Avamar 19.3+：Goav 安全性金鑰存放區會透過自動修正顯示並檢查金鑰存放區和加密箱的執行狀況

摘要: 使用 Goav 工具顯示金鑰存放區內容，或檢查 Avamar 系統上所有金鑰存放區的健全狀況。

本文章適用於本文章不適用於本文無關於任何特定產品。本文未識別所有產品版本。

說明

支援的最新 Avamar 版本：19.10
命令集支援的 Avamar 版本：需要 19.3+
Goav 版本：1.39+，推薦版本最低 1.50

下載/安裝 Goav 工具

000192151 |Avamar：Goav 工具

註解

- 在 Avamar 的每個後續版本之後，必須再次驗證該功能。
- 所有 goav 安全命令必須以 root 身份運行。

特點

顯示金鑰庫內容

此命令會提供下拉式選擇提示，以選擇要列印的金鑰存放區

./goav security keystore show

此命令會將所有金鑰存放區列印到螢幕。

./goav security keystore show --all

使用選用的自動修正

檢查金鑰存放區和加密箱組態此命令會針對 Avamar 系統上的所有金鑰存放區執行數次執行狀況檢查。
- 檢查每個金鑰庫是否存在。
- 檢查金鑰庫許可權和擁有權。
- 檢查加密箱金鑰庫密碼短語運行狀況。
- 檢查密碼箱和金鑰庫密碼是否匹配。
- 檢查每個金鑰庫的格式是否正確（PKCS12）。
- 檢查每個金鑰庫中是否存在每個必需的別名（證書）。
- 列印帶有詳細問題訊息的通過/失敗摘要。

./goav security keystore check-config

此命令會針對所有金鑰存放區執行數次執行狀況檢查，並自動修正。
- 檢查每個金鑰庫是否存在。
- 檢查金鑰庫許可權和擁有權
- 檢查加密箱金鑰庫密碼短語運行狀況。
- 檢查密碼箱/金鑰庫密碼是否匹配。
- 檢查每個金鑰庫的格式是否正確（PKCS12）。
- 檢查每個金鑰庫中是否存在每個必需的別名（證書）。
- 列印帶有詳細問題訊息的通過/失敗摘要。
- 自動重新生成丟失的金鑰庫。
- 自動修復許可權和擁有權。
- 如果密碼箱密碼與金鑰庫密碼不匹配，則自動重新生成金鑰庫。
- 在重新生成
之前備份現有金鑰庫 - 如有必要，自動重新生成密鑰庫或特定別名。
- 從 Java RMI 金鑰庫更新 MCSSL 私鑰條目，以與 avi 和 tomcat 金鑰庫同步。
- 重新啟動適當的服務

./goav security keystore check-config --fix

範例

顯示金鑰庫

root@ser-ave03:/home/admin/#: ./goav security keystore show
===========================================================
GoAv    :        1.39
Avamar  :        19.7
Date    :        19 Oct 2022 10:28 MDT
===========================================================
NOTE: This is not an official tool
===========================================================
Use the arrow keys to navigate: ↓ ↑ → ←
Select Keystore to Print:
    RMI_SSL_KEYSTORE
    AVAMAR_KEYSTORE
  → AVINSTALLER_KEYSTORE
    TOMCAT_KEYSTORE

在被動模式下檢查金鑰庫組態

root@avmr-4400-rtp:/usr/local/avamar/lib/#: ~admin/goav security keystore check-config
===========================================================
GoAv    :        1.49
Avamar  :        19.4
Date    :        17 Mar 2023 13:31 EDT
===========================================================
COMMAND :  /home/admin/goav security keystore check-config
NOTE: This is not an official tool
===========================================================
Table: Keystore Existence/Permissions Check
-------------------------------------------

