MSEO working: from Admin guide
During a write operation, the MSEO driver:
ü Intercepts a NetBackup write request from a media server
ü Sends the request to a MSEO Security Server for evaluation
ü If approved, applies encryption and compression algorithms to the data
ü Passes the data to the tape device, which writes the data to tape. The inverse is true for restoring protected data from a storage medium.
During a read operation, the MSEO driver:
ü Intercepts a NetBackup read request from a media server
ü Sends the request and NetBackup metadata to a MSEO Security Server for evaluation
ü If approved, uses Security Server-supplied keys to decrypt MSEO metadata
Decrypts the tape data
1) the licenses. I saw someone else did mentioned that it requires licenses in pair, is that true?
As per my knowledge you need to purchase MSEO license per server.
2) How the key management of MSEO works, e.g. any way to backup, recover, retire and replicate the keys? For each MSEO host, how many security keys it can handle? For example, we want to restore some data from two years ago which the key different from current encryption key, what I should do?
During restore you need to use the same key on which you have taken backup else you will not be able to restore any data. It always better to have a backup of the keys.
3) My Master backup server is installed with MSEO server & agent is this correct?
You can install MSEO security server and agent on you master, if your tape drives are configured to master else you can configure only security server. You can also use your existing media servers as a security or agent server.
4) What's the minimal hardware requirements for the MSEO deployment?
Need to check, not sure on this.
5) In the current environment we have about 6 TB for weekly full backup data and 1.4 TB daily incremental backup, and attaches a library with two LTO3 drivers. For MSEO, what kind of impact it will have on backup performance? How long it will take to encrypt all the data to the tape?
6) For restore data from the encryption tapes, what the impacts on the restore performance (RTO)?
There is no much impact on the restoration, as it will not going to encrypt complete data only at the starting data blocks a key will be inserted. But if you are going to do any compression then definately it will have effect at the time of backup and also during restores.
7) Speed and encryption type which is better, easier to implement and etc? RSA or AES?
No idea on RSA, we are using AES
8) i have both Netbackup 7.1 and MSEO installed, my backup is running fine but i have no idea how should i go about configuring the MSEO and get it up and running as well. - Everything is configured as default on MSEO do i just check on the "Encryption tab" on my Netbackup and my data will be encrypted in the process?
Until you configure any policy on the security server and MSEO drivers are placed in agent server you will not be able to do any encryption it will be just like a normal backup. Only form this you can read the prior encryption images if you have inserted a proper key in which the key used at the time of backup.
My suggestion if you are configuing this at the first time then its better to log a support case and get it done properly , its very difficult to understand from the guide.
