Manuals / HP / Computer Equipment / Software

HP UX Encrypted Volume and Filesystem (EVFS) Troubleshooting Evfs, Troubleshooting Tools Overview

Models: UX Encrypted Volume and Filesystem (EVFS)

1 174

Download 174 pages 22.98 Kb

Page 129

8 Troubleshooting EVFS

This chapter contains information about troubleshooting the HP-UX Encrypted Volume and File System (EVFS) product. This chapter addresses the following topics:

•“Troubleshooting Tools Overview” (page 129)

•“Displaying EVFS Volume Information” (page 130)

•“Verifying the EMD (evfsvol check)” (page 133)

•“Verifying User Keys (evfspkey lookup)” (page 134)

•“Problem Scenarios” (page 135)

•“Reporting Problems” (page 139)

Troubleshooting Tools Overview

EVFS provides troubleshooting tools to perform the following tasks:

•Display EVFS volume information

•Verify the encryption metadata (EMD)

•Verify user key pairs

The tasks and commands used to perform them are listed in Table 8-1and are described in the sections that follow.

Table 8-1 EVFS Troubleshooting Tasks and Commands

Task	Command
Show all I/O and cryptography	evfsadm stat -a
statistics for each EVFS volume.
Show the total number of data	evfsadm stat -s
blocks, read, written, decrypted,
and encrypted by EVFS.
Reset EVFS statistic values to	evfsadm stat -z
zero.
Display key IDs, underlying	evfsvol display -aevfs_volume_path
volume, and operating
parameters for EVFS volumes.
Verify the integrity of the EMD	evfsvol check -aevfs_volume_path
area of a volume.
Verify and display information	evfspkey lookup [-u user-r] [-k keyname]
about user key pairs.

Troubleshooting Tools Overview 129

Image 129

HP UX Encrypted Volume and Filesystem (EVFS) manual Troubleshooting Evfs, Troubleshooting Tools Overview

