8.4.4 TPM Usage
The Trusted Program Module (TPM) is a small hardware device available on most servers. If a TPM is installed and enabled on the server hosting ICDES, the Command Line Interface (CLI) spxconfig options can be run from Windows PowerShell. There are several configuration commands:
spxconfig –tpm
spxconfig –tpm ‘on/off’
spxconfig –tpm_pass ‘password’ spxconfig –validate_tpm
*The values in single quotes are placeholders and do not correspond to any valid value.
Windows Server 2008 and Windows Server 2012 have a built-in feature to administer a TPM.
A TPM cannot be used for the Master Key when using ICDES in a Guest OS on a VM.
Additional Administrative Procedures
8.5
For more on how to operate and manage ICDES, please refer to “Appendix I: Administrative Procedures”, which provides detailed descriptions of all the essential supported features and operations of ICDES.
IBM Cloud Data Encryption Services Administrative Guide 38
9 Uninstallation
Uninstalling IBM Cloud Data Encryption Services
9.1
As an Administrator on the machine where ICDES is installed locally, ICDES can be removed via the Program and Features list in the Control Panel, or running the uninstall process in command line.
Run the command msiexec /x <file path to installer file>, which will:
• Prompt for any protected directories to be decrypted
− If any directories are still encrypted, the uninstallation will not proceed
• Clean all processed files of OSR header information
• Remove ICDES software from the system
Provided in “Appendix I: Administrative Procedures” is an example of the process of performing a backup and recovery of an ICDES installation.
Attention
The uninstall process requires prior planning. The length of time to complete the uninstall process varies with the amount of data that has been processed through ICDES and environment.
IBM Cloud Data Encryption Services Administrative Guide 39
10 Frequently Asked Questions (FAQ)
The Frequently Asked Questions for ICDES is included with the product documentation and available on the support site:
IBM Cloud Data Encryption Services Administrative Guide 40
Appendix I: Administrative Procedures
1. Determining Licensing Differences M:N
2. Prerequisite Checklist
3. Employ Logging
4. Using Backup and Recovery
5. Performing Daily Operation and Maintenance
6. Setting Operational Limits (memory and disk usage for journaling)
7. Viewing Protected Directories (stubs) for Filenames
8. Setting Disk Space Alert Thresholds
9. Rebuilding a Share
10. Adjusting Share Read Order
11. Taking a Share Offline/Online
IBM Cloud Data Encryption Services Administrative Guide 41
1
Determining Licensing Differences M:N
Goal:
To determine the right level of M:N, per the Model purchased, depending on the user’s requirements.
Triggers (to start this case):
1. Administrative user wants to evaluate ICDES software
Administrative user wants to make sure that the model for an already purchased license will match the M:N for which they will need to operate.
Pre-conditions: None
Main Success Scenario:
1. Compile the user’s requirements for systems and shares to be protected. 2. Compile the user’s requirements on shares to be involved in splitting. 3. Select the model as below:
Model SEC Encryption with no fault tolerance Model ADV Encryption with High Availability (HA
Model AMS Encryption with Multi-Site Disaster Recovery (DR)
4. Determine to use data splitting plus encryption (Model SEC, ADV or AMS), per licensed system.
5. Determine the amount of High Availability needed, with an M:N either 2:3, 2:4, 3:4, or 4:6. 6. Determine the amount of Disaster Recovery needed, with an M:N either 2:6 or 3:8.
7. M:N is defined in the Overview, as the number of shares (M) needed to restore the data, out of the total number of shares (N). For the Model, select the appropriate M:N, based on whether fault tolerance or high availability is needed.
M:N Model SEC-- 1:1 or 4:4 (default 1:1) M:N Model ADV-- 2:3, 2:4, 3:4 or 4:6 (default 3:4) M:N Model AMS-- 2:6 or 3:8 (default 3:8)
For example, a 3:4 means that 3 of the 4 shares are needed to reconstruct the data. If one share goes bad, then the share is taken offline and the remaining system operates as normal, while the bad share is reconstructed by the administrator.
8. Determine location of primary and DR sites, and the amount of server shares as per license (N from above M:N)
IBM Cloud Data Encryption Services Administrative Guide 42 9. Determine and decide M:N value
10. Obtain and pick the license that corresponds to Model SEC, ADV or AMS, where M:N is a possible value within the Model.
11. M:N is determined.
Supporting Information: None
Extension Scenarios: None
Expected Outcome (after case complete):
IBM Cloud Data Encryption Services Administrative Guide 43
2
Prerequisite Checklist
This checklist is provided for convenience during installation of the product.
Key Management Local KMIP TPM
License Key M of N Configuration (M:N)
Share Location, Read Order, Encrypt Filename
IBM Cloud Data Encryption Services Administrative Guide 44
3
Employ Logging
Goal:
To view and analyze logging and alerts for daily operation. Triggers (to start this case):
The administrative user is required to analyze and view logs during normal daily operation. Pre-conditions:
ICDESneeds to be installed and operational. Main Success Scenario:
1. The user needs to have a list of logs that are currently displaying data during operation. The list is as follows:
• service • alert • gui • restore
2. Do: spxlog –‘logname’ 3. Do: spxlog –‘logname’ -n #
The -display option will display the last 20 lines of each log. Adding -n will display the last # lines of the log
4. Do: spxlog –‘logname’ -clear
Clears all log files of all entries and will need to be confirmed.