          Name         |                  Path                  | Exists |  Current Permissions  | Expected Permissions |   Current Ownership   | Expected Ownership
-----------------------+----------------------------------------+--------+-----------------------+----------------------+-----------------------+---------------------
  RMI_SSL_KEYSTORE     | /usr/local/avamar/lib/rmi_ssl_keystore | true   | rw-rw----             | rw-rw----            | root admin            | root admin
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | true   | rw-rw----             | rw-rw----            | root root             | root admin
  AVINSTALLER_KEYSTORE | /usr/local/avamar/lib/avi/avi_keystore | false  | emtpy: file not found | rw-r--r--            | empty: file not found | avi avi
  TOMCAT_KEYSTORE      | /home/admin/.keystore                  | true   | rwxr-----             | rwxr-----            | admin admin           | admin admin


Task: Lockbox Passphrase Check
------------------------------

Keystore Passphrase (From Lockbox): changeme


Table: Lockbox/Keystore Passphrase Match
----------------------------------------

          Name         |  Lockbox/Keystore Passphrase
                       |             Match
-----------------------+---------------------------------
  RMI_SSL_KEYSTORE     | false
  AVAMAR_KEYSTORE      | true
  AVINSTALLER_KEYSTORE | false
  TOMCAT_KEYSTORE      | true


Keystore Format (JKS/PKCS12)
----------------------------

          Name         | Format
-----------------------+----------
  RMI_SSL_KEYSTORE     | Unknown
  AVAMAR_KEYSTORE      | PKCS12
  AVINSTALLER_KEYSTORE | Unknown
  TOMCAT_KEYSTORE      | PKCS12


Table: Keystore Alias Check
---------------------------

          Name         |                  Path                  |   Alias   | Exists
-----------------------+----------------------------------------+-----------+---------
  RMI_SSL_KEYSTORE     | /usr/local/avamar/lib/rmi_ssl_keystore | mcssl     | false
  RMI_SSL_KEYSTORE     | /usr/local/avamar/lib/rmi_ssl_keystore | mcjwt     | false
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcecroot  | true
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcectls   | true
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcrsaroot | true
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcrsatls  | true
  AVINSTALLER_KEYSTORE | /usr/local/avamar/lib/avi/avi_keystore | tomcat    | false
  AVINSTALLER_KEYSTORE | /usr/local/avamar/lib/avi/avi_keystore | mcssl     | false
  TOMCAT_KEYSTORE      | /home/admin/.keystore                  | tomcat    | false
  TOMCAT_KEYSTORE      | /home/admin/.keystore                  | mcssl     | true


Summary
-------

*** FAIL *** keystore check-config FAILED OVERALL
PROBLEM: AVINSTALLER_KEYSTORE does not exist
PROBLEM: AVAMAR_KEYSTORE ownership/permissions incorrect
PROBLEM: AVINSTALLER_KEYSTORE ownership/permissions incorrect
PROBLEM: changeme is not the correct passphrase for keystore RMI_SSL_KEYSTORE
PROBLEM: changeme is not the correct passphrase for keystore AVINSTALLER_KEYSTORE
PROBLEM: RMI_SSL_KEYSTORE format unknown, keystore might not be readable or passphrase mismatch
PROBLEM: AVINSTALLER_KEYSTORE format unknown, keystore might not be readable or passphrase mismatch
PROBLEM: mcssl alias does not exist in RMI_SSL_KEYSTORE
PROBLEM: mcjwt alias does not exist in RMI_SSL_KEYSTORE
PROBLEM: tomcat alias does not exist in AVINSTALLER_KEYSTORE
PROBLEM: mcssl alias does not exist in AVINSTALLER_KEYSTORE
PROBLEM: tomcat alias does not exist in TOMCAT_KEYSTORE

在主動/自動修正模式下檢查金鑰存放區組態

root@avamar-rtp:/usr/local/avamar/lib/#: ~admin/goav security keystore check-config --fix
===========================================================
GoAv    :        1.49
Avamar  :        19.4
Date    :        17 Mar 2023 13:32 EDT
===========================================================
COMMAND :  /home/admin/goav security keystore check-config --fix
NOTE: This is not an official tool
===========================================================
Table: Keystore Existence/Permissions Check
-------------------------------------------

