Dell PowerVault ML6000 Guide d'installation

Dell Encryption Key Manager

and Library Managed

Encryption

Best Practices and FAQ

Notes and Cautions

NOTE: A NOTE indicates important information that helps you make better use of

your computer.

CAUTION: A CAUTION indicates either potential damage to hardware or loss of

data and tells you how to avoid the problem.

____________________

Information in this publication is subject to change without notice.

Reproduction of these materials in any manner whatsoever without the written permission of Dell Inc.

is strictly forbidden.

Trademarks used in this text: Dell™, the DELL logo, and PowerEdge™ are trademarks of Dell Inc.

Microsoft®, Windows®, and Windows Server®are either trademarks or registered trademarks of

Microsoft Corporation in the United States and/or other countries. Linux®is the registered trademark

of Linus Torvalds in the U.S. and other countries. Red Hat®and Red Hat Enterprise Linux®are

registered trademarks of Red Hat, Inc. in the United States and/or other countries. Novell®is a

registered trademark and SUSE ™ is a trademark of Novell Inc. in the United States and other countries.

Other trademarks and trade names may be used in this publication to refer to either the entities claiming

the marks and names or their products. Dell Inc. disclaims any proprietary interest in trademarks and

trade names other than its own.

2011 - 3 Rev. A02

Contents 3

Contents

1 Dell Encryption Key Manager

and Library Managed Encryption . . . . . . . 7

Best Practices . . . . . . . . . . . . . . . . . . . . . . . 7

FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Is Encryption Key Manager (EKM) supported on

Microsoft Windows Server 2008 and

Windows Server 2008 R2? . . . . . . . . . . . . . . 9

Is EKM supported on SUSE Linux

Enterprise Server 11?. . . . . . . . . . . . . . . . . 9

Is EKM supported on a virtual machine?. . . . . . . 9

How do I upgrade my current EKM

to version 2.1? . . . . . . . . . . . . . . . . . . . 10

Can an EKM server running EKM 2.0

and an EKM server running

EKM 2.1 be synchronized? . . . . . . . . . . . . . 11

How do I create a redundant EKM

based on a primary EKM server?. . . . . . . . . . 11

How do I synchronize the redundant

EKM anytime configuration changes

(like adding keys, adding key groups,

adding drives, and so on) are made

to the primary EKM? . . . . . . . . . . . . . . . . 12

How do I locate the TCP port for the

EKM server to configure my library? . . . . . . . . 12

How do I ensure that EKM restarts

automatically if my server reboots? . . . . . . . . 12

How do I configure EKM to run as a

Windows service in a 32-bit environment?. . . . . 13

How do I configure EKM to run as a

Windows service in a 64-bit environment?. . . . . 16

4Contents

EKM appears to start as a Windows service

but shows as stopped when I

check or refresh the services . . . . . . . . . . . 16

How do I uninstall EKM as a

Windows service? . . . . . . . . . . . . . . . . . 17

How do I change my login password? . . . . . . . 17

EKM Server is configured to start as a

Windows service but it stops

after initially starting . . . . . . . . . . . . . . . . 18

When I attempt to log into the

EKM Server GUI, the GUI returns

an error message pop-up reading

EKM Server Login Failed: null. . . . . . . . . . . . 18

How do I configure the EKM CLI client

for authentication based on the

LocalOS registry? . . . . . . . . . . . . . . . . . . 19

How do I uninstall EKM? . . . . . . . . . . . . . . 20

How do I reinstall the EKM? . . . . . . . . . . . . 20

I am having issues with a new

EKM installation and need to reinstall.

