Please Note:

You are not viewing the most recent version of this page. 7.7.0 is the latest version available.

Integrations and Solutions
CTE Agent for AIX Integration Guide
- Using CTE with Oracle
  - CTE on Oracle ACFS Overview
  - Creating an Oracle ASM Disk Group for Guarding
  - Oracle RAC ASM
    - Important ASM Commands and Concepts
    - Determining Best Method for Encrypting Disks
    - General Prerequisites
    - Specific Prerequisites
  - About Oracle RAC ASM Raw Devices
  - Oracle RAC ASM Multi-Disk Online Method
  - Oracle RAC ASM Multi-Disk Offline Method (Backup/Restore)
  - Surviving the Reboot and Failover Testing
  - Basic Troubleshooting Techniques
- Using CTE with PowerTech Antivirus
CTE Agent for Linux Integration Guides
- Installing CTE on Hadoop
  - Overview
  - Implementing CTE on HDFS
    - Create an Encryption Zone in HDFS Name Space for AWS EMR
    - Using the Original Information from HDFS
    - Create an HDFS Host Group and GuardPoint in CipherTrust Manager
    - Adding a New DataNode to a CTE-protected HDFS
    - Configure NameNodes
    - Take a DataNode Offline and Perform Data Transformation
    - Implementing CTE on HDFS on a Single Host
  - Deploy Cloudera Hadoop on CTE
  - HDFS Upgrade with CTE
    - Configure the Hadoop Cluster for CTE
    - Create a CipherTrust Configuration Group
    - Update the Hadoop-env Template with CTE Settings
    - Modify the HDFS IOCTL
    - Change the HDFS File Rename Check
    - User Information Push
    - Uninstalling CTE for the Hadoop Cluster
  - CTE Installation and Configuration
    - Configuring Hadoop to Use CTE
  - Deleting Metadata in HDFS when Migrating Out of LDT
- Using CTE with Oracle
  - Basic Troubleshooting Techniques
    - Verifying Database Encryption
  - Using CTE LDT with Oracle
  - Oracle RAC ASM and ASMLib
    - Important ASM Commands and Concepts
    - Determining Best Method for Encrypting Disks
    - General Prerequisites
    - Specific Prerequisites
  - Oracle RAC ASMLib Multi-Disk Online Method
  - About Oracle RAC ASM Raw Devices
  - Oracle RAC ASM Multi-Disk Online Method
  - Oracle RAC ASM Multi-Disk Offline Method (Backup/Restore)
  - Surviving the Reboot and Failover Testing
  - Using CTE with Oracle ASM Filter Driver
    - Audience
    - Enable Oracle ASMFD for CTE
    - Configure CTE and create a guarded Oracle ASMFD
    - Convert a baseline ASMFD disk group to a CTE guarded ASMFD disk group using the Offline method
    - Convert a baseline ASMFD disk group to a CTE guarded ASMFD disk group using the Online method
    - Uninstall/ Upgrade CTE with active ASMFD Setup
  - Using Oracle with CTE-U
- Integrating and Configuring EDB
- Integration with Pacemaker
  - Performing CTE maintenance with an LDT GuardPoint in a Pacemaker Setup
  - Using CTE with Pacemaker
- Using CTE with SQL Server on Linux on Red Hat 8
- Configuring Support for SAP HANA
- Using CTE with GlusterFS
- NetApp Snapshot Directory
- Using CTE with Quantum StorNext
  - Overview of using CTE with Quantum StorNext
  - CTE and Quantum StorNext Compatibility
  - Setting up CTE and Quantum StorNext Integration
  - Stop secfs Before Upgrading StorNext LAN Clients
- Using CTE with McAfee Endpoint Security for Linux Threat Prevention
- Using CTE with Trend Micro Deep Security Software
- CTE for Cloud Object Storage
  - Overview
  - System and Software Requirements
  - Client Software Requirements
  - CTE COS S3 Installation Overview
  - Install Required Linux Packages
  - Install CTE with COS Service
  - Configure the AWS CLI to use the COS Root CA Certificate
  - Configure the AWS CLI Network Proxy
  - Configure CTE COS S3
  - Configure a CTE COS S3 Role for Guarded Buckets
    - Secure an S3 Bucket with the CTE COS S3 Role
    - Disable the CTE COS S3 Role for an S3 Bucket
  - Guard an AWS Bucket
  - Additional COS Proxy Root CA Certificate Information
  - Protecting Python Programs with CTE
  - Enable COS on an Agent with no COS Service
  - Creating a COS Policy
  - Uninstall COS from an Agent
- CTE-Efficient Storage for Linux
  - Introduction to CTE-Efficient Storage
    - CTE-Efficient Storage Enhanced Storage Arrays
    - Efficient Storage Device Header and CTE Private Region
    - Device Size
    - ES GuardPoint Encryption Keys
    - Policy Requirements for ES GuardPoints
  - Guarding an Efficient Storage Device on Linux
    - Requirements for Efficient Storage GuardPoints on Linux
    - Initialize Linux Efficient Storage Devices
    - Guard the Linux Device with an ES GuardPoint
    - Example of Creating an ES GuardPoint on an Existing Linux Device
  - Guarding a CTE-Efficient Storage Device with Multiple IO Paths on Linux
  - Linux System and ES GuardPoint Administration
    - voradmin ESG Commands on Linux
    - Viewing Device Status and the ES Header on Linux