Extension Scenarios: None
Expected Outcome (after case complete): View and manage ICDESlog files.
IBM Cloud Data Encryption Services Administrative Guide 45
4
Using Backup and Recovery
Goal:
To utilize backup solutions as a best practice to insure against data loss due to a catastrophic disruption while utilizing ICDES.
Triggers (to start this case):
To enable the ability to backup data that has been lost because of a catastrophic disruption or accidental deletion of a large percentage of data.
Pre-conditions:
ICDES installed and all the shares configured and backup and disaster recovery plan implemented.
Main Success Scenario: Backup
1. Periodically backup ICDES workgroup keys and configuration. Do: spxbackup <destination path desired for backup>
2. Perform scheduled backup of at least ‘M’ shares in accordance with your backup and disaster recovery plan.
Extension Scenarios: Restore
1a. Restore the configuration and keys to the new system.
Do: spxreload <destination path of backup configuration> 2a. Perform a restore of backup share data to the shares.
3a. Restore the protected directory stubs. Do: spxrestore –stub
4a. Restore the remaining N shares. Do: spxrestore –all
Expected Outcome (after case complete): Data that has been lost is restored.
IBM Cloud Data Encryption Services Administrative Guide 46
5
Performing Daily Operation and Maintenance
Goal:
To perform daily activities to ensure operation and reliability of protected data. Triggers (to start this case):
The administrative user is required to perform daily tasks that ensure that protected data continues to be managed and safe.
Pre-conditions:
ICDES needs to be installed and operational. Shares need to be defined, and at least one directory (and subdirectories) need(s) to be protected.
Main Success Scenario: 1. Do: spxinfo -l
• The command spxinfo –l will display a list of all protected directories.
2. Do: spxshare –share all
• The command will display the status of all shares. 3. Do: spxshare –share [#] -status off
• This command will take a share offline (share number referred to by #). 4. Do: spxshare –share [#] –status on
• This command will take a share back online (share number referred to by #). 5. Do: spxlog –‘logfilename’
• The command spxlog will display the log file referred (alert or restore for example).
6. Do: spxbackup ‘destination path’
• The command spxbackup will create and back up all data needed to start ICDES on another server.
7. Do: spxrestore -all
• This restores all stubs and shares, as ICDES has recorded during the protection of the affected directories.
Extension Scenarios: 7a. Do: spxrestore -share [#]
• This restores stubs and only the share number referred to, by number. Expected Outcome (after case complete):
IBM Cloud Data Encryption Services Administrative Guide 47
6
Setting Operational Limits (memory and disk usage for
journaling)
Goal:
To set disk and memory maximum limits for journaling, during daily operation. Triggers (to start this case):
The administrative user is required to set the disk and memory limits for journaling. Pre-conditions:
ICDES needs to be installed and operational. Main Success Scenario:
1. The user determines the total amount of memory and diskspace that can be afforded to ICDES, from the total memory and diskspace of the system. There are absolute limits that spxconfig will allow for memory limit and disk limit.
2. Do: spxconfig -print
A display will show the current configuration settings, such as the disk and memory limits. 3. Do: spxconfig –opmemlimit [# MB]
• The range for opmemlimit is 0 to 3. Limit range is determined by server. 4. Do: spxconfig –opdisklimit [# GB]
• The range for opdisklimit is 0 to 16. Limit range is determined by server.
5. The memory and disk limits will restrict ICDES operation. Once the operational limits (memory and disk above) are reached, the remaining journal will be written to disk. Extension Scenarios:
None
Expected Outcome (after case complete):
IBM Cloud Data Encryption Services Administrative Guide 48
7
Viewing Protected Directories (stubs) for Filenames
Goal:
To tour the protected directory in order to view the stubs for filenames that is processed by ICDES.
Triggers (to start this case):
The need to test and monitor protected directories (stubs) for filenames being processed. Pre-conditions:
ICDES installed and the Model/License configured, with shares not yet set up. Main Success Scenario:
1. Do: mkdir <protected_dir>
2. Do: spxenc –e <protected_dir>
3. Do: cd <protected_dir>
4. Do: echo “Hello There” > 1.txt
5. Do: spxlog –service
• View that 1.txt was processed in the log file.
6. Do: cd <path to share one>\<protected_dir>
7. Do: echo “” >> 1.txt
• 1.txt should be processed.
8. Do: cd <protected_dir>
9. Do: type 1.txt
• 1.txt should appear as “Hello There”, reassembled. This stub appears as plain text, however the file space used for the file is less than the file size. Double check for stubs.
Extension Scenarios: None
Expected Outcome (after case complete):
IBM Cloud Data Encryption Services Administrative Guide 49
8
Setting Disk Space Alert Thresholds
Goal:
To set thresholds for various alerts to warn of disk space conditions in order of severity. Triggers (to start this case):
The need to monitor and be alerted to the status of disk space, where data has been processed.