          Name         |                  Path                  | Exists |  Current Permissions  | Expected Permissions |   Current Ownership   | Expected Ownership
-----------------------+----------------------------------------+--------+-----------------------+----------------------+-----------------------+---------------------
  RMI_SSL_KEYSTORE     | /usr/local/avamar/lib/rmi_ssl_keystore | true   | rw-rw----             | rw-rw----            | root admin            | root admin
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | true   | rw-rw----             | rw-rw----            | root root             | root admin
  AVINSTALLER_KEYSTORE | /usr/local/avamar/lib/avi/avi_keystore | false  | emtpy: file not found | rw-r--r--            | empty: file not found | avi avi
  TOMCAT_KEYSTORE      | /home/admin/.keystore                  | true   | rwxr-----             | rwxr-----            | admin admin           | admin admin


Task: Lockbox Passphrase Check
------------------------------

Keystore Passphrase (From Lockbox): changeme


Table: Lockbox/Keystore Passphrase Match
----------------------------------------

          Name         |  Lockbox/Keystore Passphrase
                       |             Match
-----------------------+---------------------------------
  RMI_SSL_KEYSTORE     | false
  AVAMAR_KEYSTORE      | true
  AVINSTALLER_KEYSTORE | false
  TOMCAT_KEYSTORE      | true


Keystore Format (JKS/PKCS12)
----------------------------

          Name         | Format
-----------------------+----------
  RMI_SSL_KEYSTORE     | Unknown
  AVAMAR_KEYSTORE      | PKCS12
  AVINSTALLER_KEYSTORE | Unknown
  TOMCAT_KEYSTORE      | PKCS12


Table: Keystore Alias Check
---------------------------

          Name         |                  Path                  |   Alias   | Exists
-----------------------+----------------------------------------+-----------+---------
  RMI_SSL_KEYSTORE     | /usr/local/avamar/lib/rmi_ssl_keystore | mcssl     | false
  RMI_SSL_KEYSTORE     | /usr/local/avamar/lib/rmi_ssl_keystore | mcjwt     | false
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcecroot  | true
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcectls   | true
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcrsaroot | true
  AVAMAR_KEYSTORE      | /usr/local/avamar/lib/avamar_keystore  | mcrsatls  | true
  AVINSTALLER_KEYSTORE | /usr/local/avamar/lib/avi/avi_keystore | tomcat    | false
  AVINSTALLER_KEYSTORE | /usr/local/avamar/lib/avi/avi_keystore | mcssl     | false
  TOMCAT_KEYSTORE      | /home/admin/.keystore                  | tomcat    | false
  TOMCAT_KEYSTORE      | /home/admin/.keystore                  | mcssl     | true


Summary
-------

*** FAIL *** keystore check-config FAILED OVERALL
PROBLEM: AVINSTALLER_KEYSTORE does not exist
PROBLEM: AVAMAR_KEYSTORE ownership/permissions incorrect
PROBLEM: AVINSTALLER_KEYSTORE ownership/permissions incorrect
PROBLEM: changeme is not the correct passphrase for keystore RMI_SSL_KEYSTORE
PROBLEM: changeme is not the correct passphrase for keystore AVINSTALLER_KEYSTORE
PROBLEM: RMI_SSL_KEYSTORE format unknown, keystore might not be readable or passphrase mismatch
PROBLEM: AVINSTALLER_KEYSTORE format unknown, keystore might not be readable or passphrase mismatch
PROBLEM: mcssl alias does not exist in RMI_SSL_KEYSTORE
PROBLEM: mcjwt alias does not exist in RMI_SSL_KEYSTORE
PROBLEM: tomcat alias does not exist in AVINSTALLER_KEYSTORE
PROBLEM: mcssl alias does not exist in AVINSTALLER_KEYSTORE
PROBLEM: tomcat alias does not exist in TOMCAT_KEYSTORE


