Integrated Software for ZFS ZS3-x Arrays
 
Integrated Software for ZFS 7xx0 Arrays
 
Integrated Software for ZFS ZS5-x Arrays
 
Integrated Software for ZFS ZS4-x Arrays
 

PLA-Support>Sun Systems>DISK>ZFS Storage>SN-DK: ZS
 

This document will describe how to use local keys to encrypt shares on your ZFSSA.
How to backup your keys and various trouble shooting techniques related to local encryption keys.

In this Document

Goal

Solution

To configure the ZFS appliance you can use either the BUI or CLI

References

Applies to:

Goal

 Assist in configuration of ZFSSA for using local encryption keys.

Solution

 To configure the ZFS appliance you can use either the BUI or CLI

From the CLI go to:
shares -> encryption -> local

You must set a master pass phrase 8 characters or longer.

The master passphrase is used to generate an AES key for encrypting the keys stored in the LOCAL keystore.

The PKCS#5 PBKDF algorithm is used to generate the key, and is randomly generated and managed by the system.

You will see the following error when trying to create keys with out the master_passphrase set.

To set the Master PassPhrase from the BUI click on Shares -> encryption -> Local

Fill out the Master Passphrase fields and click apply button.

Now you local keystore is configured and you can create keys.

From the CLI go to shares -> encryption -> local -> keys -> create

From there you set the keyname property and you can leave the key property blank and a new key will be created.

To create a key in the BUI click on Shares then encryption then local then click the + sign to add a new key.

Fill out the key name and leave the generate key box checked.

You will see your new key created and the creation date of the key.

You can now create a share using your new key to encrypt that share.

To ensure encrypted shares and projects are accessible, backup your appliance configurations and LOCAL keystore key values.

If a key or keys become unavailable any shares or projects that use those keys become inaccessible. If a project's key is unavailable, new shares cannot be created in that project.

Keys can become unavailable in the following ways:

• Keys are deleted
• Roll back to a release that does not support encryption
• Roll back to a release where the keys are not configured
• Factory reset
• The OKM server is not available (OKM keys)

You will want to back up any keys you have created and used to encrypt shares/projects with.

From the CLI go to shares -> encryption -> local -> keys and select your key and then show.

Use what ever method needed to copy the below 256 Bit key to a safe place.

From the BUI click on Shares then ecryption then local the click the Pencil icon on your key line.

Use what ever method needed to copy the below 256 Bit key to a safe place.

To restore a LOCAL key that was deleted, create a new LOCAL key with the same keyname and value as the deleted key.

You must have first recorded, or backed up, this information before the key was deleted.

Now about the stash object:

There is a stash object for OKM encryption, it is located at /var/ak/stash/com/sun/ak/xmlrpc/keystore/

You will need to determine which is your OKM stash as SFTP, Local and other encryption keystores are here.

You can use the down and dirty aknv -r like below to quickly find the OKM stash object.

# aknv -r */obj | grep LOCAL
9bff4caa-7072-41d6-e1e2-f3f83e7891ec/obj: name = LOCAL
9bff4caa-7072-41d6-e1e2-f3f83e7891ec/obj: path = /var/ak/keystores/LOCAL

From the raw command line you can view the key and master_passphrase with the following commands:

zs4-4:raw> keystore.getKeys('LOCAL')
result = [{
expire: Thu Jan 01 1970 00:00:00 GMT+0000 (UTC),
modified: Fri Jul 28 2017 19:42:40 GMT+0000 (UTC),
keyname: 'BOB-KEY',
comment: '',
cipher: 'AES',
user: '',
key: '60be63ec479a0dba026f6e97bf2d2e7db84cc5a340cbdbb89bb7078e7f0b2283'
}]

zs4-4:raw> keystore.getProfile('LOCAL')
result = {
ciphers: ['AES'],
format: 'local',
type: 2
}

zs4-4-brm06-a-0:raw> keystore.getConfigProps("LOCAL")
result = {
master_passphrase: 'xxxxxxxxxx'
}

References

This solution has no attachment