Manuals / HP / Computer Equipment / Software

HP UX Encrypted Volume and Filesystem (EVFS) manual Configuring an Evfs Volume

Models: UX Encrypted Volume and Filesystem (EVFS)

1 174

Download 174 pages 22.98 Kb

Page 68

The –fand –coptions are not valid for a resumed inline encryption. The volume owner key is needed to resume an operation, and you will be prompted for a passphrase.

68 Configuring an EVFS Volume

Image 68

HP UX Encrypted Volume and Filesystem (EVFS) manual Configuring an Evfs Volume

Contents

Encrypted Volume and File System v1.1 Administrators Guide Trademark Notice Table of Contents Preparing Evfs for Configuration Upgrading from Evfs v1.0 to EvfsAdministering Evfs 101 129 153 141145 169 171Page List of Figures Software TypesPage List of Tables Page About This Document Intended AudienceDocument Organization Typographic ConventionsUser input Related InformationHP Encourages Your Comments Evfs Introduction Features and BenefitsEvfs provides the following features LVM DLO Support Evfs Architecture Evfs Encryption Keys Evfs Data FlowEncryption Metadata EMD User Keys Volume Encryption KeysUsing HP-UX Trusted Computing Services with Evfs 3illustrates how Evfs uses keys to enable an Evfs volume How Evfs Uses KeysKey Names and Key IDs User Key and Passphrase StorageFile Names Alternate Storage Databases and Distributed Key StorageUser Key Privileges Summary of Key Type and Privileged User CapabilitiesEvfs Commands Evfsvol utility configures and manages the Evfs volumesEvfsadm EvfspkeySupported Software Software TypesProduct Limitations and Precautions Evfs Introduction Known Problems SymptomsPossible Device File Collision WorkaroundFeedback and Enhancement Requests Installation System Reboot PrerequisitesHardware Requirements Operating System RequirementsInstalling Evfs Use the following procedure to install EvfsSwinstall utility will install the Evfs components Log on to the target system as the root userUpgrading from Evfs v1.0 to Evfs Preparing Evfs for Configuration Verifying for PreconfigurationPreparation Overview Start the Evfs subsystem. See Starting the Evfs SubsystemConfiguring an Alternate Evfs Pseudo-User Setting the evfsuser AttributeCreating the User Group Creating the Evfs Pseudo-User AccountPreparing Evfs for Configuration Optional Configuring Alternate Key Database Directories KeysPrivate keys Passphrases that secure user private keysDefault pubkey, privkey and passkey Attribute Statements Key Storage Directory RequirementsExample Fallback Directory for Nonprivileged Users Example Alternate Directory for Public KeysExample NFS Directory for Public and Private Keys Emdbackup Optional Modifying Evfs Global ParametersDatacipher PbeEvfsadm start -n numberthreads Starting the Evfs SubsystemExample Creating Keys for Evfs Volume Owners Creating User Key PairsGuidelines for Creating User Keys Evfspkey keygen -p-s -c cipher -u user -k keynameCreating Recovery Keys Storing the recovery users Private KeyExamples Evfspkey keygen -c rsa-2048 -r -k keynameCreating Keys for authorized users Encrypted fileRsa-2048 RSA 2048-bit keys User name as the key nameExamples User Session# evfsadm start # evfspkey keygen -u root -k rootkey1Page Configuring an Evfs Volume Configuration OverviewOption 1 Creating a New Evfs Volume Before using this procedure, you must complete the tasksCreating Evfs Volume Device Files Configuring an Evfs VolumeCreating an LVM or VxVM Volume for Evfs Evfsadm map volumepath Creating the EMDOptional Adding Recovery Keys and authorized user Keys Enabling the Evfs Volume Specifies that the key pair is a recovery key pairEvfsvol add -u user -k keyname evfsvolumepath where Evfsvol enable -p-k keyname evfsvolumepathEtc/evfs/evfstab file for this volume and have a stored Specifies non-interactive mode. Evfs uses the key ID fromOption, you must add a key ID to the