根据需要还原OKM、NSE和NVE - AFF A220
第1步:还原密钥管理器
您必须使用在此过程开始时捕获的设置完成特定于启用了板载密钥管理器(OKM)、NetApp存储加密(NSE)或NetApp卷加密(NVE)的系统的步骤。
如果启用了NSE或NVE以及板载或外部密钥管理器、则必须还原在此过程开始时捕获的设置。 |
-
将控制台缆线连接到目标控制器。
-
从ONATp启动菜单中选择以下选项之一以还原板载密钥管理器配置。
从ONATp启动菜单还原板载密钥管理器配置。
还原OKM配置时、需要以下信息:
-
已输入集群范围的密码短语 "同时启用板载密钥管理"。
-
"板载密钥管理器的备份信息"(英文)
-
请先执行此 "如何验证板载密钥管理备份和集群范围的密码短语" 过程、然后再继续。
-
从ONTAP启动菜单中选择相应的选项:
-
对于ONTAP 9 8及更高版本,请选择选项10:
Please choose one of the following: (1) Normal Boot. (2) Boot without /etc/rc. (3) Change password. (4) Clean configuration and initialize all disks. (5) Maintenance mode boot. (6) Update flash from backup config. (7) Install new software first. (8) Reboot node. (9) Configure Advanced Drive Partitioning. (10) Set Onboard Key Manager recovery secrets. (11) Configure node for external key management. Selection (1-11)? 10
-
对于ONTAP 9 7及更早版本,请输入隐藏选项 `recover_onboard_keymanager`命令。
Please choose one of the following: (1) Normal Boot. (2) Boot without /etc/rc. (3) Change password. (4) Clean configuration and initialize all disks. (5) Maintenance mode boot. (6) Update flash from backup config. (7) Install new software first. (8) Reboot node. (9) Configure Advanced Drive Partitioning. Selection (1-19)? recover_onboard_keymanager
-
-
确认此过程是否继续。
This option must be used only in disaster recovery procedures. Are you sure? (y or n): `y
-
输入集群范围的密码短语两次。
输入密码短语时、控制台不会显示任何输入。 Enter the passphrase for onboard key management:
Enter the passphrase again to confirm:
-
输入备份信息。将整个内容从开始备份行粘贴到结束备份行。
在输入末尾按两次回车键。
Enter the backup data: --------------------------BEGIN BACKUP-------------------------- 0123456789012345678901234567890123456789012345678901234567890123 1234567890123456789012345678901234567890123456789012345678901234 2345678901234567890123456789012345678901234567890123456789012345 3456789012345678901234567890123456789012345678901234567890123456 4567890123456789012345678901234567890123456789012345678901234567 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 0123456789012345678901234567890123456789012345678901234567890123 1234567890123456789012345678901234567890123456789012345678901234 2345678901234567890123456789012345678901234567890123456789012345 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ---------------------------END BACKUP---------------------------
-
恢复过程将完成。
Trying to recover keymanager secrets.... Setting recovery material for the onboard key manager Recovery secrets set successfully Trying to delete any existing km_onboard.wkeydb file. Successfully recovered keymanager secrets. *********************************************************************************** * Select option "(1) Normal Boot." to complete recovery process. * * Run the "security key-manager onboard sync" command to synchronize the key database after the node reboots. ***********************************************************************************
如果显示的输出不是,请勿继续 Successfully recovered keymanager secrets
。执行故障排除以更正错误。 -
从启动菜单中选择选项1以继续启动至ONTAP。
*********************************************************************************** * Select option "(1) Normal Boot." to complete the recovery process. * *********************************************************************************** (1) Normal Boot. (2) Boot without /etc/rc. (3) Change password. (4) Clean configuration and initialize all disks. (5) Maintenance mode boot. (6) Update flash from backup config. (7) Install new software first. (8) Reboot node. (9) Configure Advanced Drive Partitioning. (10) Set Onboard Key Manager recovery secrets. (11) Configure node for external key management. Selection (1-11)? 1
-
确认控制器的控制台显示
Waiting for giveback…(Press Ctrl-C to abort wait)
-
从配对节点中,将配对控制器:
storage failover giveback -fromnode local -only-cfo-aggregates true
-
仅使用CFO聚合启动后、运行_security key-manager onboard sync_命令。
-
输入板载密钥管理器的集群范围密码短语。
Enter the cluster-wide passphrase for the Onboard Key Manager: All offline encrypted volumes will be brought online and the corresponding volume encryption keys (VEKs) will be restored automatically within 10 minutes. If any offline encrypted volumes are not brought online automatically, they can be brought online manually using the "volume online -vserver <vserver> -volume <volume_name>" command.
