User manual QUANTUM Q-EKM

[. . . ] Quantum Encryption Key Manager Scalar Libraries 6-01847-02 Quantum Encryption Key Manager User's Guide, 6-01847-02, Rev A, August 2010. Quantum Corporation provides this publication "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose. Quantum Corporation may revise this publication from time to time without notice. Making copies or adaptations without prior written authorization of Quantum Corporation is prohibited by law and constitutes a punishable violation of the law. [. . . ] 1 Log on to Q-EKM Commands (see Logging On to Q-EKM Commands on page 27). 2 At the Enter Command prompt, enter 5 (for Set Q-EKM server debug logging on or off). The Q-EKM server process stops. The Q-EKM server debug mode change menu displays. Figure 6 Debug Mode Change Menu 4 At the Enter Command prompt, enter 1 to turn debug logging ON; 2 to turn debug logging OFF, or q to quit. The Q-EKM server process starts. Quantum Encryption Key Manager Service and Installation Manual 32 Chapter 5 Q-EKM Server Operation and Configuration Synchronizing Primary and Secondary Q-EKM Servers 6 Verify the Q-EKM server process started by doing one of the following: · · Issue the Display the Q-EKM server status command (see Displaying the Q-EKM Server On/Off Status on page 30), or Check the native_stdout. log file (located in the keymanager folder in the QEKM directory; see Standard Out Messages Log on page 66). 7 Press <Enter> to return to the command menu. 8 Verify the debug logging is set as desired by checking the status on the Q-EKM commands menu. Synchronizing Primary and Secondary Q-EKM Servers A synchronized configuration means that the configuration files on the primary and secondary Q-EKM match. The two configuration files are: · ClientKeyManagerConfig. properties · KeyManagerConfig. properties The servers must be synchronized or you will not have accurate data should failover from the primary to the secondary server occur. (See What to do if Your Q-EKM Server Fails on page 64. ) Synchronization copies the two configuration files from the primary server to the secondary server automatically once per hour as long as both servers are up and running and connected to the network. The files are also coped immediately whenever a configuration change occurs on the primary server. Quantum Support should have set up synchronization at the initial install. Note: Only set up synchronization on the primary Q-EKM server. Quantum Encryption Key Manager Service and Installation Manual 33 Chapter 5 Q-EKM Server Operation and Configuration Synchronizing Primary and Secondary Q-EKM Servers Note: In order to synchronize properly, the TCP and SSL ports on the primary and secondary Q-EKM servers must be set to the same values. Synchronization causes the entire configuration files of the primary server to overwrite the configuration files on the secondary server. Because the TCP and SSL ports are listed in the configuration files, the primary and secondary servers must use the same TCP and SSL port settings. In addition, make sure the libraries that access these servers have their Q-EKM port configuration settings set to the correct values. If the you make changes to the keystore by importing keys, you must manually copy the keystore file (EKMKeys. jck) from the QEKM directory on the primary server to the QEKM directory on the secondary server so the keystore data is the same (C:\Program Files\Quantum\QEKM on Windows and opt/Quantum/QEKM on Linux). Both the primary and secondary Q-EKM servers must be running in order for synchronization to occur. Keep in mind that synchronization occurs from the primary Q-EKM server to the secondary, not vice versa. The secondary server remains the secondary server, even during a failover. Do not make changes to the secondary server's configuration because the primary server's configuration files will overwrite them during the next synchronization. Note: Note: Note: To set up synchronization, do the following: 1 Ensure that both the primary and secondary Q-EKM servers are up and running and connected to the network. 2 Log on to Q-EKM Commands on the primary Q-EKM server (see Logging On to Q-EKM Commands on page 27). You receive confirmation that looks similar to the following: Q-EKM Server: shut down complete. 3 Press <Enter>. Quantum Encryption Key Manager Service and Installation Manual 34 Chapter 5 Q-EKM Server Operation and Configuration Synchronizing Primary and Secondary Q-EKM Servers 4 When prompted, enter the secondary Q-EKM server's IP address. Caution: Ensure you enter the correct IP address of the secondary Q-EKM server. If you enter the wrong IP address, changes to the configuration files will not be synchronized to the secondary server. You receive a message that looks similar to the following: Sync IP address: x. x. x. x port: 443 ipaddress=x. x. x. x 1 file(s) moved. [. . . ] If the problem persists, contact Quantum Global Call Center. EF01 Encryption Configuration Problem: "Drive not configured. " The drive that is trying to communicate with Q-EKM is not present in the drive table. Ensure that the config. drivetable. file. url is correct in the KeyManagerConfig. properties file, if that parameter is supplied. If not, configure the drive manually by using the adddrive command with the correct drive information or set the "drive. acceptUnknownDrives" property to true using the modconfig command. If the problem persists, contact Quantum Global Call Center. Quantum Encryption Key Manager User's Guide 73 Appendix A ASetting the System Path Variable in Windows You may wish to update your system Path environment variable to include the path to the QEKM directory. [. . . ]