FAQ: Best practices for managing encryption key on OBM or ACB version 7? (5034)

Transcription

1 FAQ: Best practices fr managing encryptin key n OBM r ACB versin 7? (5034) Article ID: 5034 Prduct Versin: ACB / OBM: 7.3 r abve OS: All platfrms Table f Cntents: Frequently Asked Questins: 1. What is the 'default' encryptin setting f a backup set? 2. Can I change the encryptin setting f a backup set? 3. Can I restre my backup data if I have lst my encryptin key? 4. Where is the encryptin setting f a backup set saved at? 5. I am prmpted t enter the encryptin key f my backup sets, why is that? Best practices fr managing yur encryptin key 1. What is the 'default' encryptin setting f a backup set? Answer) Fr backup sets created with OBM r ACB versin 7.3 r abve, the default encryptin setting f a backup set is: Encryptin Key: A randmly generated key f 44 alpha numeric characters Encryptin Key Length: 256 bits Encryptin Algrithm: AES Encryptin Methd: CBC Nte that fr backup accunt with multiple backup sets, even if the user had chsen t use 'default' setting fr their backup sets, each backup set will have its wn encryptin key.

2 Imprtant Nte: Fr users wh may have used lder releases f OBM r ACB, the 'default' encryptin setting is n lnger the passwrd. The default setting has changed since versin Can I change the encryptin setting f a backup set? Answer) The encryptin setting f a backup set is generated at the backup set creatin time, and cannt be changed afterward. 3. Can I restre my backup data if I have lst my encryptin key? Answer) N, if yu have lst the encryptin key f yur backup set, it will be impssible t restre data frm the crrespnding backup set. 4. Where is the encryptin setting f a backup set saved at? Answer) The encryptin setting f a backup set is saved lcally n the client cmputer, at: ~/.bm/cnfig/settings.sys Yu can als save the encryptin setting f yur backup sets n the backup server by enabling the 'Encryptin Recvery' ptin within the client user interface: Lgin t the OBM / ACB user interface. Click n the User Prfile (icn beside the username): Select 'Encryptin Recvery' then enable the setting:

3 Or frm the CBS web cnsle: Lgin t the CBS cnsle. Select 'User & User Grup' under 'User Management'. Select the crrespnding user, then under 'User Prfile', enable 'Uplad encryptin key after running backup fr recvery': If this ptin is enabled, the encryptin key (in encrypted frmat) f the backup set wuld be upladed t the backup server whenever a backup jb is perfrmed. The encryptin key wuld be saved within the user hme f the crrespnding accunt: %UserHme%\%username%\%backupset_id%\settings\EncryptinKeys-%YYYY-MM- DD%.jsn.rgz Cntact address f the user accunt will als be saved within this file.

4 Imprtant: Nte that this file cannt be decrypted by the CBS administratr. Yu must engage ur Prfessinal Encryptin Recvery Service t decrypt this file fr retrieving the encryptin key f a backup set. The encryptin key will be sent directly t the end user's cntact address. 5. I am prmpted t enter the encryptin key f my backup sets, why is that? Answer) The client applicatin will prmpt fr the encryptin key f all existing backup sets when the user it cannt detect the present f the settings.sys file (within the perating system prfile (e.g. ~/.bm/cnfig/settings.sys). Fr example: Lgin t the client applicatin n multiple cmputers with the same backup accunt. Yu have lgin t OBM with backup accunt 'username' n Cmputer A, then when yu lgin t OBM with the same accunt n Cmputer B, when yu access the Backup Sets tile, yu will be prmpted t enter the encryptin key fr all existing backup sets. Lgin t the client applicatin with multiple backup accunts. Yu have lgin t OBM with backup accunt 'username' n Cmputer A, then when yu lgin t OBM with backup accunt 'username2' n Cmputer A, yu will be prmpted t enter the encryptin key fr all existing backup sets. The client applicatin was cmpletely uninstalled (including the user prfile at ~/.bm/cnfig/settings.sys).

5 The user must enter the crrect encryptin key at this pint t manage r cntinue with the backup r restre peratin (f that backup set) n this cmputer. Best practices fr managing yur encryptin key: We wuld like t stress that it is very very very imprtant t keep a recrd f yur encrypting key at multiple lcatins. 1. Write dwn the encryptin keys f all f yur backup sets. Lgin t the OBM / ACB user interface. Click n the 'Backup Sets' tile. Select the crrespnding backup set, then 'Shw advanced settings'. Click n 'Others', select 'Unmask encryptin key' at the bttm f the menu. Cpy the encryptin key at multiple lcatins. 2. Make cpies f the backup accunt prfiles n the client cmputer: ~/cnfig/settings.sys

6 3. Enable the 'Encryptin Recvery' setting fr yur accunt. As last step t prtect yurself frm lsing the encryptin key f yur backup sets, enable the 'Encryptin Recvery' setting f yur backup accunt, t save the key t the backup server.