如果同步成功、则会返回集群提示符、而不会显示任何其他消息。如果同步失败、则会在返回集群提示符之前显示一条错误消息。更正错误并成功运行同步之前、请勿继续。 -
确保所有密钥均已同步:
security key-manager key query -restored false
。There are no entries matching your query.
在reved参数中筛选false时、不应显示任何结果。 -
从配对节点进行节点的返回:
storage failover giveback -fromnode local
从ONATp启动菜单还原外部密钥管理器配置。
要还原外部密钥管理器(EKM)配置、您需要以下信息:
-
另一个集群节点上的/cfcard/kmip/servers.cfg文件的副本、或者以下信息:
-
KMIP服务器地址。
-
KMIP端口。
-
另一个集群节点或客户端证书中的/cfcard/kmip/certs/client.crt文件的副本。
-
另一个集群节点或客户端密钥上的/cfcard/kmip/certs client.key文件的副本。
-
另一个集群节点或KMIP服务器CA的/cfcard/kmip/certs /CA.pm文件的副本。
-
-
从ONTAP启动菜单中选择选项11。
(1) Normal Boot. (2) Boot without /etc/rc. (3) Change password. (4) Clean configuration and initialize all disks. (5) Maintenance mode boot. (6) Update flash from backup config. (7) Install new software first. (8) Reboot node. (9) Configure Advanced Drive Partitioning. (10) Set Onboard Key Manager recovery secrets. (11) Configure node for external key management. Selection (1-11)? 11
-
出现提示时、确认您已收集所需信息:
-
Do you have a copy of the /cfcard/kmip/certs/client.crt file? {y/n}
y -
Do you have a copy of the /cfcard/kmip/certs/client.key file? {y/n}
y -
Do you have a copy of the /cfcard/kmip/certs/CA.pem file? {y/n}
y -
Do you have a copy of the /cfcard/kmip/servers.cfg file? {y/n}
y您也可以使用以下提示:
-
Do you have a copy of the /cfcard/kmip/servers.cfg file? {y/n}
n-
Do you know the KMIP server address? {y/n}
y -
Do you know the KMIP Port? {y/n}
y
-
-
-
为每个提示提供相关信息:
-
Enter the client certificATE (cclient.crt) file contents:
-
Enter the client key (cclient.key) file contents:
-
Enter the KMIP server CA (ca.pm) file contents:
-
Enter the server configuration (servers.cfg) file contents:
Example Enter the client certificate (client.crt) file contents: -----BEGIN CERTIFICATE----- MIIDvjCCAqagAwIBAgICN3gwDQYJKoZIhvcNAQELBQAwgY8xCzAJBgNVBAYTAlVT MRMwEQYDVQQIEwpDYWxpZm9ybmlhMQwwCgYDVQQHEwNTVkwxDzANBgNVBAoTBk5l MSUbQusvzAFs8G3P54GG32iIRvaCFnj2gQpCxciLJ0qB2foiBGx5XVQ/Mtk+rlap Pk4ECW/wqSOUXDYtJs1+RB+w0+SHx8mzxpbz3mXF/X/1PC3YOzVNCq5eieek62si Fp8= -----END CERTIFICATE----- Enter the client key (client.key) file contents: -----BEGIN RSA PRIVATE KEY----- MIIEpQIBAAKCAQEAoU1eajEG6QC2h2Zih0jEaGVtQUexNeoCFwKPoMSePmjDNtrU MSB1SlX3VgCuElHk57XPdq6xSbYlbkIb4bAgLztHEmUDOkGmXYAkblQ= -----END RSA PRIVATE KEY----- Enter the KMIP server CA(s) (CA.pem) file contents: -----BEGIN CERTIFICATE----- MIIEizCCA3OgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx 7yaumMQETNrpMfP+nQMd34y4AmseWYGM6qG0z37BRnYU0Wf2qDL61cQ3/jkm7Y94 EQBKG1NY8dVyjphmYZv+ -----END CERTIFICATE----- Enter the IP address for the KMIP server: 10.10.10.10 Enter the port for the KMIP server [5696]: System is ready to utilize external key manager(s). Trying to recover keys from key servers.... kmip_init: configuring ports Running command '/sbin/ifconfig e0M' .. .. kmip_init: cmd: ReleaseExtraBSDPort e0M
-
-
恢复过程将完成:
System is ready to utilize external key manager(s). Trying to recover keys from key servers.... [Aug 29 21:06:28]: 0x808806100: 0: DEBUG: kmip2::main: [initOpenssl]:460: Performing initialization of OpenSSL Successfully recovered keymanager secrets.