    - File System Mount Points on Linux
    - Linux System Utilities for Signing
  - Changing the Encryption Key on Linux ESG Devices
  - Resizing Guarded Efficient Storage Devices
    - Example: Resizing a Linux Device
  - Use Cases involving Efficient Storage GuardPoints
    - Use Case 1: Single Encryption Key
    - Use Case 2: Device-Level GuardPoints
    - Use Case 3: Directory-Level GuardPoints
    - Best Practices for the Migration of a legacy Raw Device Guardpoint to an Efficient Storage Guardpoint
    - Migration Prerequisites
    - Migration
    - Use Case 4: Using CTE-Efficient Storage with LVM
  - Alerts and Errors on Linux
- CTE with Teradata Database Appliances
  - IDT-Capable GuardPoints and Teradata Database Appliances
  - Requirements and Considerations
  - Guarding a Teradata Database Device
    - Install CTE on the Teradata Database Appliance
    - Identify the Devices to Be Guarded
    - Select the Initial Configuration Method
    - Initialize and Guard the Database Devices Using the Standard Initialization Method
    - Initialize and Guard the Teradata Database Devices Using the Backup/Restore Method
  - Changing the Encryption Key on Teradata Devices
  - Access Rules to Apply on the Teradata Database Appliance
  - Replication of IDT Metadata Files Across Members of a Clique
  - Best Practices
  - Uninstalling CTE from the Teradata Cluster
  - Alerts and Errors
  - Generating IDT-capable Metadata for Teradata Storage Expansion
- Integrating CTE with an Exasol Database
- Integrating CTE with a Couchbase Database
- Integrating CTE with an EnterpriseDB Postgres Advanced Server
- Integrating CTE with a MongoDB database
- Integrating CTE with an Apache Cassandra database
- Integrating CTE with a Neo4j Database
CTE Agent for Windows Integration Guides
- Using CTE with Microsoft SQL AlwaysOn and SQL File Tables
  - Using CTE with Microsoft SQL
    - Using CTE with SQL
    - Using CTE with SQL FileTables
    - Installing CTE on Microsoft SQL AlwaysOn
    - Data Transformation (Encryption in place)
    - Copy/Restore
    - SQL Server Policy Tuning
  - Using LDT with Microsoft SQL
    - Using LDT with SQL AlwaysOn
    - Using LDT with SQL FILESTREAM
- CTE with DFSR
  - Overview
  - Creating Required DFSR Policy Components
  - Using the Standard Encryption Method
    - Creating Standard Policies for DFSR
    - Creating Standard GuardPoints with the DFSR Hub and Spoke Topology
    - Creating Standard GuardPoints with the DFSR Full Mesh Topology
  - Using the CTE-LDT Encryption Method
    - Creating a CTE-LDT Policy for DFSR
    - Creating a CTE-LDT GuardPoint for DFSR
- Secure Start
  - Secure Start Overview
  - Prerequisites
  - Encrypt by Moving the AD Service into a Guarded Directory
  - Encrypt Data in Place with Offline Transformation
  - Encrypt with an LDT Transformation Policy
  - Configure the Time Out Failure
  - Recover a Server After it Loses Connection to the Key Manager
  - Other Use Cases
  - Best Practices for Encrypting and Protecting the AD Service
- Exchange DAG
  - Exchange DAG Overview
  - CTE Policies for Exchange DAG
    - Creating a Policy for CTE-LDT Encryption with CipherTrust Manager
    - Creating Policies for Standard Encryption with CipherTrust Manager
  - Encrypting with CTE-LDT in an Exchange DAG Environment
  - Encrypting with a Standard CTE Policy in the Exchange DAG Environment
  - Decrypting with CTE-LDT in an Exchange DAG Environment
- Storage Spaces Direct
- Using CTE with Quantum StorNext
  - Overview of using CTE with Quantum StorNext
  - CTE and Quantum StorNext Compatibility
  - Setting up CTE and Quantum StorNext Integration
- CTE-Efficient Storage for Windows
  - Introduction to CTE-Efficient Storage
    - CTE-Efficient Storage Enhanced Storage Arrays
    - Efficient Storage Device Header and CTE Private Region
    - Device Size
    - ES GuardPoint Encryption Keys
    - Policy Requirements for ES GuardPoints
  - Guarding an Efficient Storage Device on Windows
    - Requirements for Efficient Storage GuardPoints on Linux
    - Limitations for ES GuardPoints on Windows
    - Initialize Windows CTE-Efficient Storage Devices
    - Guard the Windows Device with an ES GuardPoint
  - Windows System and ES GuardPoint Administration
  - Changing the Encryption Key for a Windows ES GuardPoint
  - Resizing Guarded Efficient Storage Devices
  - Use Cases involving Efficient Storage GuardPoints
    - Use Case 1: Single Encryption Key
    - Use Case 2: Device-Level GuardPoints
    - Use Case 3: Directory-Level GuardPoints
    - Use Case 4: Full Device Protection
  - Alerts and Errors on Windows
- Encrypt Microsoft OneDrive files with CTE

Creating an Oracle ASM Disk Group for Guarding

Creating a new ASM Disk Group

Note

This document is for Oracle 19c on AIX 7.

