Sun Oracle Crypto Accelerator 6000 Board, Руководство пользователя

Страница: 89 / 266

Chapter 3 Administering the Sun Crypto Accelerator 6000 Board 67
Note – If the following command is executed in Multi-Admin mode, authentication
is required by multiple security officers assigned the Multi-Admin role.
3. Set a password for the backup data.
This password encrypts the master key in the backup file.
Caution – Choose a password that is very difficult to guess when making backup
files, because this password protects the master key for your keystore. You must also
remember the password you enter. Without the password, you cannot access the
master key backup file. There is no way to retrieve the data protected by a lost
password.
Note – To load a keystore to a board from a previous keystore backup, only the
keystore backup file is required. The required keystore files will automatically be
created in the keystore directory (
/var/sca/keydata
by default). If keystore files
for a keystore with the same name as the keystore backup already exist in the
keystore directory, the backup will not be allowed. A keystore backup file can also
be used to load just the master key to a card if the data base files are already in the
keystore directory.
Locking Keystores to Restrict Access
▼
Lock a Master Key to Prevent Backups
A site might have a strict security policy that does not permit the master key for a
keystore to leave the hardware.
Caution – Once this command is entered, all attempts to back up the master key
will fail. This lock persists even if the master key is rekeyed. The only way to clear
this setting is to delete the keystore from the Sun Crypto Accelerator 6000 board
with the
delete keystore
command. (See
TABLE 3-4
.)
scamgr{mca
N
@
hostname
,
sec-officer
}> backup keystore
/opt/SUNWconn/mca/backups/bkup.data
Enter a password to protect the data:
Confirm password:
Backup to /opt/SUNWconn/mca/backups/bkup.data successful.