Integrated Dell Remote Access Controller 9 User's Guide

The following are the SEKM functionalities available in iDRAC:

1. SEKM Key Purge Policy—iDRAC provides a policy setting that allows you to configure iDRAC to purge old unused keys at the Key Management Server (KMS) when Rekey operation is performed. You can set the iDRAC read-writable attribute KMSKeyPurgePolicy to one of the following values:
   • Keep All Keys – This is the default setting and is the existing behavior where iDRAC leaves all the keys on the KMS untouched while performing Rekey operation.
   • Keep N and N-1 keys – iDRAC deletes all keys at the KMS except the current (N) and previous key (N-1) when performing Rekey operation.
2. KMS Key Purge on SEKM Disable—As part of the Secure Enterprise Key Manager (SEKM) solution, iDRAC allows you to disable SEKM on the iDRAC. Once SEKM is disabled, the keys that are generated by iDRAC at the KMS are unused and remain at the KMS. This feature is for allowing iDRAC to delete those keys when SEKM is disabled. iDRAC provides a new option “-purgeKMSKeys” to existing legacy command “racadm sekm disable” which will let you purge keys at the KMS when SEKM is disabled on iDRAC.
   NOTE:If SEKM is already disabled and you want to purge old keys, you must re-enable SEKM, then disable passing in option -purgeKMSKeys.
3. Key Creation Policy—As part of this release, iDRAC has been preconfigured with a Key Creation Policy. Attribute KeyCreationPolicy is read-only and set to "Key per iDRAC" value.
   • iDRAC read-only attribute iDRAC.SEKM.KeyIdentifierN reports the Key Identifier that is created by the KMS.

     racadm get iDRAC.SEKM.KeyIdentifierN

   • iDRAC read-only attribute iDRAC.SEKM.KeyIdentifierNMinusOne reports the previous Key Identifier after performing a Rekey operation.

     racadm get iDRAC.SEKM.KeyIdentifierNMinusOne

4. SEKM Rekey—iDRAC provides the following two options from the UI to rekey your SEKM solution, either Rekey iDRAC or PERC. It is recommended to rekey the iDRAC since this rekeys all SEKM Secure capable and enabled devices.
   • SEKM iDRAC Rekey [ Rekey on iDRAC.Embedded.1 FQDD ]—When performing racadm sekm rekey iDRAC.Embedded.1 , all SEKM Secure capable/Enabled devices are Rekeyed with a new key from KMS and this is common key to all SEKM enabled devices. iDRAC Rekey operation can also be performed from iDRAC UI- iDRAC Settings > Services > SEKM Configuration > Rekey. After performing this operation, the change in the Key can be validated by reading KeyIdentifierN and KeyIdentifierNMinusOne attributes.
   • SEKM PERC Rekey ( Rekey On Controller [ Example RAID.Slot.1-1 ] FQDD )—When performing racadm sekm rekey <controller FQDD>, the corresponding SEKM enabled controller gets rekeyed to the currently active iDRAC common key created from KMS. Storage Controller Rekey operation can also be performed from iDRAC UI- Storage > Controllers > <controller FQDD> > Actions > Edit > Security > Security(Encryption) > Rekey.
     NOTE:When you run Rekey on PERC while the controller and iDRAC keys are in sync, you may get a config job failure, or configuration job may succeed but the key is not changed when you run the job. You can use iDRAC Rekey option to fix this issue.
5. SEKM Rekey only from Redfish: The following two SEKM Rekey options are supported from Redfish:
   • SEKM iDRAC Schedule Rekey—Sends a new key generation request from iDRAC for automatic change of the SEKM keys based on a recurrence interval that is configured by the user.
   • SEKM iDRAC Periodic Sync with Key Management Server (KMS)—Enables automatic change of the SEKM keys based on the recurrence interval configured on the KMS Server. iDRAC polls for any new key that is generated by the KMS server.

For detailed information about all supported SEKM features and deployment workflow, see the white paper - Enable OpenManage Secure Enterprise Key Manager (SEKM) on Dell PowerEdge Servers