Manuals / HP / Computer Equipment / Software

HP UX Encrypted Volume and Filesystem (EVFS) EMD Is Dirty, Evfsvol check -r -aevfsvolumepathwhere

Models: UX Encrypted Volume and Filesystem (EVFS)

1 174

Download 174 pages 22.98 Kb

Page 138

EMD Is Dirty

Symptom

The evfsvol enable or evfsvol check command fails. The output from the evfsvol enable command includes the text EMD is dirty and is similar to the following:

evfsvol: enable error: cannot enable encrypted volume "/dev/evfs/vg01/lvol5", EMD is dirty

evfsvol: enable error: failed to enable encrypted volume /dev/evfs/vg01/lvol5

The output from the evfsvol check command includes the text EMD is dirty and is similar to the following:

evfsvol: check error: cannot check encrypted volume "ev1", EMD is dirty

Description

If the system terminates without executing the system shutdown scripts, EVFS volumes will have a "dirty bit" set in the EMD areas. If you try to enable an EVFS volume with the dirty bit set, EVFS displays the message EMD is dirty.

Solution

Use the following evfsvol check -rcommand to reset the dirty bit.

evfsvol check -r -aevfs_volume_pathwhere:

-r	Resets the dirty bit for the specified volume.
-a	Resets the dirty bit for all volumes in the /etc/evfs/evfstab file.

evfs_volume_path Specifies the absolute pathname for the EVFS volume device file, such as /dev/evfs/vg01/lvol5, /dev/evfs/vx/dsk/rootdg/vol05, or /dev/evfs/dsk/c2t0d1.

138 Troubleshooting EVFS

Image 138

HP UX Encrypted Volume and Filesystem (EVFS) manual EMD Is Dirty, Evfsvol check -r -aevfsvolumepathwhere

