Search <book_title>...

Veritas NetBackup™ Security and Encryption Guide

Last Published: 2018-02-16

Product(s): NetBackup (8.1.1)

Managing the NetBackup encryption key file

This topic describes how to manage the NetBackup encryption key file.

Note:

The key file must be the same on all nodes in a cluster.

Use the bpkeyutil command to set up the cipher-based encryption key file and pass phrase on the NetBackup Encryption client.

For a Windows client, the full command path is as follows
```
install_path\NetBackup\bin\bpkeyutil
```
For a UNIX client, the full command path is as follows
```
/usr/openv/netbackup/bin/bpkeyutil
```

You are prompted to add a pass phrase for that client.

NetBackup uses the pass phrase you specify to create the key file, as follows:

NetBackup uses a combination of the following two algorithms to create a key from the pass phrase that is up to 256 bits.
- Secure hashing algorithm, or SHA1
- Message digest algorithm, or MD5
NetBackup uses the NetBackup private key and 128-bit AES algorithm to encrypt the key.
The key is stored in the key file on the client.
At run time, NetBackup uses the key and a random initialization vector to encrypt the client data. The initialization vector is stored in the header of the backup image.

Previous pass phrases remain available in the key file to allow restores of the backups that were encrypted by using those phrases.

Caution:

You must remember the pass phrases, including the old pass phrases. If a client's key file is damaged or lost, you need all of the previous pass phrases to recreate the key file. Without the key file, you cannot restore the files that were encrypted with the pass phrases.

The key file must be accessible only to the administrator of the client machine.

For a UNIX client, you must ensure the following:

The owner is root.
The mode bits are 600.
The file is not on a file system that can be NFS mounted.