HP UX Encrypted Volume and Filesystem (EVFS) manual Option 1 Creating New Evfs Volume

Option 1: Creating New EVFS Volume

1.Configure the EVFS volume:

a.Create an LVM or VxVM volume if you are not creating the EVFS volume directly above a whole physical volume:

#lvcreate -Llv_size [options]vgfile (LVM)

#vxassist -ggroup make volume_name size (VxVM)

b.Create the EVFS device files:

CAUTION: Any data on the underlying LVM, VxVM, or physical volume will be overwritten in subsequent steps, so HP recommends that you specify an empty volume.

#evfsadm map volume_path

c.Create the EMD and assign an owner for the volume:

#evfsvol create -kkeyname [-ccipher]evfs_volume_path

d.(Optional) Add recovery and authorized user keys to the volume:

#evfsvol add -r[-kkeyname]evfs_volume_path

#evfsvol add -u user [-k keyname]evfs_volume_path

e.Enable encryption and decryption access for the EVFS volume:

#evfsvol enable [-kkeyname]evfs_volume_path

2.Create and mount a new file system on the EVFS volume:

a.Use the newfs command to create a new file system on the raw EVFS volume device file:

#newfs [-Ffile_sys_type ] /dev/evfs/raw_evfs_volume_path

b.(Optional) Use the fsck command to check the integrity of the file system:

#fsck [-Ffile_sys_type] raw_evfs_volume_path

c.Use the mkdir command to create the mount point:

#mkdir mount_point

d.Mount the file system on the EVFS volume:

#mount [-Ffile_sys_type] evfs_volume_path mount_point

e.Add an entry to the /etc/fstab file for the encrypted volume. The syntax for the entry is as follows:

evfs_volume_path mount_point file_sys_type [options]

3.Verify EVFS operation. Use the following commands:

• evfsadm stat -a

• evfsvol display evfs_volume_path

4.(Optional) Migrate existing data to the EVFS volume by copying data from a non-EVFS volume to an EVFS volume. For more information, see “Step 4: (Optional) Migrating Existing Data to an EVFS Volume” (page 61)

5.(Optional) Configure the EVFS autostart feature. The autostart feature enables you to enable EVFS encryption and mount file systems on EVFS volumes at system startup without manual intervention. You must have stored passphrases to use the autostart feature.

To configure the autostart feature, edit the /etc/rc.config.d/evfs file to contain the following entry:

EVFS_ENABLED = 1

You must also edit the /etc/evfs/evfstab file. The syntax for each entry is as follows:

vvolume_path evfs_volume_path user_name.key_name options

Configuring EVFS 147