UNSOLVED
S
shearer007
10 Posts
0
1348
July 18th, 2007 06:00
AES ASAM
Hi,
We have recently upgraded our Networker server to version NetWorker nw_7_3_2_jumbo.Build.386 Network Edition/60, i have been having a few issues getting the Encryption ASAM up and running, We are backing up Linux/Unix/wintel servers and i need to get this working. I have added the datazone pass phrase, and taken a copy of the Unix standard Directive and added the following as a test:
<< / >>
skip: tmp_mnt
+skip: core
+aes: *
I have ran my backup but i am unsure if it worked?
Will the above encrpt the / filesystem?, or am i doing something wrong? i want to eventually be able to add encryption to all filesystems for this client. i know the encryption is done at the saveset level, how can i check if this actually is doing what i want it to?
if it works does it put a key or a lock on the saveset?
and what happens when the file is recovered?
I have a client who requires this so any help or guidance would be grateful
Thanks in Advance
Steve
We have recently upgraded our Networker server to version NetWorker nw_7_3_2_jumbo.Build.386 Network Edition/60, i have been having a few issues getting the Encryption ASAM up and running, We are backing up Linux/Unix/wintel servers and i need to get this working. I have added the datazone pass phrase, and taken a copy of the Unix standard Directive and added the following as a test:
<< / >>
skip: tmp_mnt
+skip: core
+aes: *
I have ran my backup but i am unsure if it worked?
Will the above encrpt the / filesystem?, or am i doing something wrong? i want to eventually be able to add encryption to all filesystems for this client. i know the encryption is done at the saveset level, how can i check if this actually is doing what i want it to?
if it works does it put a key or a lock on the saveset?
and what happens when the file is recovered?
I have a client who requires this so any help or guidance would be grateful
Thanks in Advance
Steve
643
0
Posted July 18th, 2007 07:00
I have just started using the AES asm on my Windows clients.
<< / >>
+aes: *
You must specify the passphrase or it will use a default. The only real way you will notice, at least in my experience, is if you change your passphrase and try to recover data that was encrypted with a previous phrase. In that case you must specify the old passphrase with the -p switch.
It explains it pretty well in the Admin guide on page 2-16 & 13-15.
One thing I have noticed since applying it, is that my LTO-3 tapes now only hold about 450 GB vs 600+ GB previously.643
0
Posted July 18th, 2007 09:00
That's expected as enrypted data has random pattern.643
0
Posted November 7th, 2007 14:00
I am using Networker 7.3.1 and am working with AES ASM for the first time today. I supplied a Datazone pass phrase on our backup server then did a small test backup of some data on another server using a directive with the aes command in it.
I then did a restore of the data back to the same server it came from and it worked fine. I then removed the pass phrase leaving it blank and did another restore on the same server. It restored the data but noted in the recover status: no decryption key available! However it did restore the data fine and I can access it. I also did a redirected restore of the same data to the backup server and it restored fine but still showed that no decryption key was available.
I thought that if the pass phrase was changed when you went to restore encrypted data it would prompt you to provide the pass phrase it was encrypted with. Not sure why it is not.
Any assistance is appreciated.643
0
Posted November 7th, 2007 23:00
It won't ask you for any password - kind of cheeky
If you had something encrypted and saved in that manner and then you run restore you will see files coming and they will have exactly the same size and everything. Then try to read that file (if it was some document for example) and you get one big nothing. Very cheeky643
0
Posted November 8th, 2007 07:00
In NW user under recover options you can put recover password. From CLI there is also a switch where you can specify it.643
0
Posted November 8th, 2007 07:00
thanks, it works. I put a doc file in the backup and did a encrypted restore without the datazone passphrase included on the backup server and when I tried to open it all I could see was a bunch of small squares. Then I tried it with the right pass phrase and I could read the doc.
One more question though, if the datazone pass phrase is not present or has been changed since the encrypted backup was done with the old phrase, then how, using Networker User, do you restore the encrypted data to access it without putting back the original pass phrase on the backup server. Networker User doesn't prompt me for a pass phrase when I try to restore the data. It just restores it and tells me no decryption key was available.300
0
Posted November 8th, 2007 08:00
Never played with that really... if you try the same from CLI using -p to specify pass do you get better results?300
0
Posted November 8th, 2007 08:00
From the Networker User on the server I am trying to restore the encrypted data. I select the encrypted data and redirect it to another folder then fill in the password fields under options but when I start restore it still tells me that no decryption key is available.89
0
Posted November 8th, 2007 08:00
I will try.
Can you encrypt SQL and Exchange databases as well using aes asm?
ble1
6 Operator
•
14354 Posts
•
56186 Points
643
0
Posted July 18th, 2007 07:00
We had some discussion on AES here and if your customer requires encrypted solution dedicated hardware is much better approach.