Defina a frase secreta do sistema no DD usando:
System Passphrase set
Importe o certificado de host signed_host_cert.pem, gerado anteriormente no sistema Data Domain usando:
adminaccess certificate import host application ciphertrust file <host certificate file>
Importe o certificado CA cacert.pem, gerado anteriormente, para o sistema Data Domain:
adminaccess certificate import ca application ciphertrust file cacert.pem
Verifique os certificados usando:
adminaccess certificates show
Ative a criptografia:
filesys encryption enable
Configure o Key Manager como ciphertrust:
filesys encryption key-manager set server <IP Address> port 5696 key-class <key_class> kmip-user <kmip_user> server-type ciphertrust
Habilite o gerenciador de chaves usando:
filesys encryption key-manager enable
Verifique se o gerenciador de chaves está ativado:
filesys encryption key-manager show The current key-manager configuration is: Key Manager: Enabled Server Type: CipherTrust Server: <serverip> Port: 5696 Status: Online Key-class: <key_class> KMIP-user: <kmip_user> Key rotation period: not-configured Last key rotation date: N/A Next key rotation date: N/A
Verifique se a nova chave está ativada.
filesys encryption keys show detailed
Por exemplo:
filesys encryption keys show detailed Active Tier: Key Key State Size Key Manager Min-Cid Max-Cid Id MUID post-comp Type --- ---------------------------------------------------------------- ------------ --------- ----------- ------- ------- 1 3d4 Deactivated 0 DataDomain 759 1096 2 736FB25DF3E52F1D1086AB0AD36650F011FB4A59777A0611993E28F1E87A972A Activated-RW 65.45 TiB KeySecure 1097 - --- ---------------------------------------------------------------- ------------ --------- ----------- ------- -------
O DDOS oferece uma CLI para garantir uma transição tranquila do KeySecure para o CipherTrust. O cliente deve primeiro mover as chaves de um servidor do gerenciador de chaves para outro antes de usar essa CLI para migrar no DD.
Para migrar chaves no lado do DD, emitimos a CLI migrate.
filesys encryption key-manager keys migrate source <> destination <>
Por exemplo:
filesys encryption key-manager keys migrate source keysecure destination ciphertrust Migrating keys from keysecure to ciphertrust key manager. Do you want to proceed? (yes|no) [no]: yes Migrated keys to ciphertrust key manager.
Verifique se as chaves são migradas no DD, execute o seguinte comando e verifique o campo key manager type.
filesys encryption keys show detailed
Por exemplo:
Active Tier: Key Key State Size Key Manager Min-Cid Max-Cid Id MUID post-comp Type --- ---------------------------------------------------------------- ------------ --------- ----------- ------- ------- 1 3d4 Deactivated 0 DataDomain 759 1096 2 736FB25DF3E52F1D1086AB0AD36650F011FB4A59777A0611993E28F1E87A972A Activated-RW 65.45 TiB CipherTrust 1097 - --- ---------------------------------------------------------------- ------------ --------- ----------- ------- -------