Forum Discussion

Bruce_Clegg's avatar
Bruce_Clegg
Level 5
7 years ago

transferring encryption license

I'm well into my project to set up netbackup 8.0 on a new media server.  The next issue is encryption.  We have licenses to encrypt a few of the servers.  My question is: Where can I find these lice...
Linux
  • andrew_mcc1's avatar
    andrew_mcc1
    7 years ago
    Well if the policy encryption checkbox is greyed out for no obvious reason I would still suggest trying the working license key on the new master server. I understand client encryption is included in version 6.5 and later licences but it still may need the key "feature" to run.
    To check, just copy and paste the license string via Admin Console> Help Licences. Obviously only run with the correct key in production. BR Andrew
Marianne's avatar
Marianne
Level 6
7 years ago
Neither NBU Client-based encryption nor KMS is licensed. These options are free.

Your issue is the encryption keys. You need to know which type of encryption you are using and how to export them.

NBU client encryption is selected in policy attributes. KMS writes to tape pool(s) starting with ENCR in the name.

Please see mph999 's reply in this post:

https://vox.veritas.com/t5/NetBackup/Encryption-On-tape-Drive/m-p/838220
  • Bruce_Clegg's avatar
    Bruce_Clegg
    Level 5
    7 years ago

    Reading through the options in the documentation is good.  I could probably set up a new system, but I'm worried about breaking what has been working on the 'old' 7.7 platform.  Right now I don't understand exactly what my predessessors put in place encryption wise on the old platform.  I appreciate your patience as I go through the process here...

    I want to encrypt the backups for a single policy - but on the new platform the option on the policy to encrypt the backup is greyed out.  I'm calling up the old encryption keys from the offsite vault.  When they get here, will I be able to use them to 'un-grey' the option on the policy?  If so, how?  I suspect I could create new keys too, but I'm not sure if this will 'break' the encrypted archive tapes I've already got from the old 7.7 installation.

    I suspect I'm making this harder than it is - but as I said - I'm being careful.

    • Marianne's avatar
      Marianne
      Level 6
      7 years ago

      So, it seems you are using Client encryption in your environment?

      If so, please go through this TN:  

      More about the NetBackup Encryption Option - detailed demonstration of encrypted backups
      https://www.veritas.com/support/en_US/article.TECH56759

      The TN is VERY old, so please ignore refence to license key (free as from 6.5) and bpinst (no longer separate install).

      Start reading here:
      Encryption will need to be enabled on the client through its Host Properties

      If you scroll down, you will see how to backup the keyfile.dat on the client. 
      This is what you need to transfer the key to a new/alternate client for restores.

      HTH

       

       

      • Bruce_Clegg's avatar
        Bruce_Clegg
        Level 5
        7 years ago

        I am not sure if we're using Client encryption or not.  I do appreciate all the help you've been providing. 

        I have access to the 7.7 media server and there are no keyfile.dat files at all on it.  If I look at the client properties of the client and it shows a checkmark in front of Enable Encryption.  The unencrypted clients don't have this checkmark.

        I go to the new 8.0 media server and look up the client and I am able to check Enable Encryption. 

        But I'm still not able to choose the encrypt option on the policy attributes - greyed out.  Did I miss something in the document you recommended I read?

        I'm not following this:  The NetBackup Encryption Option is located on the "UNIX Options" media (UNIX) and is automatically included in the NetBackup installation (Windows).  A valid license key is required to enable functionality. 

        Where do I access the UNIX Options?  And how do I use the license key to enable the functionality? 

        There are encryption license keys on the 7.7 Media Server labled Encryption, Encrypttion (Legacy DES 56-bit, and Encryption (Legacy DES 40-bit) - The new server does not have these.  I see I can export a license key - Do I need to learn how to import the key in order for this to work?

         

        And finally:

        We're only encrypting the backups on 2 clients - I'm a bit concerned because the bp.conf on each of them is different.  The production database client is using CRYPT_KIND = STANDARD (from bp.conf) - the pre-production database client has:

        CRYPT_KIND = LEGACY
        CRYPT_OPTION = REQUIRED
        CRYPT_KEYFILE = XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XX
        CRYPT_STRENGTH = DES_56

        I suppose this is fine - but I'd like them to both be the same. What are the issues if I change them both to legacy or standard on the new media server?