This post is more than 5 years old
11 Posts
0
1682
February 11th, 2015 06:00
Securing SyncIQ jobs between clusters?
Hi,
We are running SyncIQ between clusters successfully, but have a couple of questions regarding security.
First, there is a "Shared Secret" field when setting up a policy, but we are having trouble finding the documentation. The Admin Guide says "refer to the Knowledge Base", where we do find a bit of info, namely:
Solution
If a shared secret is specified on the source cluster for a SyncIQ job, you must also specify a shared secret on the target cluster.
Add the password/shared secret to the following file on the target cluster.
For SyncIQ 2.0, 2.5:
/ifs/.ifsvar/modules/tsm/passwd
the question is, do we simply add a new line to this file with the text of the Shared Secret? Also, there seems to be not other mechanism to secure a SyncIQ job, correct? The GUI just lets us pick a target cluster, specify a target folder, and start the job. No remote password required or anything. Is there any other way?
Thanks,
Don
chughh
122 Posts
0
February 11th, 2015 09:00
Hello,
Sorry I missed that. yes you need to create a file manually on location (/ifs/.ifsvar/modules/tsm/passwd) and input password.
Which also speaks to the matter of security -- if I knew only a cluster's IP address, and it was running SyncIQ, I could indiscriminately bombard it with a sync job, if not for the shared secret, right?
Yes you are correct..
Thanks
Hemant
chughh
122 Posts
0
February 11th, 2015 07:00
Hello,
Yes you only need to type password in the secret file (it has to be identical on source and target cluster). If you have specified shared secret only on source then you will get error so secret file has to be same on source and target cluster.
This will be handy when you are trying to do some testing on a new cluster and secret password file has not been implemented on the new cluster synciq will not run the job will fail asking for shared secret password.
From user guide.
Optionally, in the Shared secret box, type a shared secret for SyncIQ operations.
This shared secret provides a simple level of authentication that can prevent certain types of attacks; however, this
feature does not perform any encryption. To establish this type of authentication, you must configure both the target
cluster and the source cluster to require the same shared secret.
Thanks
Hemant
piched2
11 Posts
0
February 11th, 2015 08:00
Hi Hemant,
Yes, we had looked at the documentation, but the problem/question is, there is no place to input the shared secret via the web interface on the target cluster. Is it a CLI-only operation perhaps?
Per the doc's reference to consult the Knowledge Base (at support.emc.com), we have anecdotal information suggesting to populate the
/ifs/.ifsvar/modules/tsm/passwd
file on the target side. On my (test) cluster, that file does not exist. Should we create the file on the target cluster, containing the text string of the shared secret then?
Which also speaks to the matter of security -- if I knew only a cluster's IP address, and it was running SyncIQ, I could indiscriminately bombard it with a sync job, if not for the shared secret, right? Thanks again!
Regards,
Don
piched2
11 Posts
0
February 11th, 2015 11:00
OK great. I guess I'll make a leap of faith and surmise that the mere existence of the 'passwd' file on the target means that any SyncIQ job from any source will be refused, unless the shared secret field is populated with the same string. Thanks again!
piched2
11 Posts
0
February 15th, 2015 14:00
Hi,
As a follow-up, the customer wonders, if they add a shared secret to the 'passwd' file on the target, and specify same at the source, but it's in the middle of an existing sync policy/job (that is, only incremental changes are now being copied to the target), will the additional layer of security cause the existing process to revert to a full sync, i.e. a replay of the entire sequence?
Thanks,
Don