Search <book_title>...

Veritas NetBackup™ Security and Encryption Guide

Last Published: 2017-09-25

Product(s): NetBackup (8.1)

Creating the key database

Use the following procedure to create an empty key database. A key database is created by invoking the service name with the -createemptydb option. This process checks and ensures that an existing key database does not already exist, and then proceeds with the creation. Two protection keys need to be created when the KMS is initialized. They are the Host Master Key (HMK) and the Key Protection Key (KPK).

As with all KMS key creation activities, the user is presented with the following options for creating these keys:

Keys are generated by pass phrases
Randomly generated pass phrases

You are prompted to provide a logical ID to be associated with each key. At the end of this operation, the key database and protection keys are established.

On a Windows system they can be found in the following files:

\Program Files\Veritas\kms\db\KMS_DATA.dat
\Program Files\Veritas\kms\key\KMS_HMKF.dat
\Program Files\Veritas\kms\key\KMS_HKPKF.dat

On a UNIX system, they can be found in the following files:

/opt/openv/kms/db/KMS_DATA.dat
/opt/openv/kms/key/KMS_HMKF.dat
/opt/openv/kms/key/KMS_HKPKF.dat

Note:

On Windows the following nbkms command is run from the C:\Program Files\Veritas\NetBackkup\bin directory.

To create the key database

Run the following command:
```
nbkms -createemptydb.
```
Enter a pass phrase for the Host Master Key, or press Enter to use a randomly generated key. Re-enter the pass phrase at the following prompt.
Enter an HMK ID. This ID is associated with the HMK; you can use it to find this particular key in the future.
Enter a pass phrase for the Key Protection Key, or press Enter to use a randomly generated key. Re-enter the pass phrase at the following prompt.
Enter a KPK ID. This ID is associated with the KPK; you can use it to find this particular key in the future.
Enter KPK ID: 10.