************************
Task: Auto-Fix Keystores
************************

INFO: Begin fixing any keystore issues...
INFO: Renaming /usr/local/avamar/lib/rmi_ssl_keystore in order to regenerate...
INFO: Renamed /usr/local/avamar/lib/rmi_ssl_keystore to /usr/local/avamar/lib/x-rmi_ssl_keystore.bak
INFO: Renaming /usr/local/avamar/lib/rmi_ssl_keystore in order to regenerate succeeded
INFO: Regenerating RMI_SSL_KEYSTORE
Generating 3,072 bit RSA key pair and self-signed certificate (SHA512withRSA) with a validity of 3,650 days
        for: CN=avamar-rtp, OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US
[Storing /usr/local/avamar/lib/rmi_ssl_keystore]
Generating 3,072 bit RSA key pair and self-signed certificate (SHA512withRSA) with a validity of 3,650 days
        for: CN=avamar-rtp, OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US
Enter key password for <mcjwt>
        (RETURN if same as keystore password):  [Storing /usr/local/avamar/lib/rmi_ssl_keystore]
INFO: RMI_SSL_KEYSTORE Successfully Regenerated
INFO: Please re-import any vcenter certificate if vcenter certificate authentication is used
INFO: RMI_SSL_KEYSTORE Permissions & Ownership Updated


INFO: Regenerating AVINSTALLER_KEYSTORE
Generating 3,072 bit RSA key pair and self-signed certificate (SHA512withRSA) with a validity of 3,650 days
        for: CN=avamar-rtp, OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US
[Storing /usr/local/avamar/lib/avi/avi_keystore]
INFO: AVINSTALLER_KEYSTORE Successfully Regenerated
INFO: AVINSTALLER_KEYSTORE Permissions & Ownership Updated


INFO: Renaming /home/admin/.keystore in order to regenerate...
INFO: Renamed /home/admin/.keystore to /home/admin/x-.keystore.bak
INFO: Renaming /home/admin/.keystore in order to regenerate succeeded
INFO: Regenerating TOMCAT_KEYSTORE
Generating 3,072 bit RSA key pair and self-signed certificate (SHA512withRSA) with a validity of 3,650 days
        for: CN=avamar-rtp, OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US
[Storing /home/admin/.keystore]
INFO: TOMCAT_KEYSTORE Successfully Regenerated
INFO: TOMCAT_KEYSTORE Permissions & Ownership Updated


INFO: Updating mcssl certificate from rmi keystore to tomcat and avi keystore...
INFO: Updating mcssl certificate from rmi keystore to tomcat and avi keystore succeeded
INFO: Restarting MCS   [======>             ]
INFO: Restarting MCS succeeded
INFO: Restarting avinstaller service   [==========>         ]
INFO: Restarting avinstaller service succeeded
INFO: Restarting tomcat service   [                    ]
INFO: Restarting tomcat service succeeded

DONE

受影響的產品

Avamar

文章編號: 000204386

文章類型: How To

上次修改時間: 30 10月 2025

版本: 15

檢查您的裝置是否在支援服務的涵蓋範圍內。

Avamar 19.3+：Goav 安全性金鑰存放區會透過自動修正顯示並檢查金鑰存放區和加密箱的執行狀況

摘要: 使用 Goav 工具顯示金鑰存放區內容，或檢查 Avamar 系統上所有金鑰存放區的健全狀況。

說明

受影響的產品

文章屬性

向其他 Dell 使用者尋求您問題的答案

支援服務

文章屬性

向其他 Dell 使用者尋求您問題的答案

支援服務

Avamar 19.3+：Goav 安全性金鑰存放區會透過自動修正顯示並檢查金鑰存放區和加密箱的執行狀況

摘要: 使用 Goav 工具顯示金鑰存放區內容，或檢查 Avamar 系統上所有金鑰存放區的健全狀況。

詳細文章

說明

受影響的產品

說明

受影響的產品

文章屬性

向其他 Dell 使用者尋求您問題的答案

支援服務

文章屬性

向其他 Dell 使用者尋求您問題的答案

支援服務