Contents

Encrypted Volume and File System v1.1 Administrators Guide Trademark Notice Table of Contents Upgrading from Evfs v1.0 to Evfs Preparing Evfs for ConfigurationAdministering Evfs 101 129 141 145153 171 169Page Software Types List of FiguresPage List of Tables Page Intended Audience About This DocumentDocument Organization Typographic ConventionsRelated Information HP Encourages Your CommentsUser input Features and Benefits Evfs provides the following featuresEvfs Introduction LVM DLO Support Evfs Architecture Evfs Data Flow Encryption Metadata EMDEvfs Encryption Keys Volume Encryption Keys Using HP-UX Trusted Computing Services with EvfsUser Keys How Evfs Uses Keys 3illustrates how Evfs uses keys to enable an Evfs volumeUser Key and Passphrase Storage Key Names and Key IDsFile Names Alternate Storage Databases and Distributed Key StorageSummary of Key Type and Privileged User Capabilities User Key PrivilegesEvfsvol utility configures and manages the Evfs volumes Evfs CommandsEvfsadm EvfspkeySoftware Types Supported SoftwareProduct Limitations and Precautions Evfs Introduction Symptoms Known ProblemsPossible Device File Collision WorkaroundFeedback and Enhancement Requests Installation Prerequisites System RebootHardware Requirements Operating System RequirementsUse the following procedure to install Evfs Installing EvfsSwinstall utility will install the Evfs components Log on to the target system as the root userUpgrading from Evfs v1.0 to Evfs Verifying for Preconfiguration Preparing Evfs for ConfigurationStart the Evfs subsystem. See Starting the Evfs Subsystem Preparation OverviewSetting the evfsuser Attribute Configuring an Alternate Evfs Pseudo-UserCreating the User Group Creating the Evfs Pseudo-User AccountPreparing Evfs for Configuration Keys Optional Configuring Alternate Key Database DirectoriesPrivate keys Passphrases that secure user private keysKey Storage Directory Requirements Default pubkey, privkey and passkey Attribute StatementsExample Alternate Directory for Public Keys Example NFS Directory for Public and Private KeysExample Fallback Directory for Nonprivileged Users Optional Modifying Evfs Global Parameters EmdbackupDatacipher PbeStarting the Evfs Subsystem ExampleEvfsadm start -n numberthreads Creating User Key Pairs Creating Keys for Evfs Volume OwnersGuidelines for Creating User Keys Evfspkey keygen -p-s -c cipher -u user -k keynameStoring the recovery users Private Key Creating Recovery KeysExamples Evfspkey keygen -c rsa-2048 -r -k keynameEncrypted file Creating Keys for authorized usersRsa-2048 RSA 2048-bit keys User name as the key nameUser Session Examples# evfsadm start # evfspkey keygen -u root -k rootkey1Page Configuration Overview Configuring an Evfs VolumeBefore using this procedure, you must complete the tasks Option 1 Creating a New Evfs VolumeConfiguring an Evfs Volume Creating an LVM or VxVM Volume for EvfsCreating Evfs Volume Device Files Creating the EMD Evfsadm map volumepathOptional Adding Recovery Keys and authorized user Keys Specifies that the key pair is a recovery key pair Enabling the Evfs VolumeEvfsvol add -u user -k keyname evfsvolumepath where Evfsvol enable -p-k keyname evfsvolumepathSpecifies non-interactive mode. Evfs uses the key ID from Etc/evfs/evfstab file for this volume and have a storedOption, you must add a key ID to the entry Evfsvol prompts you for the passphrase for the private keyOptional Using fsck to Check the File Volume Creating and Mounting a File System on an Evfs VolumeCreating a New File System with newfs # newfs -F vxfs /dev/evfs/vg01/rlvol5Mount the File System on the Evfs Volume Creating the Mount PointOptional Adding an Entry to /etc/fstab Dev/evfs/vg01/lvol5 /opt/encrypteddata vxfs defaults 0 Evfsvol display evfsvolumepath Verifying the ConfigurationEvfsadm stat -a Evfsvol display evfsvolumepath Evfsadm stat -aRemount the file system using the mount command Optional Migrating Existing Data to an Evfs Volume Optional Configuring the Autostart Feature See evfstab4 for more information Dev/vg01/lvol5 /dev/evfs/vg01/lvol5 init.initkey bootlocalBacking Up Your Configuration Page Preparing the File System and Data Map the regular volume to an Evfs volumePerforming Inline Encryption Mount the file system to the Evfs volumeIencrypt Inline Encryption Start inline encryptionConfiguring an Evfs Volume Verifying the Configuration Remount the file system using the mount command # strings /dev/vg01/lvol5 grep TOP Secret Optional Configuring the Autostart Feature Example Backing Up Your Configuration Option Existing size is 96 MB we now extend it by 4 MB, to 100 MB Existing size is 96 MB we now extend it by 4 MB, to 100 MB Page Administering Evfs Enabling Encryption and Decryption Access to Evfs Volumes Starting and Stopping EvfsStarting the Evfs Subsystem Disabling Encryption/Decryption Access to Evfs Volumes Causes Evfs to use a stored passphrase to enable encryptionUses the user name as the key name Evfsvol disable -a Evfsvol disable -p evfsvolumepathEnter the following evfsadm stop command evfsadm stop Stopping the Evfs SubsystemClosing Raw Access to Evfs Volumes Opening Raw Access to Evfs VolumesInformation for the volume Displaying Key IDs for an Evfs VolumeManaging Evfs Keys and Users Restoring User KeysUser Corresponds to a recovery users key in the EMD. If you do Changing Owner Keys for an Evfs VolumeTo execute this command evfsvol prompts you for Specifies the name of the file containing private key thatRemoving Keys from an Evfs Volume Recovering from