How can I determine if the EKM

ever provided keys? . . . . . . . . . . . . . . . . . 21

How do I reuse previously encrypted

media as non-encrypted media or

as encrypted media with a

different encryption key? . . . . . . . . . . . . . . 21

How do I recover from a forgotten

EKM GUI login password? . . . . . . . . . . . . . 22

My redundant EKM server does not

start and the login fails . . . . . . . . . . . . . . . 23

The Dell Encryption Key Manager User's Guide

does not contain details on how

the user can edit the EKM configuration

files for the server and client . . . . . . . . . . . . 23

My PowerVault TL2000/TL4000 posts

an LME Failure when I change the configuration

from Library-Managed Encryption to

Application-Managed Encryption . . . . . . . . . 24

Contents 5

My PowerVault TL2000/TL4000 is configured

for library-managed encryption and my

RMU shows an error condition

with no associated text. . . . . . . . . . . . . . . 24

When I attempt to add a drive manually

using adddrive in the CLI, it asks for a

12-digit drive serial number. The drive

serial number is only 10 digits . . . . . . . . . . . 24

How is my backup application affected

when I configure the library for

library-managed encryption?. . . . . . . . . . . . 24

How does EKM handle the addition of

new drives or the replacement of bad drive? . . . 25

How does EKM handle the addition of a

new library or the replacement

of a bad library?. . . . . . . . . . . . . . . . . . . 25

How is compression affected by

encryption and vice versa?. . . . . . . . . . . . . 25

Is there a performance impact

with encryption? . . . . . . . . . . . . . . . . . . 25

6Contents

Dell Encryption Key Manager and Library Managed Encryption 7

NOTE: Read the following information before using your Dell PowerVault TL2000,

TL4000, or ML6000 tape libraries.

Dell Encryption Key Manager and

Library Managed Encryption

This document covers the Dell Encryption Key Manager and Library

Managed Encryption used on the Dell PowerVault TL2000, TL4000,

and ML6000 tape libraries.

Best Practices

It is not possible to overstate the importance of backing up the key store once it is

populated with keys and every time keys are added to the key store. If the keys are

lost, the data encrypted with the keys is lost forever.

The key store should be backed up to non-encrypted media. The keys are

encrypted within the key store so there is no security concern with this process.

The key store should not be backed up to media encrypted with the keys in the

key store as the backup is no longer available if the key store is deleted or

corrupted. The Dell Encryption Key Manager (EKM) GUI allows for the key

store to be backed up every time a configuration change is made.

To prevent possible data loss due to an EKM server failure, it is recommended

to use a primary and redundant (secondary) EKM server. This configuration

provides redundancy in the event the primary EKM server is down or

unavailable. For information on configuring a primary and redundant

(secondary) EKM server for your library, follow the steps under "How do I create

a redundant EKM based on a primary EKM server?" on page 11. If two

independent EKMs are installed and configured through the defaults, the key

stores cannot be merged later due to identical key aliases.

It is recommended that the primary and redundant EKM servers be

synchronized every time changes are made to the primary EKM. In addition,

since the two methods of synchronization in the

Dell Encryption Key Manager

User's Guide

do not act on the keystore or key groups XML file, both of which

are essential to reading encrypted data from the media, they should be copied

to the redundant EKM server any time new media is allocated by EKM.

For more information, see "How do I synchronize the redundant EKM anytime

configuration changes (like adding keys, adding key groups, adding drives, and so

on) are made to the primary EKM?" on page 12.

8Dell Encryption Key Manager and Library Managed Encryption

It is recommended that you set the EKM server with a static IP address

to avoid changes in the IP address. With the EKM server IP address set to

Dynamic

using a DHCP server, there is the possibility of the E KM server

IP address being changed by the DHCP server. When the IP address changes,

the library has no way to access the EKM server. All subsequent encrypted

backup jobs fail if there is no available EKM server to provide the required keys.

If the library firmware supports key path diagnostics, the diagnostics should be

run to validate the EKM connectivity prior to starting normally scheduled

backups. This ensures that scheduled backup jobs complete successfully.

If the library firmware does not support key path diagnostics, the firmware can

be updated to the most recent version so that key path diagnostics can be used.

Test backups can also be used to validate the EKM connectivity.

When using new media, the user must ensure that the tape backup software

application recognizes the media as available for backup and is in a valid state

prior to encrypting data on the media.This ensures that scheduled backup jobs

complete successfully.

To avoid data loss, key path diagnostics should be run on the library to

validate that the EKM server or servers are still running. EKM can be

configured as a Microsoft Windows service so that it automatically restarts if the

system is rebooted. To configure EKM as a Windows service, see "How do I

configure EKM to run as a Windows service in a 32-bit environment?" on page 13.

Media portability rules with library-managed encryption are consistent with

media portability rules between different types of backup software. Currently

media encrypted through library-managed encryption cannot be restored

through a standalone drive due to lack of support for standalone drives in EKM.

Media encrypted in one Dell PowerVault tape library can be restored through

another PowerVault tape library as long as the key store associated with the

original library can be accessed by the second library.

Dell Encryption Key Manager and Library Managed Encryption 9

To minimize latency in providing keys to the drive, the EKM should be on

a localized network. The EKM can be located on a different network or offsite

from the library but the network bandwidth should be taken into account.