Pre-conditions:
ICDES installed and all the shares are configured. Main Success Scenario:
1. Do: spxconfig –informpct <% disk space threshold of least severity to be informed about>
2. Do: spxconfig –warnpct <% disk space threshold of 2nd least severity to be warned about>
3. Do: spxconfig -minorpct <% disk space threshold of 3rd least severity to be warned about>
4. Do: spxconfig -majorpct <% disk space threshold of 2nd most severity to be alerted about>
5. Do: spxconfig -criticalpct <% disk space threshold of most severity to be alerted about>
Extension Scenarios: None
Expected Outcome (after case complete): Alert thresholds have been set for ICDES.
IBM Cloud Data Encryption Services Administrative Guide 50
9
Rebuilding a Share
Goal:
To rebuild a Share
Triggers (to start this case):
Rebuilding of shares after a share or shares has been taken offline. Pre-conditions:
ICDES installed and all the shares configured. Main Success Scenario:
1. Do: spxrestore -all 2. Do: spxshare –share all
Extension Scenarios: Restore of stubs:
1a. Do: spxrestore –stub
Restore of a single share:
1b. Do: spxrestore -share [#]
Expected Outcome (after case complete): Shares and or stubs have been rebuilt.
IBM Cloud Data Encryption Services Administrative Guide 51
10 Adjusting Share Read Order
Goal:
To vary the read order of shares to optimize the performance of the overall system. Triggers (to start this case):
The ability to reorder the read order of shares from 1 to N for optimization of performance. Pre-conditions:
ICDES installed and all the shares configured. Main Success Scenario:
1. Do: spxconfig –share <share #> -readorder <order #>
2. Repeat the previous command until N shares read order have unique values from 1 to N.
Extension Scenarios: None
Expected Outcome (after case complete): Modified read order of shares.
IBM Cloud Data Encryption Services Administrative Guide 52
11 Taking a Share Offline/Online
Goal:
To take a share offline/online Triggers (to start this case):
The necessary scheduled maintenance of a particular share. Pre-conditions:
ICDES installed and all the shares are configured. Main Success Scenario:
1. Do: spxshare –share <share number of your M of N configuration> -status off Note the path of the share that you wish to take offline.
2. Do: spxshare –share all
Extension Scenarios:
1a. Do: spxshare –share <share number of your M of N configuration> -status on
Supporting Information: None
Expected Outcome (after case complete): Bring a share offline/online and view the status.
IBM Cloud Data Encryption Services Administrative Guide 53
12 Setting Up SNMP Traps
Goal:
Setup SNMP Traps for ICDES. Triggers (to start this case):
The need to set up messaging relating to the SNMP system. Pre-conditions:
ICDES installed and all the shares are configured. Main Success Scenario:
1. On the ICDES system run the following: Do: spxconfig –print
2. Find the “SNMP-Engine_ID:” String:
The following is an example of the SMNP-Engine_ID: SNMP-Engine_ID = 2f2k163684562t6eb6b67473 3. On the SNMP Server create a snmptrap user:
Stop snmp/snmptrap: Do: Services snmpd stop Do: Services snmptrapd stop
Edit the snmptrapd configuration file: Vim /var/lib/net-snmp/snmptrapd.conf 4. Add the following to the file:
Do: createuser –e <Engine ID String (SNMP-Engine_ ID) > <username> <MD5/SHA> <password> <DES/AES> <des/aes password>
Example
createuser –e 2f2k163684562t6eb6b67473 tester1 MD5 testerpass DES extrapass
5. Start the snmp/snmptrapd Services back up: Do: Services snmpd start
IBM Cloud Data Encryption Services Administrative Guide 54 6. On the ICDES GUI, under the tools page, add the SNMP Server Information:
SNMP User = <user> Example: SNMP User = tester1
SNMP Password = <password> Example: SNMP Password = testerpass
SNMP IP Address = <SNMP Server IP Address> Example: SNMP IP Address = 172.0.16.111
SNMP Port = <SNMP Port> Example: SNMP Port = 162
7. Once the information is filled in, click on the “Validate Options” button.
(You will be notified under the “SNMP Options” box if it was successful or unsuccessful.) 8. Click on the “Submit” button to save your configuration.
Extension Scenarios: None
Supporting Information: None
Expected Outcome (after case complete):
IBM Cloud Data Encryption Services Administrative Guide 55
Appendix II: IBM Cloud Data Encryption
Services - Event Identifiers
List of event identifiers: The following identifiers and descriptions are a list of alerts and notifications from ICDES
10000 Notification test was run
10010 License key value invalid
10050 Port number invalid
10090 OpMemLimit greater than 50% of available memory
10100 OpMemLimit greater than system memory
10110 OpDiskLimit greater than 80% of local disk capacity
10160 Share ‘arg1’ readorder value ‘arg2’ invalid 10330 Not all share paths have been defined
10440 New license key value entered and validated
10470 Value cannot be changed after system is running
20020 Share # offline / online / rebuild / critical
40010 15 day trial period over, read only mode
IBM Cloud Data Encryption Services Administrative Guide 56