm chart 

Before you install the strongSwan Helm chart, you must decide on your strongSwan configuration.

Before you begin



* Install an IPSec VPN gateway in your on-premises data center.
* Ensure you have the [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for the default namespace.
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster) All strongSwan configurations are permitted in standard clusters.





 Step 1: Get the strongSwan Helm chart 

Install Helm and get the strongSwan Helm chart to view possible configurations.



1. [Follow the instructions](https://cloud.ibm.com/docs/containers?topic=containers-helminstall_v3) to install the version 3 Helm client on your local machine.
2. Save the default configuration settings for the strongSwan Helm chart in a local YAML file.

helm show values iks-charts/strongswan > config.yaml
3. Open the config.yaml file.







 Step 2: Configure basic IPSec settings 

To control the establishment of the VPN connection, modify the following basic IPSec settings.

For more information about each setting, read the documentation provided within the config.yaml file for the Helm chart.



1.
A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.
* -n --number-of-key-versions

Restricts the number of key versions to be retrieved by the supplied integer value (default: 200).
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -s --starting-offset

Retrievies the key versions from the offset as specified by the supplied integer value.
* -t --total-count

Used to reterieve total number of key versions for a key by the supplied integer value.









 kp key wrap 

[Wrap a data encryption key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys) (DEK) using a root key that is stored in the Key Protect instance. A DEK is typically used to encrypt "other" pieces of information.

When you wrap a DEK with a root key, Key Protect combines the strength of multiple algorithms to protect the privacy and the integrity of your encrypted data.

You cannot wrap a standard key, that is, a key created using the -s parameter (ibmcloud kp key create my-key-name -s).

ibmcloud kp key wrap KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]
[-a, --aad ADDITIONAL_DATA]
[-o, --output OUTPUT]
[-p, --plaintext DATA_KEY]



 Best practices 

Wrapping a data encryption key (DEK) creates a ciphertext. The ciphertext is encrypted information that, when unwrapped, reveals the original DEK.

The Key Protect service does not store your DEK. Save, or persist to storage, the ciphertext to make sure you can retrieve the DEK with the kp key unwrap command.
Setting up classic VPN connectivity 

This VPN information is specific to classic clusters. For VPN information for VPC clusters, see [Setting up VPC VPN connectivity](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaas).

With VPN connectivity, you can securely connect apps in a Kubernetes cluster on IBM Cloud® Kubernetes Service to an on-premises network. You can also connect apps that are external to your cluster to an app that runs inside your cluster.

To connect your worker nodes and apps to an on-premises data center, you can configure one of the following options.



* strongSwan IPSec VPN Service: You can set up a [strongSwan IPSec VPN service](https://www.strongswan.org/about.html) that securely connects your Kubernetes cluster with an on-premises network. The strongSwan IPSec VPN service provides a secure end-to-end communication channel over the internet that is based on the industry-standard Internet Protocol Security (IPSec) protocol suite. To set up a secure connection between your cluster and an on-premises network, [configure and deploy the strongSwan IPSec VPN service](https://cloud.ibm.com/docs/containers?topic=containers-vpnvpn-setup) directly in a pod in your cluster.
* IBM Cloud® Direct Link: [IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-dl-about) allows you to create a direct, private connection between your remote network environments and IBM Cloud Kubernetes Service without routing over the public internet. The IBM Cloud Direct Link offerings are useful when you must implement hybrid workloads, cross-provider workloads, large or frequent data transfers, or private workloads. To choose an IBM Cloud Direct Link offering and set up an IBM Cloud Direct Link connection, see [Get Started with IBM Cloud IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl) in the IBM Cloud Direct Link documentation.
* ikeycmd -cert -create -db key.jks -pw <keyStorePassword> -sig_alg SHA256WithRSA -label clientcert -dn "O=<Your Organisation>, C=<Your Country>"



* <keyStorePassword> - pick a password for your key store file
* <Your Organisation> - your company may have specified a particular value to use, otherwise use your own input
* <Your Country> - your company may have specified a particular value to use, otherwise use your own input





* In Mac OSX environment:



* keytool -genkey -alias clientcert -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -keystore key.jks -dname "O=<Your Organisation>, C=<Your Country>" -storepass mypass





2. Extract the public key of the security certificate from the key store:



* In Windows and Linux environments:



* ikeycmd -cert -extract -db key.jks -pw <keyStorePassword> -label clientcert -target clientcert.pem



* <keyStorePassword> - this is the password entered above to protect the key store.