Contents

Encrypted Volume and File System v1.1 Administrators Guide Trademark Notice Table of Contents Preparing Evfs for Configuration Upgrading from Evfs v1.0 to EvfsAdministering Evfs 101 129 141 145153 169 171Page List of Figures Software TypesPage List of Tables Page Document Organization About This DocumentIntended Audience Typographic ConventionsRelated Information HP Encourages Your CommentsUser input Features and Benefits Evfs provides the following featuresEvfs Introduction LVM DLO Support Evfs Architecture Evfs Data Flow Encryption Metadata EMDEvfs Encryption Keys Volume Encryption Keys Using HP-UX Trusted Computing Services with EvfsUser Keys 3illustrates how Evfs uses keys to enable an Evfs volume How Evfs Uses KeysFile Names Key Names and Key IDsUser Key and Passphrase Storage Alternate Storage Databases and Distributed Key StorageUser Key Privileges Summary of Key Type and Privileged User CapabilitiesEvfsadm Evfs CommandsEvfsvol utility configures and manages the Evfs volumes EvfspkeySupported Software Software TypesProduct Limitations and Precautions Evfs Introduction Possible Device File Collision Known ProblemsSymptoms WorkaroundFeedback and Enhancement Requests Installation Hardware Requirements System RebootPrerequisites Operating System RequirementsSwinstall utility will install the Evfs components Installing EvfsUse the following procedure to install Evfs Log on to the target system as the root userUpgrading from Evfs v1.0 to Evfs Preparing Evfs for Configuration Verifying for PreconfigurationPreparation Overview Start the Evfs subsystem. See Starting the Evfs SubsystemCreating the User Group Configuring an Alternate Evfs Pseudo-UserSetting the evfsuser Attribute Creating the Evfs Pseudo-User AccountPreparing Evfs for Configuration Private keys Optional Configuring Alternate Key Database DirectoriesKeys Passphrases that secure user private keysDefault pubkey, privkey and passkey Attribute Statements Key Storage Directory RequirementsExample Alternate Directory for Public Keys Example NFS Directory for Public and Private KeysExample Fallback Directory for Nonprivileged Users Datacipher EmdbackupOptional Modifying Evfs Global Parameters PbeStarting the Evfs Subsystem ExampleEvfsadm start -n numberthreads Guidelines for Creating User Keys Creating Keys for Evfs Volume OwnersCreating User Key Pairs Evfspkey keygen -p-s -c cipher -u user -k keynameExamples Creating Recovery KeysStoring the recovery users Private Key Evfspkey keygen -c rsa-2048 -r -k keynameRsa-2048 RSA 2048-bit keys Creating Keys for authorized usersEncrypted file User name as the key name# evfsadm start ExamplesUser Session # evfspkey keygen -u root -k rootkey1Page Configuring an Evfs Volume Configuration OverviewOption 1 Creating a New Evfs Volume Before using this procedure, you must complete the tasksConfiguring an Evfs Volume Creating an LVM or VxVM Volume for EvfsCreating Evfs Volume Device Files Evfsadm map volumepath Creating the EMDOptional Adding Recovery Keys and authorized user Keys Evfsvol add -u user -k keyname evfsvolumepath where Enabling the Evfs VolumeSpecifies that the key pair is a recovery key pair Evfsvol enable -p-k keyname evfsvolumepathOption, you must add a key ID to the entry Etc/evfs/evfstab file for this volume and have a storedSpecifies non-interactive mode. Evfs uses the key ID from Evfsvol prompts you for the passphrase for the private keyCreating a New File System with newfs Creating and Mounting a File System on an Evfs VolumeOptional Using fsck to Check the File Volume # newfs -F vxfs /dev/evfs/vg01/rlvol5Mount the File System on the Evfs Volume Creating the Mount PointOptional Adding an Entry to /etc/fstab Dev/evfs/vg01/lvol5 /opt/encrypteddata vxfs defaults 0 Evfsadm stat -a Evfsvol display evfsvolumepath Verifying the ConfigurationEvfsvol display evfsvolumepath Evfsadm stat -aRemount the file system using the mount command Optional Migrating Existing Data to an Evfs Volume Optional Configuring the Autostart Feature Dev/vg01/lvol5 /dev/evfs/vg01/lvol5 init.initkey bootlocal See evfstab4 for more informationBacking Up Your Configuration Page Map the regular volume to an Evfs volume Preparing the File System and DataIencrypt Inline Encryption Mount the file system to the Evfs volumePerforming Inline Encryption Start inline encryptionConfiguring an Evfs Volume Verifying the Configuration Remount the file system using the mount command # strings /dev/vg01/lvol5 grep TOP Secret Optional Configuring the Autostart Feature Example Backing Up Your Configuration Option Existing size is 96 MB we now extend it by 4 MB, to 100 MB Existing size is 96 MB we now extend it by 4 MB, to 100 MB Page Administering Evfs Enabling Encryption and Decryption Access to Evfs Volumes Starting and Stopping EvfsStarting the Evfs Subsystem Disabling Encryption/Decryption Access to Evfs Volumes Causes Evfs to use a stored passphrase to enable encryptionUses the user name as the key name Enter the following evfsadm stop command evfsadm stop Evfsvol disable -p evfsvolumepathEvfsvol disable -a Stopping the Evfs SubsystemOpening Raw Access to Evfs Volumes Closing Raw Access to Evfs VolumesManaging Evfs Keys and Users Displaying Key IDs for an Evfs VolumeInformation for the volume Restoring User KeysUser To execute this command evfsvol prompts you for Changing Owner Keys for an Evfs VolumeCorresponds to a recovery users key in the EMD. If you do Specifies the name of the file containing private key thatChanging the Passphrase for a Key Recovering from