Best method to encrypt AIX LTO6 tape backups? Post: 303002296

Sponsored Content

Operating Systems AIX Best method to encrypt AIX LTO6 tape backups? Post 303002296 by c3rb3rus on Monday 21st of August 2017 05:12:53 PM

08-21-2017

Registered User

Best method to encrypt AIX LTO6 tape backups?

Hello,

I need to be able to encrypt LTO tapes that our AIX writes to for backups.

We have a tape library (IBM TS3100) that our AIX host uses to write to LTO6 tapes. We then take those tapes off-site and restore to another AIX system using a 3580-H6S LTO6 tape drive - this is a very simple environment (single AIX host with a tape library/drive directly attached).

I know that the TS3100 has capabilities to encrypt the tapes that we can activate in the web interface of the tape library - however since we need to restore using a 3580-H6S tape drive I don't think this will work.

So from my research it looks like we need to leverage application managed encryption (AME) as this is the only supported form of encryption on the 3580-H6S. It appears we need IBM Security Key Lifecycle Manager (ISKLM) but what I am failing to understand is how all this ties in together. If I install the ISKLM on Windows - do I update the driver configuration on AIX to poll ISKLM for encryption keys (which I would think would be transparent to the backup application as its being done at the driver level). There seems to be a lot of information on various products to make this work and I am just not getting it.

My goal is to encrypt the data offloaded to LTO6 tapes and to make it transparent to the backup application running within AIX (lets assume this is a shell script/wrapper around the tar command).

If anyone could point me to the right direction that would be great.

Last edited by c3rb3rus; 08-21-2017 at 06:54 PM..

c3rb3rus

View Public Profile for c3rb3rus

Find all posts by c3rb3rus

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Multiple backups on one tape

For those with backup tapes (and I just bought and installed a Seagate one for my FreeBSD box) I want to know how to get the most out of each tape by placing multiple backups on each tape (potentially 20GB). Please correct me if I'm wrong: First, retension the tape: # mt retension next, turn...

2. AIX

backups getting it so the tape doesn't rew.

Currently am running the backup command for AIX 5L and see that the tape is rewinding after the completion of the back. backup -0 -u -f /dev/rmt0 / >> $file 2>&1 What can I do to stop allow the backup to rew after the completion of this job? Any thoughts? Thanks again.

3. UNIX for Dummies Questions & Answers

verifying tape backups

Hello all, how would i go about verifying that a tape is backing up data correctly other than restoring the backup. for example, what command would i use to check the tape for errors? Any and all help is appreciated -Coffee

4. Filesystems, Disks and Memory

Tape drives used for taking backups

Hi, I am a abit new in AIX system administration field. I want to gather knowledge about backup techniques. As per my knowledge we use Tape archives for taking backups. Can anyone pls explain me in detail abt tape archive? Whether these tape archives come along with the systems or we have to...

5. Solaris

Remote Backups to a Tape

My tape library is broken but backups still need to go on .I have 2 boxes running Solaris 10 Got SCSI tape drive attached to the DEV box ( my PROD Box has only fibre) I want to take the prod backup from the DEV box using ufsdump. ie /usr/sbin/ufsdump 0uvf DEV:/dev/rmt/1n...

6. AIX

How to optimize our tape backups ?

Hi, I am currently looking at how we can optimize and speed up our backups here. I am just a beginner operator and our system admin hardly knows anything (long term interim). There is this particular TAR backup of DB backups that for a 10.5Gb amount of files, it takes 5 hours to do the backup on...

7. AIX

Tape backups: do you always verify them after doing them ?

It may seam a bit odd that I ask this question. After you have done your backups to tapes, do you verify the content of the tapes ? - never - sometimes - always The reason I am asking is that here in the office, all the backup procedures include verifying the content of the tapes (no...

8. UNIX for Dummies Questions & Answers

Question about a tape write error doing backups

Hello all. UNIX dummy here :p Anyway I was trying to do a full backup of my work server SUN SPARC SERVER 1000 machine (yes we are actually using this dinosaur). I did the ufsdump comand and everything was fine until I got to the dumping of regular files. During the run I got the following...

9. SCO

SCO tape backups won't restore in Ubuntu Linux environment

Hello folks. I have the following problem: I'm trying to create a tape backup of a list of files on a 10 year old server, running SCO Openserver 5.0.5 (the tape drive is a Seagate STD224000N, connected as a SCSI drive). I then want to restore the contents of this tape onto a new server...

10. AIX

Ejecting tape on AIX & Some Tape commands

I am trying to use this command to eject the tape mt -f /dev/rmt/0 unload but it gives me error mt -f /dev/rmt/0 unload mt: 0511-575 unload is not a recognized subcommand. Usage: mt Subcommand Valid subcommands are: weof eof fsf bsf ...

LEARN ABOUT HPUX

st

st(1M)																	    st(1M)

NAME

       st - shared tape administration

SYNOPSIS

       device_file

DESCRIPTION

       The  command  provides  users  with a command-line interface to check the status of a shared tape device or to reclaim a shared tape device
       from a host system that has failed while holding a reservation on the shared tape device.  The command can also be used for the	same  pur-
       pose on shared library robotic devices.	To use the command you must have root user id.

       Please see examples below for usage.

   Options
       recognizes the following options and arguments:

       Specifies the tape device file or sctl/esctl pass-through device
		      file for the shared tape/library device. This parameter is mandatory and will report an error if device_file is omitted.

       Allows the user to reclaim a shared tape device or shared
		      library robotic device in the case where a host failed while holding a reservation on the shared device.	This option causes
		      a bus device reset to be issued to the device specified by the option.

       Prints out the current status of the shared tape/library
		      device specified by the option.

RETURN VALUE

       returns 0 upon successful completion and 1 otherwise.

EXAMPLES

       The following shows three examples of output from the above command.

       The above output indicates that the shared device is reserved by another host and is therefore unavailable at this time.

       The above output indicates that the shared device is not ready for use at this time.

       The above output indicates that the shared device is ready for use at this time.

       To reclaim a shared tape/library device from a failed host, the following command can be used:

WARNINGS

       The option must be used with care. When reclaiming devices, it must be ensured that the host from which the device is being  reclaimed  has
       in fact failed, as data may be lost as the result of reclaiming a device that is currently in use by another host.

AUTHOR

       was developed by Hewlett-Packard.

SEE ALSO

       mt(1), scsi(7), scsi_ctl(7).

																	    st(1M)