entry Evfsvol prompts you for the passphrase for the private keyCreating and Mounting a File System on an Evfs Volume Optional Using fsck to Check the File VolumeCreating a New File System with newfs # newfs -F vxfs /dev/evfs/vg01/rlvol5Optional Adding an Entry to /etc/fstab Mount the File System on the Evfs VolumeCreating the Mount Point Dev/evfs/vg01/lvol5 /opt/encrypteddata vxfs defaults 0 Verifying the Configuration Evfsvol display evfsvolumepathEvfsadm stat -a Evfsvol display evfsvolumepath Evfsadm stat -aRemount the file system using the mount command Optional Migrating Existing Data to an Evfs Volume Optional Configuring the Autostart Feature Dev/vg01/lvol5 /dev/evfs/vg01/lvol5 init.initkey bootlocal See evfstab4 for more informationBacking Up Your Configuration Page Map the regular volume to an Evfs volume Preparing the File System and DataMount the file system to the Evfs volume Performing Inline EncryptionIencrypt Inline Encryption Start inline encryptionConfiguring an Evfs Volume Verifying the Configuration Remount the file system using the mount command # strings /dev/vg01/lvol5 grep TOP Secret Optional Configuring the Autostart Feature Example Backing Up Your Configuration Option Existing size is 96 MB we now extend it by 4 MB, to 100 MB Existing size is 96 MB we now extend it by 4 MB, to 100 MB Page Administering Evfs Starting the Evfs Subsystem Enabling Encryption and Decryption Access to Evfs VolumesStarting and Stopping Evfs Uses the user name as the key name Disabling Encryption/Decryption Access to Evfs VolumesCauses Evfs to use a stored passphrase to enable encryption Evfsvol disable -p evfsvolumepath Evfsvol disable -aEnter the following evfsadm stop command evfsadm stop Stopping the Evfs SubsystemOpening Raw Access to Evfs Volumes Closing Raw Access to Evfs VolumesDisplaying Key IDs for an Evfs Volume Information for the volumeManaging Evfs Keys and Users Restoring User KeysUser Changing Owner Keys for an Evfs Volume Corresponds to a recovery users key in the EMD. If you doTo execute this command evfsvol prompts you for Specifies the name of the file containing private key thatRecovering from Problems with Owner Keys Removing Keys from an Evfs VolumeChanging the Passphrase for a Key Evfspkey delete -u username-r -p -k keynameEvfspkey passgen -f-p-s -u username -k keyname where Evfspkey passgen -u username -k keynameEvfspkey passgen -r recovkeyfile where Recovering from EMD Corruption EMD Backup DirectoryRemoving a Volume from the Evfs Subsystem # evfsvol destroy /dev/evfs/vg01/lvol5Exporting and Importing Evfs Volumes Exporting an Evfs VolumeUse the following evfspkey keygen command syntax Evfspkey keygen -c cipher -u user -k keynameIs the key owners name and keyname is the key name Importing an Evfs VolumeKey owners name and keyname is the key name Administering Evfs Managing Data on Evfs Volumes Creating a New Evfs Volume Overwrites Existing Data Vxresize -F Might Cause Data Loss or CorruptionCorrect Resizing Evfs Volumes and File SystemsLVM Example Increasing Volume and File System Sizes LVM Example Reducing Volume and File System Sizes IncorrectVxVM Example Increasing Volume and File System Sizes VxVM Example Reducing Volume and File System Sizes# fsadm -F vxfs -b 65536 /test5 Backing Up and Restoring Data on Evfs Volumes Backing Up Evfs Volumes Backup Types with LVM or VxVM Mirrored Volumes Backup Types with Nonmirrored Volumes This creates the device files /dev/evfs/vg01/lvol5backup Backups Using LVM Mirrored VolumesMap the backup volume to EVFS. For example Evfsvol check -r evfsvolumepath Dev/vg01/lvol5backup Syntax is as follows# evfsvol display /dev/evfs/vg01/lvol6 Evfsvol check -r evfsvolumepath Disable the Evfs backup volume. For example Creating Cleartext Backup Media LVM Mirrored Volumes Example File UtilityBackups Using VxVM Mirrored Volumes Map the backup VxVM