Chapter 2: DSM V6100 Hardware Appliance
Full Disk Encryption
DSM Installation and Configuration Guide
Copyright 2009 - 2020 Thales Group. All rights reserved.
40
Add more CLI administrators (optional)
1. Navigate to the
users commands
menu, type:
user
2. For each administrator you want to add, type:
add
<administrator name>
3. When prompted, enter a password. The password criteria are:
n
Does not have repeating characters
n
Uses at least 1 upper- and 1 lower-case character
n
Uses at least 1 special character
4. Return to the main menu, type:
up
Full Disk Encryption
As of v6.0.2, the DSM root file system is automatically encrypted for enhanced security. This feature is only available
on a fresh installation of the DSM v6.0.2 software or any higher version. This feature is not available if you upgrade to
v6.0.2.
Note
This feature is not supported on the V5800 appliances.
To maintain the security of the encrypted root file system, a DSM System administrator can set a passphrase that will
be required at boot time to unlock the system. Setting a boot passphrase is not required. Users who prefer an
unattended boot, can continue to use the DSM without a passphrase. However in the interest of better security, we
recommend that you set a boot passphrase.
Set boot passphrase
Once a boot passphrase is set, it is required each time the system boots. The passphrase is set via the CLI and is
available under the ‘System’ category of commands in the security sub-menu, refer to the CLI chapter of the
DSM
Administrators Guide
for details about usage.
If you plan to create a high availability cluster, we recommend, that you set a passphrase on each node in the cluster,
in order to maintain a consistent level of security.
To set a passphrase the following are required:
l
An RSA key pair with a minimum length of 2048 bits. The public key of the pair is used to encrypt the passphrase.
The private key is required to decrypt the passphrase for recovery, in the event that it is lost.
l
Console access to the DSM appliance, either direct or remotely via IPMI. After setting the passphrase, the DSM
will reboot and any network connections will no longer work. Upon reboot, a prompt will appear on the console,
and the system will wait for the correct boot passphrase to be entered.
See
"Configuring IPMI on the DSM" on page 60
for how to set up the IPMI. If using a virtual appliance, you
can connect to the DSM via the console available from the virtualization application in use.
1. Log on to the console, and enter the System category of commands and type
security boot-passphrase set
at the prompt;
0001:system$ security boot-passphrase set