* In Mac OSX environment:



* keytool -export -keystore key.jks -storepass <keyStorePassword> -alias clientcert -file clientcert.cer
* cat clientcert.cer | openssl x509 -inform DER >clientcert.pem











 Step 5: Configure the JMS application to use a key store for mutual TLS 



1. Open the JMS application with a preferred text editor, and navigate to the following section of code:

try {
// Create a connection factory
JmsFactoryFactory ff = JMSFactoryFactory.getInstance(WMQConstants.WMQ_PROVIDER);
JmsConnectionFactory cf = ff.createConnectionFactory();

...
2. Insert the following code immediately after the code shown above:
VRVDR-51142 5.5 DSA-4685-1 CVE-2020-3810: Debian DSA-4685-1 : apt - security update 
 VRVDR-51054 6.7 DSA-4688-1 CVE-2020-10722, CVE-2020-10723, CVE-2020-10724: Debian DSA-4688-1 : dpdk - security update 
 VRVDR-50886 8.8 DSA-4670-1 CVE-2018-12900, CVE-2018-17000, CVE-2018-17100, CVE-2018-19210, CVE-2019-7663, CVE-2019-14973, CVE-2019-17546 : Debian DSA-4670-1 : tiff - security update 
 VRVDR-50851 7.5 DSA-4666-1 CVE-2020-12243: Debian DSA-4666-1 : openldap - security update 
 VRVDR-50530 7.1 DSA-4647-1 CVE-2020-0556: Debian DSA-4647-1 : bluez - security update 
 VRVDR-50498 8.8 DSA-4646-1 CVE-2020-10531: Debian DSA-4646-1 : icu - security update 
 VRVDR-44891 N/A N/A opd doesn't escape input properly when completing commands 









 1912a 



 Issues Resolved 



Issues resolved for 1912a

 Issue Number Priority Summary 

 VRVDR-49822 Critical Only shows peering with 16 nodes in "show ptp clock 0" 
 VRVDR-49735 Critical IPsec RA VPN: default VRF + VFP is blocking traffic which is supposed to be forwarded 
 VRVDR-49734 Critical Strongswan VRRP startup check breaks RAVPN server 
 VRVDR-49684 Blocker DHCP services within VRF failed to start after enabling secure boot 
 VRVDR-49656 Minor IDT servo is built without optimization
To allow different worker nodes to be used with different helm chart deployments, use strongswan: <release_name>. For high availability, select at least two worker nodes.



* Public IP address of the strongSwan service: To establish connection by using the IP address of the strongSwan VPN service, set connectUsingLoadBalancerIP to true. The strongSwan service IP address is either a portable public IP address you can specify in the loadBalancerIP setting, or an available portable public IP address that is automatically assigned to the service.



* If you choose to select an IP address using the loadBalancerIP setting, the cluster must have at least one available public load balancer IP address. [You can check to see your available public IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-subnetsreview_ip) or [free up a used IP address](https://cloud.ibm.com/docs/openshift?topic=openshift-subnetsfree).
* all the cluster worker nodes must be on the same public VLAN. Otherwise, you must use the nodeSelector setting to ensure that the VPN pod deploys to a worker node on the same public VLAN as the loadBalancerIP.
* If connectUsingLoadBalancerIP is set to true and ipsec.keyexchange is set to ikev1, you must set enableServiceSourceIP to true.











 Step 4: Access cluster resources over the VPN connection 

Determine which cluster resources must be accessible by the remote network over the VPN connection.



1. Add the CIDRs of one or more cluster subnets to the local.subnet setting. You must configure the local subnet CIDRs on the on-premises VPN endpoint. This list can include the following subnets.



