Forum Discussion

MikeSB's avatar
MikeSB
Level 3
13 years ago

Verify KMS Encryption NetBackup 7.5

I hope this helps others, I just spent the last 2 weeks searching around trying to find this answer.

Here are steps to verify KMS encryption on tapes with NetBackup 7.5;
Find the jobs on a particular tape you think may be encrypted;
/usr/openv/netbackup/bin/admincmd/bpimmedia -L -mediaid <media name>
get the "Backup-ID" in the first column
then run;
/usr/openv/netbackup/bin/admincmd/bpimagelist -backupid <Backup-ID> -L | grep "Flags:"
if tape is encrypted with KMS this will display;
" Flags: 0x40 (Tape Encrypted)"
and if tape is NOT encrypted this will display;
" Flags: 0x0"

7.5
Backing Up
Backup and Recovery
Best Practice
Configuring
NetBackup
Restore
Tip-How to
  • CRZ's avatar
    CRZ
    13 years ago

    Hi Mike,

    I JUST learned there's a defect in bpimmedia which you might be hitting.  This entry is in the 7.5.0.4 Release Notes (page 48):

    Etrack Incident: 2826378
    ■ Description:
    A missing Key Management Server tag in the bpimmedia output has been added.

    NetBackup 7.5.0.4 Release Notes
     http://symantec.com/docs/DOC5514

    Is there any chance you could apply 7.5.0.4?  (If not, there may be an EEB available under Etrack 2793446 depending on which version you're at.)  I believe your "0" will change to a real tag after that, which would make a little more sense, now that I think about it...

  • Mark_Solutions's avatar
    Mark_Solutions
    Level 6
    13 years ago

    Many tape libraries also detect the encryption via the firmware and when you view the media in the tape library web GUI it also reports which tapes are encrypted

    Hope this also helps

  • MikeSB's avatar
    MikeSB
    Level 3
    13 years ago

    Chris,

    This is what took me 2 weeks to wade through, and in the TechNote (TECH127166) you provided .

    OPTION 1 Was not great (Since I had the KeyGroup / Key / Pool and Policy all called ENCR_tmp), until I looked further down in the output from "bpimagelist" command and seen the light.

    OPTION 2 shows me "0" for the "Encryption Key Tag" in the GUI, this is what made it so difficult to track down.

    OPTION 3 I had also found a different TechNote that had a different suggestion of removing the Key and try the restore, but again the TechNote had notes saying output should look like this "blah..blah..blah.., and that is not what I see :-(

    and as far as HOWTO46852 again it points me to OPTION 2 above :-(

    and of course pages 324-325 from the Encryption Guide are the same as OPTION 2 above.

    Are you seeing why it took me 2 weeks to track this down.. to verify.

    Regards,

    Mike.

  • MikeSB's avatar
    MikeSB
    Level 3
    13 years ago

    Mark,

    Thanks for the feedback.. as you say "Many tape libraries" detect encryption, mine does not fall into the Many catagory.

    Regards,

    Mike

  • CRZ's avatar
    CRZ
    Level 6
    13 years ago

    Thanks for that very valuable feedback, Mike!  I'll have to see if we can incorporate your information into our documentation (or at least a TechNote) and try to save other folks a couple weeks.

  • CRZ's avatar
    CRZ
    Level 6
    13 years ago

    Hi Mike,

    I JUST learned there's a defect in bpimmedia which you might be hitting.  This entry is in the 7.5.0.4 Release Notes (page 48):

    Etrack Incident: 2826378
    ■ Description:
    A missing Key Management Server tag in the bpimmedia output has been added.

    NetBackup 7.5.0.4 Release Notes
     http://symantec.com/docs/DOC5514

    Is there any chance you could apply 7.5.0.4?  (If not, there may be an EEB available under Etrack 2793446 depending on which version you're at.)  I believe your "0" will change to a real tag after that, which would make a little more sense, now that I think about it...

  • MikeSB's avatar
    MikeSB
    Level 3
    13 years ago

    Chris,

    Where do I download patch releases to apply this, I can only see the 7.5 Base in the Software download area?

    When I get access to the patch, I will apply this today and test it.

    Mike