volume to EVFS. For example# evfsvol raw /dev/evfs/vx/dsk/testdg/backupvol Backing Up and Restoring Data on Evfs Volumes # vxplex -g testdg -v vol05 dis vol05-02 # evfsvol enable -k mykey /dev/evfs/vx/dsk/testdg/backupvol Evfsvol check -r evfsvolumepath # fsck -F vxfs /dev/evfs/vx/rdsk/testdg/backupvol Backing Up Evfs Volumes Example File Utility Creating Cleartext Backup Media VxVM Mirrored VolumesExample Block Device Utility Backups Using Nonmirrored Volumes # evfsvol raw /dev/evfs/vg01/lvol5 Evfsadm stat -a Cp -r /opt/encrypteddata /opt/evfsbackup Restoring Backup Media Restoring Backup Data from an Evfs Volume to an Evfs Volume # cp -r /opt/backupevfs /opt/encrypteddata 128 Troubleshooting Evfs Troubleshooting Tools OverviewDisplaying Evfs Volume Information Displaying I/O and Encryption Statistics evfsadm statEvfsadm stat -a-s-z Meaning of each field is as followsADisplays the EMD information for all enabled Evfs volumes Number of data blocks encryptedSize of the encrypted metadata EMD area, in kilobytes Verifying the EMD evfsvol check SyntaxVerifying User Keys evfspkey lookup # evfspkey lookup -u root -k rootkey1 Key ID root.rootkey1Evfspkey Cannot Store Keys Problem ScenariosEvfspkey Cannot Generate Key Pairs See the evfstab4 man page for more information Evfsvol Cannot Retrieve Private KeyEvfsvol create Fails, Valid EMD Already Exists Evfsvol disable Fails, Evfs Volume Is Busy Evfsvol disable command returns the following errorEvfsadm map command returns the following error Evfsadm map Fails, Invalid DeviceEMD Is Dirty Evfsvol check -r -aevfsvolumepathwhereResets the dirty bit for the specified volume Reporting Problems Collecting Data140 Product Specifications User Files Commands and Tools Evfs provides the following commands144 Evfs Quick Reference This appendix contains reference information about EvfsConfiguring Evfs Preparing EvfsOption 1 Creating New Evfs Volume # evfsadm map volumepathPerform inline encryption Start inline encryption Evfs Tasks and Commands Table B-1 Starting and Stopping EvfsTable B-3 Managing Evfs Keys and Users Table B-4 Troubleshooting Evfs 152 Requirements Using Evfs with ServiceguardEvfs and Serviceguard Overview Restrictions Evfs Attribute Definition File ADF Installing Evfs Creating the Serviceguard Storage Infrastructure Creating an LVM Serviceguard Storage InfrastructureCreating a VxVM Serviceguard Storage Structure Configuration NodeAdoptive Nodes Configuring Evfs on the Configuration Node Creating a Cluster Key PairAdding the Cluster Keys to the EMD Modifying /etc/evfs/evfstab Entries# vxdg deport evfsdg Preparing Evfs Volumes for Adoptive Nodes# vgchange -a n /dev/vg02 Configuring Evfs Volumes on the Adoptive Nodes Copying the Evfs Configuration Files and KeysRestoring the Cluster Key Pair Files Creating a Local Passphrase FileMapping the LVM or VxVM Volumes to Evfs Deactivating the VolumesModifying the /etc/evfs/evfstab File Verifying EvfsConfiguring the Autostart Feature Configuring Serviceguard using Modular packages Installing the Evfs Attribute Definition FileHalting an Existing Package Copying the Evfs Control and Module ScriptsCreating a Modular Package Configuration File Migrating a Legacy Package Configuration FileAdding the Evfs package to the Configuration File # cmmigratepkg -p pkgname -o outputfile.conf whereLVM and VxVM Modular package example Adding the Evfs Volumes to the Package Configuration FileVerifying the Script Configuring Serviceguard using Legacy packages Creating the Package Configuration FileCreating a Package Control Script Converting a Package Control ScriptAdding the Evfs Volumes to the Package Control Script Installing the Evfs Control ScriptModifying the Package Configuration File LVM and VxVM Legacy package exampleGlossary AESVolume Index EMDPermissions, 85 /etc/rc.config.d/evfs, 62, 72 RSA Vxresize command Renaming