* The Kubernetes pod subnet CIDR: 172.30.0.0/16. Bidirectional communication is enabled between all cluster pods and any of the hosts in the remote network subnets that you list in the remote.subnet setting.
For more information about the PKCS #11 user types, see <br><br>[PKCS #11 Cryptographic Token Interface Usage Guide Version 2.40 - Users](http://docs.oasis-open.org/pkcs11/pkcs11-ug/v2.40/cn02/pkcs11-ug-v2.40-cn02.html_Toc406759984). 
 public_keystore_spaceid The 128-bit [Universally Unique IDentifier (UUID)](https://www.cryptosys.net/pki/uuid-rfc4122.html) of the public keystore. You can generate the UUID with a third-party tool, such as [UUID generator](https://www.uuidgenerator.net/).<br><br>Hyper Protect Crypto Services provides you with two database-backed EP11 keystores for enhanced security and better user access management: the private keystore that only the normal user type can access and the public keystore that all user types can access. 
 apikey_for_anonymous_user The service ID API key that you create for the anonymous user type in the [previous prerequisites step](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-apiprerequisite-pkcs-api). 
 logging_level The supported logging levels, in an increasing order of verboseness: panic, fatal, error, warning/warn, info, debug, and trace. The Default value is warning. 
 log_file_path The full path of your logging file. It saves all the logs that are generated when your applications interact with the Hyper Protect Crypto Services cloud HSM to execute PKCS #11 functions. 



To encrypt and authenticate the keystore that is used by PKCS #11, enable the sessionauth parameter and configure the password for the keystore. For each service instance, a maximum of five authenticated keystores are supported. The password can be 6-8 characters.
This option provides one of the most secure configurations for the VPN connection because no connections from the remote network back into the cluster are permitted.



* This setting requires that all data flow over the VPN connection must be outbound regardless of whether the VPN connection is established from the cluster or from the remote network.
* If you install strongSwan into a single-zone cluster, you must set local.subnet to only one IP address as a /32 subnet. If you install strongSwan in a multizone cluster, you can set local.subnet to the %zoneSubnet variable, and use the local.zoneSubnet to specify an IP address as a /32 subnet for each zone of the cluster.



4. Optional for version 2.2.0 and later strongSwan Helm charts: Enable the strongSwan service to route incoming requests from the remote network to a service that exists outside of the cluster by using the localNonClusterSubnet setting.



* The non-cluster service must exist on the same private network or on a private network that is reachable by the worker nodes.
* The non-cluster worker node can't initiate traffic to the remote network through the VPN connection, but the non-cluster node can be the target of incoming requests from the remote network.
* You must list the CIDRs of the non-cluster subnets in the local.subnet setting.









 Step 5: Access remote network resources over the VPN connection 

Determine which remote network resources must be accessible by the cluster over the VPN connection.



1. Add the CIDRs of one or more on-premises private subnets to the remote.subnet setting. Note: If ipsec.keyexchange is set to ikev1, you can specify only one subnet.
2. Optional for version 2.2.0 and later strongSwan Helm charts: Remap remote network subnets by using the remoteSubnetNAT setting. Network Address Translation (NAT) for subnets provides a workaround for subnet conflicts between the cluster network and on-premises remote network. You can use NAT to remap the remote network's IP subnets to a different private subnet. Remapping happens before the packets are sent over the VPN tunnel.
root@10.176.18.15's password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh 'root@10.176.18.15'"
and check to make sure that only the key(s) you wanted were added.
Show more

The ssh-copy-id command appends the keys to the remote-host .ssh/authorized_key file.





 Testing that the key was copied correctly 

To test that the public key was properly copied to the remote host, ssh to the remote host.

root@bck2:/etc ssh root@10.176.18.15
Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-53-generic x86_64)

* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage

Get cloud support with Ubuntu Advantage Cloud Guest:
http://www.ubuntu.com/business/services/cloud

0 packages can be updated.
0 updates are security updates.

Last login: Fri Feb 10 16:51:51 2017 from 169.46.3.91
root@bck1:

You aren't prompted for the password when you ssh in to the remote host.





 SSH keys with a passphrase 

Providing a passphrase for your SSH key provides an extra layer of security, but it can also cause issues when you are run automated scripts that require the protected key.