Problems with Owner KeysChanging the Passphrase for a Key Evfspkey delete -u username-r -p -k keynameEvfspkey passgen -u username -k keyname Evfspkey passgen -r recovkeyfile whereEvfspkey passgen -f-p-s -u username -k keyname where EMD Backup Directory Recovering from EMD Corruption# evfsvol destroy /dev/evfs/vg01/lvol5 Removing a Volume from the Evfs SubsystemExporting an Evfs Volume Exporting and Importing Evfs VolumesEvfspkey keygen -c cipher -u user -k keyname Use the following evfspkey keygen command syntaxImporting an Evfs Volume Key owners name and keyname is the key nameIs the key owners name and keyname is the key name Administering Evfs Managing Data on Evfs Volumes Vxresize -F Might Cause Data Loss or Corruption Creating a New Evfs Volume Overwrites Existing DataResizing Evfs Volumes and File Systems LVM Example Increasing Volume and File System SizesCorrect Incorrect LVM Example Reducing Volume and File System SizesVxVM Example Reducing Volume and File System Sizes VxVM Example Increasing Volume and File System Sizes# fsadm -F vxfs -b 65536 /test5 Backing Up and Restoring Data on Evfs Volumes Backing Up Evfs Volumes Backup Types with LVM or VxVM Mirrored Volumes Backup Types with Nonmirrored Volumes Backups Using LVM Mirrored Volumes Map the backup volume to EVFS. For exampleThis creates the device files /dev/evfs/vg01/lvol5backup Evfsvol check -r evfsvolumepath Syntax is as follows Dev/vg01/lvol5backup# evfsvol display /dev/evfs/vg01/lvol6 Evfsvol check -r evfsvolumepath Disable the Evfs backup volume. For example Example File Utility Creating Cleartext Backup Media LVM Mirrored VolumesMap the backup VxVM volume to EVFS. For example Backups Using VxVM Mirrored Volumes# evfsvol raw /dev/evfs/vx/dsk/testdg/backupvol Backing Up and Restoring Data on Evfs Volumes # vxplex -g testdg -v vol05 dis vol05-02 # evfsvol enable -k mykey /dev/evfs/vx/dsk/testdg/backupvol Evfsvol check -r evfsvolumepath # fsck -F vxfs /dev/evfs/vx/rdsk/testdg/backupvol Backing Up Evfs Volumes Creating Cleartext Backup Media VxVM Mirrored Volumes Example Block Device UtilityExample File Utility Backups Using Nonmirrored Volumes # evfsvol raw /dev/evfs/vg01/lvol5 Evfsadm stat -a Cp -r /opt/encrypteddata /opt/evfsbackup Restoring Backup Media Restoring Backup Data from an Evfs Volume to an Evfs Volume # cp -r /opt/backupevfs /opt/encrypteddata 128 Troubleshooting Tools Overview Troubleshooting EvfsDisplaying I/O and Encryption Statistics evfsadm stat Displaying Evfs Volume InformationEvfsadm stat -a-s-z Meaning of each field is as followsNumber of data blocks encrypted ADisplays the EMD information for all enabled Evfs volumesSize of the encrypted metadata EMD area, in kilobytes Syntax Verifying the EMD evfsvol check# evfspkey lookup -u root -k rootkey1 Key ID root.rootkey1 Verifying User Keys evfspkey lookupProblem Scenarios Evfspkey Cannot Generate Key PairsEvfspkey Cannot Store Keys Evfsvol Cannot Retrieve Private Key Evfsvol create Fails, Valid EMD Already ExistsSee the evfstab4 man page for more information Evfsvol disable command returns the following error Evfsvol disable Fails, Evfs Volume Is BusyEvfsadm map command returns the following error Evfsadm map Fails, Invalid DeviceEvfsvol check -r -aevfsvolumepathwhere Resets the dirty bit for the specified volumeEMD Is Dirty Collecting Data Reporting Problems140 Product Specifications User Files Evfs provides the following commands Commands and Tools144 This appendix contains reference information about Evfs Evfs Quick ReferencePreparing Evfs Configuring Evfs# evfsadm map volumepath Option 1 Creating New Evfs VolumePerform inline encryption Start inline encryption Table B-1 Starting and Stopping Evfs Evfs Tasks and CommandsTable B-3 Managing Evfs Keys and Users Table B-4 Troubleshooting Evfs 152 Using Evfs with Serviceguard Evfs and Serviceguard OverviewRequirements Restrictions Evfs Attribute Definition File ADF Installing Evfs Creating an LVM Serviceguard Storage Infrastructure Creating the Serviceguard Storage InfrastructureCreating a VxVM Serviceguard Storage Structure Configuration NodeAdoptive Nodes Creating a Cluster Key Pair Configuring Evfs on the Configuration NodeAdding the Cluster Keys to the EMD Modifying /etc/evfs/evfstab EntriesPreparing Evfs Volumes for Adoptive Nodes # vgchange -a n /dev/vg02# vxdg deport evfsdg Copying the Evfs Configuration Files and Keys Configuring Evfs Volumes on the Adoptive NodesRestoring the Cluster Key Pair Files Creating a Local Passphrase FileDeactivating the Volumes Mapping the LVM or VxVM Volumes to EvfsModifying the /etc/evfs/evfstab File Verifying EvfsConfiguring the Autostart Feature Installing the Evfs Attribute Definition File Configuring Serviceguard using Modular packagesHalting an Existing Package Copying the Evfs Control and Module ScriptsMigrating a Legacy Package Configuration File Creating a Modular Package Configuration FileAdding the Evfs package to the Configuration File # cmmigratepkg -p pkgname -o outputfile.conf whereAdding the Evfs Volumes to the Package Configuration File Verifying the ScriptLVM and VxVM Modular package example Creating the Package Configuration File Configuring Serviceguard using Legacy packagesCreating a Package Control Script Converting a Package Control ScriptInstalling the Evfs Control Script Adding the Evfs Volumes to the Package Control ScriptModifying the Package Configuration File LVM and VxVM Legacy package exampleAES GlossaryVolume EMD IndexPermissions, 85 /etc/rc.config.d/evfs, 62, 72 RSA Vxresize command Renaming