08-21-2017
Best method to encrypt AIX LTO6 tape backups?
Hello,
I need to be able to encrypt LTO tapes that our AIX writes to for backups.
We have a tape library (IBM TS3100) that our AIX host uses to write to LTO6 tapes. We then take those tapes off-site and restore to another AIX system using a 3580-H6S LTO6 tape drive - this is a very simple environment (single AIX host with a tape library/drive directly attached).
I know that the TS3100 has capabilities to encrypt the tapes that we can activate in the web interface of the tape library - however since we need to restore using a 3580-H6S tape drive I don't think this will work.
So from my research it looks like we need to leverage application managed encryption (AME) as this is the only supported form of encryption on the 3580-H6S. It appears we need IBM Security Key Lifecycle Manager (ISKLM) but what I am failing to understand is how all this ties in together. If I install the ISKLM on Windows - do I update the driver configuration on AIX to poll ISKLM for encryption keys (which I would think would be transparent to the backup application as its being done at the driver level). There seems to be a lot of information on various products to make this work and I am just not getting it.
My goal is to encrypt the data offloaded to LTO6 tapes and to make it transparent to the backup application running within AIX (lets assume this is a shell script/wrapper around the tar command).
If anyone could point me to the right direction that would be great.
Last edited by c3rb3rus; 08-21-2017 at 06:54 PM..
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
For those with backup tapes (and I just bought and installed a Seagate one for my FreeBSD box) I want to know how to get the most out of each tape by placing multiple backups on each tape (potentially 20GB). Please correct me if I'm wrong:
First, retension the tape:
# mt retension
next, turn... (3 Replies)
Discussion started by: WIntellect
3 Replies
2. AIX
Currently am running the backup command for AIX 5L and see that the tape is rewinding after the completion of the back.
backup -0 -u -f /dev/rmt0 / >> $file 2>&1
What can I do to stop allow the backup to rew after the completion of this job? Any thoughts?
Thanks again. (2 Replies)
Discussion started by: justinburbridge
2 Replies
3. UNIX for Dummies Questions & Answers
Hello all, how would i go about verifying that a tape is backing up data correctly other than restoring the backup. for example, what command would i use to check the tape for errors? Any and all help is appreciated
-Coffee (0 Replies)
Discussion started by: coffeebrown
0 Replies
4. Filesystems, Disks and Memory
Hi,
I am a abit new in AIX system administration field. I want to gather knowledge about backup techniques. As per my knowledge we use Tape archives for taking backups. Can anyone pls explain me in detail abt tape archive? Whether these tape archives come along with the systems or we have to... (1 Reply)
Discussion started by: forumsrahul
1 Replies
5. Solaris
My tape library is broken but backups still need to go on .I have 2 boxes running Solaris 10
Got SCSI tape drive attached to the DEV box ( my PROD Box has only fibre)
I want to take the prod backup from the DEV box using ufsdump. ie
/usr/sbin/ufsdump 0uvf DEV:/dev/rmt/1n... (2 Replies)
Discussion started by: Msororaji
2 Replies
6. AIX
Hi, I am currently looking at how we can optimize and speed up our backups here. I am just a beginner operator and our system admin hardly knows anything (long term interim).
There is this particular TAR backup of DB backups that for a 10.5Gb amount of files, it takes 5 hours to do the backup on... (6 Replies)
Discussion started by: Browser_ice
6 Replies
7. AIX
It may seam a bit odd that I ask this question.
After you have done your backups to tapes, do you verify the content of the tapes ?
- never
- sometimes
- always
The reason I am asking is that here in the office, all the backup procedures include verifying the content of the tapes (no... (5 Replies)
Discussion started by: Browser_ice
5 Replies
8. UNIX for Dummies Questions & Answers
Hello all. UNIX dummy here :p
Anyway I was trying to do a full backup of my work server SUN SPARC SERVER 1000 machine (yes we are actually using this dinosaur). I did the ufsdump comand and everything was fine until I got to the dumping of regular files. During the run I got the following... (7 Replies)
Discussion started by: hammerva
7 Replies
9. SCO
Hello folks. I have the following problem:
I'm trying to create a tape backup of a list of files on a 10 year old server, running SCO Openserver 5.0.5 (the tape drive is a Seagate STD224000N, connected as a SCSI drive).
I then want to restore the contents of this tape onto a new server... (6 Replies)
Discussion started by: klabelkholosh
6 Replies
10. AIX
I am trying to use this command to eject the tape
mt -f /dev/rmt/0 unload
but it gives me error
mt -f /dev/rmt/0 unload
mt: 0511-575 unload is not a recognized subcommand.
Usage: mt Subcommand
Valid subcommands are:
weof
eof
fsf
bsf
... (5 Replies)
Discussion started by: filosophizer
5 Replies
LEARN ABOUT REDHAT
amflush
AMFLUSH(8) System Manager's Manual AMFLUSH(8)
NAME
amflush - flush Amanda backup files from holding disk to tape
SYNOPSIS
amflush [ -f ] [ -D datestamp ]* config [ host [ disk ]* ]*
DESCRIPTION
Amflush writes Amanda backups from the holding disks to tape, and updates the Amanda info database and tape list accordingly. Backups may
stay in a holding disk when something is wrong with the tape at the time amdump is run. When this happens, the problem must be corrected
and amflush run by hand.
-D datestamp specify a datestamp expression you want to flush, see the "DATASTAMP EXPRESSION" section of amanda(8) for a description. -D
20001225-7 will flush all dump from 25 december 2000 to 27 december 2000.
You can specify many host/disk expressions, only disks that match an expression will be flushed. All disk are flushed if no expression are
given. see the "HOST & DISK EXPRESSION" section of amanda(8) for a description.
Amflush will look in the holding disks specified by the amanda.conf file in /etc/amanda/config for any non-empty Amanda work directories.
It then prompts you to select a directory or to process all of the directories. The work directories in the holding disks are named by the
date at the time amdump was run, e.g. 19910215.
Amflush normally detaches itself from the tty and runs as a background process. With the -f option, amflush stays in the foreground. This
is useful if amflush is run as part of another script that, for example, advances the tape after the flush is completed.
See the amanda(8) man page for more details about Amanda.
EXAMPLE
Amflush will search for holding areas associated with the PUCC configuration. After you select which holding area to flush, amflush writes
the data to tape, updates the databases and sends a mail report similar to amdump(8).
% amflush DailySet1
Scanning /amanda-hold...
20001113: found Amanda directory.
20001114: found Amanda directory.
Multiple Amanda directories, please pick one by letter:
A. 20001113
B. 20001114
Select directories to flush [A..B]: [ALL] all
Flushing dumps in 20001113, 20001114,
today: 20001117
to tape drive /dev/rmt/0mn.
Expecting tape DMP014 or a new tape. (The last dumps were to tape DMP013)
Are you sure you want to do this? yes
Running in background, you can log off now.
You'll get mail when amflush is finished.
AUTHOR
James da Silva <jds@cs.umd.edu>
University of Maryland, College Park
SEE ALSO
amanda(8), amdump(8)
AMFLUSH(8)