It is recommended that the audit log file folder be cleaned out periodically.

Each audit file log is 1 MB and a new file with a new time stamp is created

every time the current file reaches 1 MB. These files are located under

C:\ekm\gui\audit

FAQ

Is Encryption Key Manager (EKM) supported on Microsoft

Windows Server 2008 and Windows Server 2008 R2?

Support for Windows Server 2008 and Windows Server 2008 R2 was added

in EKM version 2.1 available at

support.dell.com

Is EKM supported on SUSE Linux Enterprise Server 11?

Support for SUSE Linux Enterprise Server 11 was added in EKM version 2.1

available at

support.dell.com

Is EKM supported on a virtual machine?

Support for Microsoft Windows Hyper-V and VMWare 4.0 was added

in EKM version 2.1 available at

support.dell.com

. EKM must run on

a supported guest operating system.

10 Dell Encryption Key Manager and Library Managed Encryption

How do I upgrade my current EKM to version 2.1?

There is no upgrade process for EKM. In order to update to EKM version 2.1,

migrate the EKM application. Choose the appropriate option below depending

on your operating system environment.

• If the existing EKM is running on Microsoft Windows Server 2003,

Red Hat Enterprise Linux 4, Red Hat Enterprise Linux 5, SUSE Linux

Enterprise Server 9, SUSE Linux Enterprise Server 10—No upgrade

is required. EKM version 2.1 does not add any new features to your

current installation. Only new operating system support was added.

• If you are upgrading an existing EKM on a new supported operating

system using a new server:

Select the new server and ensure that the new operating system

is supported in EKM 2.1.

Follow the procedure in "How do I create a redundant EKM based on a

primary EKM server?" on page 11. However, you do not have to install

the primary EKM as mentioned in step 1 as the installation is already

completed on the existing server. Make note of the items listed in that

step 1. Perform step 7 to step 10 only if you are using a primary and

redundant EKM configuration.

After the EKM is successfully migrated, the original EKM server can

be uninstalled. It is recommended that you use key path diagnostics

or a test backup to verify the functionality of the new EKM prior to

uninstalling the existing EKM.

• If you are upgrading existing EKM on a new supported operating system

using the existing server:

Ensure the new operating system is supported on EKM 2.1.

Collect the backup files from the existing EKM located in the default

directory at

c:\ekm\backup

Record the following settings in the existing EKM: group name,

number of keys, key store name, and key store password.

Install the new operating system and drivers on the existing server.

Install EKM 2.1. Use the GUI to configure the EKM. The EKM 2.1

settings must be the same as the original EKM - the following items

must match: group name, number of keys, key store name, and key

store password.

Autres manuels pour PowerVault ML6000

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Dell Logiciel

Dell

Dell OPENMANAGE 7.6 Manuel utilisateur

Dell

Dell DVS Simplified Appliance Tower Manuel de service

Dell

Dell S2340T Touch Manuel utilisateur

Dell

Dell PowerVault MD3060e Series Manuel de l'opérateur

Dell

Dell PowerEdge UPS 500T Manuel utilisateur

Dell

Dell PowerVault 770N Manuel utilisateur

Dell

Dell PowerConnect W-Airwave Manuel utilisateur

Dell

Dell DX6000 Guide de l'utilisateur

Dell

Dell OpenManage Network Manager Manuel utilisateur

Dell

Dell PowerConnect W-Airwave Manuel utilisateur

Dell

Dell OPENVIEW NNM SE 1.2 Manuel utilisateur

Dell

Dell OpenManage Network Manager Mode d’emploi

Dell

Dell DX6000G Manuel utilisateur

Dell

Dell DX6000 Manuel utilisateur

Dell

Dell PowerApp .cache 100 Manuel d'exploitation et d'entretien

Dell

Dell PowerVault Storage Area Network Manuel utilisateur

Dell

Dell DX6000 Comment utiliser

Dell

Dell PowerVault MD3000i Manuel utilisateur

Dell

Dell PowerConnect W-Airwave Manuel utilisateur

Dell

Dell PowerVault ML6000 Manuel utilisateur

Dell

Dell IDRAC6 Manuel utilisateur

Dell

Dell PowerVault MD3000i Manuel utilisateur

Dell

Dell DX6000 Manuel utilisateur

Dell

Dell PowerConnect W-Airwave Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur