Chapter 4 Administering the Sun Crypto Accelerator 4000 Board With the vcaadm andvcadiag Utilities 75
A password must be set for the backup data. This password is used to encrypt the
master key that is in the backup file.
Caution – Youshould choose a password that is very difficult to guess when
making backup files because this password protects the master key for your
keystore. Youmust also remember the password you enter. Without the password,
you cannot access the master key backup file. There is no way to retrieve the data
protected by a lost password.
Locking the Keystore to Prevent Backups
A site might have a strict security policy that doesn’t allow the master key for a Sun
Crypto Accelerator 4000 board to ever leave the hardware. This can be enforced
using the set lockcommand.
Caution – Once this command is issued, all attempts to back up the master key will
fail. This lock persists even if the master key is rekeyed. The only way to clear this
setting is to zeroize the Sun Crypto Accelerator 4000 board with the zeroize
command. Refer to “Zeroizing a Sun Crypto Accelerator 4000 Board” on page80.
vcaadm{vcaN@hostname,sec_officer}> backup /opt/SUNWconn/vca/backups/bkup.data
Enter a password to protect the data:
Confirm password:
Backup to /opt/SUNWconn/vca/backups/bkup.data successful.
vcaadm{vcaN@hostname,sec_officer}> set lock
WARNING: Issuing this command will lock the
master key. You will be unable to back
up your master key once this command
is issued. Once set, the only way to
remove this lock is to zeroize the board.
Do you wish to lock the master key? (Y/Yes/N/No) [No]: y
The master key is now locked.