-
从启动菜单中选择选项1以继续启动至ONTAP。
*********************************************************************************** * Select option "(1) Normal Boot." to complete the recovery process. * *********************************************************************************** (1) Normal Boot. (2) Boot without /etc/rc. (3) Change password. (4) Clean configuration and initialize all disks. (5) Maintenance mode boot. (6) Update flash from backup config. (7) Install new software first. (8) Reboot node. (9) Configure Advanced Drive Partitioning. (10) Set Onboard Key Manager recovery secrets. (11) Configure node for external key management. Selection (1-11)? 1
第2步:完成启动介质更换
在正常启动后、通过完成最终检查并交还存储来完成启动介质更换过程。
-
检查控制台输出:
如果控制台显示 … 那么 … 登录提示符
转至步骤6。
正在等待交还
-
登录到配对控制器。
-
使用_storage故障转移show_命令确认目标控制器已准备好进行恢复。
-
-
使用_storage故障转移交还-fronode local -only -cfo-Aggregates true命令将控制台缆线移至配对控制器并交还目标控制器存储。
-
如果命令因磁盘发生故障而失败,请物理断开故障磁盘,但将磁盘保留在插槽中,直到收到更换磁盘为止。
-
如果此命令因配对节点"未就绪"而失败、请等待5分钟、以便HA子系统在配对节点之间同步。
-
如果命令因 NDMP , SnapMirror 或 SnapVault 进程而失败,请禁用此进程。有关详细信息,请参见相应的文档中心。
-
-
等待3分钟、然后使用_storage故障转移show_命令检查故障转移状态。
-
在cluster-shell提示符处、输入_network interface show -is-home false_命令、列出不在其主控制器和端口上的逻辑接口。
如果列出了任何接口
false
,请使用_net int revserver cluster -lif _nokename_命令 将这些接口还原回其主端口。 -
将控制台缆线移至目标控制器、然后运行_version -v_命令以检查ONTAP版本。
-
使用
storage encryption disk show
查看输出。 -
使用_security key-manager key query_命令 显示密钥管理服务器上存储的身份验证密钥的密钥ID。
-
如果
restored
column =yes/true
,则表示您已完成更换过程,并可继续完成更换过程。 -
如果
Key Manager type
=external
和Restored
列=以外的任何内容yes/true
,请使用_security key-manager External Restore_命令 还原身份验证密钥的密钥ID。如果命令失败,请联系客户支持。 -
如果
Key Manager type
=onboard
和Restored
列=以外的任何内容yes/true
,请使用_security key-manager onboard sync_命令同步修复后节点上缺少的板载密钥。使用_security key-manager key query_命令 验证所有身份验证
Restored
密钥的列=yes/true
。
-
-
将控制台缆线连接到配对控制器。
-
使用
storage failover giveback -fromnode local
命令交还控制器。 -
如果已使用_storage故障转移修改-node local -auto-交还true命令禁用自动交还、则还原自动交还。
-
如果启用了AutoSupport、请使用_system node AutoSupport invoke -node *-type all -message Maint=end_命令还原/取消禁止自动创建案例。