User manual QUANTUM Q-EKM

[. . . ] Quantum Encryption Key Manager Scalar Libraries 6-01847-02 Quantum Encryption Key Manager User's Guide, 6-01847-02, Rev A, August 2010. Quantum Corporation provides this publication "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose. Quantum Corporation may revise this publication from time to time without notice. COPYRIGHT STATEMENT Copyright 2010 by Quantum Corporation. [. . . ] Do not make changes to the secondary server's configuration because the primary server's configuration files will overwrite them during the next synchronization. Note: Note: Note: To set up synchronization, do the following: 1 Ensure that both the primary and secondary Q-EKM servers are up and running and connected to the network. 2 Log on to Q-EKM Commands on the primary Q-EKM server (see Logging On to Q-EKM Commands on page 27). You receive confirmation that looks similar to the following: Q-EKM Server: shut down complete. 3 Press <Enter>. Quantum Encryption Key Manager Service and Installation Manual 34 Chapter 5 Q-EKM Server Operation and Configuration Synchronizing Primary and Secondary Q-EKM Servers 4 When prompted, enter the secondary Q-EKM server's IP address. Caution: Ensure you enter the correct IP address of the secondary Q-EKM server. If you enter the wrong IP address, changes to the configuration files will not be synchronized to the secondary server. You receive a message that looks similar to the following: Sync IP address: x. x. x. x port: 443 ipaddress=x. x. x. x 1 file(s) moved. 1 file(s) moved. 5 When prompted, press <Enter>. You receive confirmation that looks similar to the following: Starting EKM Server. . . Please check the logs to make sure EKM Server has started successfully. 6 Press <Enter>. 7 Verify the Q-EKM server process started by doing one of the following: · · Issue the Display the Q-EKM server status command (see Displaying the Q-EKM Server On/Off Status on page 30), or Check the native_stdout. log file (located in the keymanager folder in the QEKM directory; see Standard Out Messages Log on page 66). Quantum Encryption Key Manager Service and Installation Manual 35 Chapter 5 Q-EKM Server Operation and Configuration Keeping the Keystores Matched 8 Press <Enter>. The synchronization setup completes and the first sync occurs. You receive several lines of confirmation text: * Verify primary to secondary server sync has been configured. * Primary to secondary sync has been configured. Syncing primary to secondary --------------------------------------------Sync completed --------------------------------------------- Press <Enter> to return to the command menu. Keeping the Keystores Matched In order for failover to work, the primary and secondary keystores must match. Unlike the configuration files, which are copied from the primary to the secondary Q-EKM server automatically once you set up synchronization, the keystore is not automatically copied from one server to the other. You must manually ensure that the keystores match any time you make changes to the keystore. Changes to the keystore include: · Importing keys · Importing certificates There are two was to make sure the keystores match. Do one of the following: · Import the keys or certificates onto both Q-EKM servers (see Chapter 6, Sharing Encrypted Tapes ­ Import/Export Operations). · Import the keys or certificates onto one Q-EKM server, and then copy the keystore file from that server onto the other server. The keystore file is called EKMKeys. jck and is located in the QEKM directory of the Q-EKM server: Windows Linux c:\Program Files\Quantum\QEKM /opt/Quantum/QEKM Quantum Encryption Key Manager Service and Installation Manual 36 Chapter 5 Q-EKM Server Operation and Configuration Changing the Communication Port Settings Changing the Communication Port Settings Changes the communication port settings on the Q-EKM server. You should not need to change the default port settings unless the default ports are being used by other software on the host. The Q-EKM server is set up with the following ports by default: · TCP Port (also referred to as the EKM Port) ­ Default Value 3801 · SSL Port ­ Default Value 443. In order for synchronization between the primary and secondary Q-EKM servers to occur, the TCP and SSL port settings on the primary and secondary Q-EKM servers must be set to the same values. [. . . ] When finished collecting data, turn Debug off. If the problem persists, contact Quantum Global Call Center. Quantum Encryption Key Manager User's Guide 73 Appendix A ASetting the System Path Variable in Windows You may wish to update your system Path environment variable to include the path to the QEKM directory. This allows you to enter Q-EKM commands on any command line rather than having to change the directory to the QEKM directory each time. To update the system Path environment variable: 1 Choose Start > Control Panel > System. [. . . ]