Problems with Owner KeysRemoving Keys from an Evfs Volume Evfspkey delete -u username-r -p -k keynameEvfspkey passgen -u username -k keyname Evfspkey passgen -r recovkeyfile whereEvfspkey passgen -f-p-s -u username -k keyname where Recovering from EMD Corruption EMD Backup DirectoryRemoving a Volume from the Evfs Subsystem # evfsvol destroy /dev/evfs/vg01/lvol5Exporting and Importing Evfs Volumes Exporting an Evfs VolumeUse the following evfspkey keygen command syntax Evfspkey keygen -c cipher -u user -k keynameImporting an Evfs Volume Key owners name and keyname is the key nameIs the key owners name and keyname is the key name Administering Evfs Managing Data on Evfs Volumes Creating a New Evfs Volume Overwrites Existing Data Vxresize -F Might Cause Data Loss or CorruptionResizing Evfs Volumes and File Systems LVM Example Increasing Volume and File System SizesCorrect LVM Example Reducing Volume and File System Sizes IncorrectVxVM Example Increasing Volume and File System Sizes VxVM Example Reducing Volume and File System Sizes# fsadm -F vxfs -b 65536 /test5 Backing Up and Restoring Data on Evfs Volumes Backing Up Evfs Volumes Backup Types with LVM or VxVM Mirrored Volumes Backup Types with Nonmirrored Volumes Backups Using LVM Mirrored Volumes Map the backup volume to EVFS. For exampleThis creates the device files /dev/evfs/vg01/lvol5backup Evfsvol check -r evfsvolumepath Dev/vg01/lvol5backup Syntax is as follows# evfsvol display /dev/evfs/vg01/lvol6 Evfsvol check -r evfsvolumepath Disable the Evfs backup volume. For example Creating Cleartext Backup Media LVM Mirrored Volumes Example File UtilityBackups Using VxVM Mirrored Volumes Map the backup VxVM volume to EVFS. For example# evfsvol raw /dev/evfs/vx/dsk/testdg/backupvol Backing Up and Restoring Data on Evfs Volumes # vxplex -g testdg -v vol05 dis vol05-02 # evfsvol enable -k mykey /dev/evfs/vx/dsk/testdg/backupvol Evfsvol check -r evfsvolumepath # fsck -F vxfs /dev/evfs/vx/rdsk/testdg/backupvol Backing Up Evfs Volumes Creating Cleartext Backup Media VxVM Mirrored Volumes Example Block Device UtilityExample File Utility Backups Using Nonmirrored Volumes # evfsvol raw /dev/evfs/vg01/lvol5 Evfsadm stat -a Cp -r /opt/encrypteddata /opt/evfsbackup Restoring Backup Media Restoring Backup Data from an Evfs Volume to an Evfs Volume # cp -r /opt/backupevfs /opt/encrypteddata 128 Troubleshooting Evfs Troubleshooting Tools OverviewEvfsadm stat -a-s-z Displaying Evfs Volume InformationDisplaying I/O and Encryption Statistics evfsadm stat Meaning of each field is as followsADisplays the EMD information for all enabled Evfs volumes Number of data blocks encryptedSize of the encrypted metadata EMD area, in kilobytes Verifying the EMD evfsvol check SyntaxVerifying User Keys evfspkey lookup # evfspkey lookup -u root -k rootkey1 Key ID root.rootkey1Problem Scenarios Evfspkey Cannot Generate Key PairsEvfspkey Cannot Store Keys Evfsvol Cannot Retrieve Private Key Evfsvol create Fails, Valid EMD Already ExistsSee the evfstab4 man page for more information Evfsadm map command returns the following error Evfsvol disable Fails, Evfs Volume Is BusyEvfsvol disable command returns the following error Evfsadm map Fails, Invalid DeviceEvfsvol check -r -aevfsvolumepathwhere Resets the dirty bit for the specified volumeEMD Is Dirty Reporting Problems Collecting Data140 Product Specifications User Files Commands and Tools Evfs provides the following commands144 Evfs Quick Reference This appendix contains reference information about EvfsConfiguring Evfs Preparing EvfsOption 1 Creating New Evfs Volume # evfsadm map volumepathPerform inline encryption Start inline encryption Evfs Tasks and Commands Table B-1 Starting and Stopping EvfsTable B-3 Managing Evfs Keys and Users Table B-4 Troubleshooting Evfs 152 Using Evfs with Serviceguard Evfs and Serviceguard OverviewRequirements Restrictions Evfs Attribute Definition File ADF Installing Evfs Creating a VxVM Serviceguard Storage Structure Creating the Serviceguard Storage InfrastructureCreating an LVM Serviceguard Storage Infrastructure Configuration NodeAdoptive Nodes Adding the Cluster Keys to the EMD Configuring Evfs on the Configuration NodeCreating a Cluster Key Pair Modifying /etc/evfs/evfstab EntriesPreparing Evfs Volumes for Adoptive Nodes # vgchange -a n /dev/vg02# vxdg deport evfsdg Restoring the Cluster Key Pair Files Configuring Evfs Volumes on the Adoptive NodesCopying the Evfs Configuration Files and Keys Creating a Local Passphrase FileModifying the /etc/evfs/evfstab File Mapping the LVM or VxVM Volumes to EvfsDeactivating the Volumes Verifying EvfsConfiguring the Autostart Feature Halting an Existing Package Configuring Serviceguard using Modular packagesInstalling the Evfs Attribute Definition File Copying the Evfs Control and Module ScriptsAdding the Evfs package to the Configuration File Creating a Modular Package Configuration FileMigrating a Legacy Package Configuration File # cmmigratepkg -p pkgname -o outputfile.conf whereAdding the Evfs Volumes to the Package Configuration File Verifying the ScriptLVM and VxVM Modular package example Creating a Package Control Script Configuring Serviceguard using Legacy packagesCreating the Package Configuration File Converting a Package Control ScriptModifying the Package Configuration File Adding the Evfs Volumes to the Package Control ScriptInstalling the Evfs Control Script LVM and VxVM Legacy package exampleGlossary AESVolume Index EMDPermissions, 85 /etc/rc.config.d/evfs, 62, 72 RSA Vxresize command Renaming