The ssh-agent can manage your keys. You enter the passphrase once. The ssh-agent keeps your key in its memory and pulls it up when needed. If you want the ssh-agent manage your keys, issue the following command:

eval $(ssh-agent)

After the program starts the ssh-add command to add your public key to the agent, the ssh-add utility searches for default keynames, of which id_rsa is one, and adds them to the ssh-agent.
* The file share must be based on the [dp2 profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles&interface=apidp2-profile) and be configured with [Security Group access mode](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutfs-share-mount-targets).
* The mount target must be created with a [virtual network interface](https://cloud.ibm.com/docs/vpc?topic=vpc-vni-about). For more information, see [Creating file shares and mount targets](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create).
* Data encryption in transit must be enabled. In the UI, you can toggle encryption in transit on when you create the mount target. The API transit_encryption property accepts the user_managed value to enable the feature.
* When you configure the virtual server instance to access the file share, you must configure IPsec Transport Mode for the mount target address. [Install](https://docs.strongswan.org/docs/5.9/install/install.html) and configure the strongSwan client.
* Obtain X.509 certificates are needed for authentication. The same certificates cannot be used across multiple regions.



1. The following command generates a Certificate Signing Request (CSR) and RSA Key Pair by using openssl.

openssl req -out sslcert.csr -newkey rsa:2048 -nodes -keyout private.key

OpenSSL is an open source command-line toolkit that you can use to work with X.509 certificates, certificate signing requests (CSRs), and cryptographic keys. For more information, see [OpenSSL Documentation](https://www.openssl.org/docs/).
2. Format the csr before you make an API call to metadata service by using the following command.
Viewing and managing device usernames and passwords 

From the device details page, you can view existing usernames and passwords on a device and update them to new values.



  Before you begin 

First, go to the device menu and make sure that you have the correct account permissions to complete the tasks.



*  Go to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-navigating-devices).
*  Make sure that you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users classic infrastructure permission, can adjust the permissions.



For more information about permissions, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-infrapermission) and [Managing device access](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-device-access).





  Viewing device passwords 



1.  From the Devices menu, select Device List.
2.  Select the virtual server instance that you want to view.
3.  Select the Passwords tab to show all passwords for the instance. If the passwords are not displayed, you might not have the correct permissions.







  Managing usernames or passwords 



1.  From the Devices menu, select Device List.
2.  Select the virtual server instance that you want to manage.
3.  Select the Passwords tab to show all passwords for the instance.
4.  In the Actions menu next to the username and password that you want to update, click Edit credentials.
5.  Update your username or password and click Save.
Refer to [Connecting to Windows instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_windows) to access the Windows Administrator's password, however, in short the following commands are used from your laptop, where the instances command returns the <INSTANCE_ID> of the virtual server:

ibmcloud is instances
ibmcloud is instance-initialization-values <INSTANCE_ID> --private-key @/.ssh/id_rsa





 Add a domain controller 

To add a domain controller to the existing forest\domain, the following commands are used:



* The Get-DnsClientServerAddress captures the Interface Index for the IPv4 Ethernet interface, so that the DNS can be changed from the IBM Cloud DNS server to the ADDNS server. The Install-ADDSDomainController uses DNS to lookup the IP address of an existing domain controller.
* Use Set-DnsClientServerAddress to set the <ADDNS_IP_Address> to the existing ADDNS server.
* Create a secure string for the domain administrator's password for use in the credential variable $credential.
* Install the AD features on the server using the Install-WindowsFeature command.
* Install the server as a domain controller in the <Domain_Name> domain, e.g. sqlserver.test, using a Safe Mode Administrator Password of <SafeModeAdministratorPassword>. This password should adhere to your required standards and kept securely.
* The server will reboot.



$dns = "<ADDNS_IP_Address>"
$domainnb = "<NB_Domain>"
$user = $domainnb + "Administrator"
$password = "<password>"
$domainfull = <Domain_Name>
$smpassword = "<Safe_Mode_Admin_Password>"
$out=Get-DnsClientServerAddress -InterfaceAlias Ethernet -AddressFamily IPv4 | Select-Object -Property InterfaceIndex