List the available cluster shared disks, type:

# xiv_devlist

Response

IBM storage devices
----------------------------------------------------------------------------------------------------------------------------
Device       Size (GB)  Paths  Vol Name                               Vol ID  Storage ID  Storage Type  Hyper-Scale Mobility
----------------------------------------------------------------------------------------------------------------------------
/dev/hdisk2  51.6       2/2    sjaix81lpar069_sjaix81lpar079_vol_001  1053    7825664     XIV           Idle
----------------------------------------------------------------------------------------------------------------------------
/dev/hdisk3  154.9      2/2    sjaix81lpar069_sjaix81lpar079_vol_002  1054    7825664     XIV           Idle
----------------------------------------------------------------------------------------------------------------------------
/dev/hdisk4  154.9      2/2    sjaix81lpar069_sjaix81lpar079_vol_003  1055    7825664     XIV           Idle
----------------------------------------------------------------------------------------------------------------------------
/dev/hdisk5  154.9      2/2    sjaix81lpar069_sjaix81lpar079_vol_004  1056    7825664     XIV           Idle
----------------------------------------------------------------------------------------------------------------------------
/dev/hdisk6  51.6       2/2    sjaix81lpar069_sjaix81lpar079_vol_005  1075    7825664     XIV           Idle
----------------------------------------------------------------------------------------------------------------------------

Ensure that the disks are available, type:

# /usr/sbin/lsdev -Cc disk

Response

hdisk0 Available          Virtual SCSI Disk Drive
hdisk1 Available          Virtual SCSI Disk Drive
hdisk2 Available C5-T1-01 MPIO 2810 XIV Disk
hdisk3 Available C5-T1-01 MPIO 2810 XIV Disk
hdisk4 Available C5-T1-01 MPIO 2810 XIV Disk
hdisk5 Available C5-T1-01 MPIO 2810 XIV Disk
hdisk6 Available C5-T1-01 MPIO 2810 XIV Disk

To identify the device names for the physical disks that you want to use, type the following on any node:

# /usr/sbin/lspv | grep -i none

Response

hdisk1          00fa0087e313f5c9                    None
hdisk2          none                                None
hdisk3          none                                None
hdisk4          none                                None
hdisk6          none                                None

Select available candidate disks for a new ASM disk group. On the Oracle system, type:

SYS@+ASM2> COLUMN path format a20

SYS@+ASM2> SELECT name, header_status, path FROM V$ASM_DISK;

Response

NAME                           HEADER_STATUS PATH
------------------------------ ------------ --------------------
                               FORMER       /dev/rhdisk1
                               FORMER       /dev/rhdisk2
                               CANDIDATE    /dev/rhdisk3
TDE1_0000                      MEMBER       /dev/rhdisk4
GRID_0000                      MEMBER       /dev/rhdisk6

Prepare the Targeted Disk for CTE and ASM Diskgroup creation:

# chown grid:dba /dev/rhdisk3
# chmod 660 /dev/rhdisk3
# dd if=/dev/rhdisk3 of=zzz bs=4k count=1

Response

1+0 records in.
1+0 records out.

In CipherTrust Manager, create a key with the following characteristics:
- Encryption mode: CBC
- Algorithm: AES
- Size: 128 or 256
Create a CipherTrust Transparent Encryption policy for Oracle on AIX.

a. Create a CBC key with CBC-AES128 or CBC-AES256.

b. Create a Security Rule:
- Action: all_ops
- Effect: Audit, Permit, Apply Key
c. Create a Key Selection Rule:
- Key: cte_cbc_aes256_key
d. Guard your targeted RAC raw devices so that you can use the secvm disk to create a guarded Oracle RAC ASM or ASMLib disk group.
```
/dev/rhdisk3
```
- Type = Raw or Block Device (Auto or Manual Guard)
Once you guard your target, CipherTrust Transparent Encryption creates the following:
```
/dev/secvm/dev/rhdisk3
```

Install the same version of CipherTrust Transparent Encryption on all nodes in the cluster. To check the version, type:

# vmd -v

Response

Version 7, Service Pack 3
7.3.0.35
2022-09-23 02:08:46 (PDT)
Copyright (c) 2009-2022, Thales Inc.  All rights reserved.

Guard targeted disk on all cluster nodes.

a. Check the guard status of the disk on all cluster nodes, type:

#  secfsd -status guard

Response

GuardPoint    Policy                  Type       ConfigState  Status   Reason
----------    ------                  ----       -----------  ------   ------
/dev/rhdisk3  encrypt_cbc_aes256_all  rawdevice  guarded      guarded  N/A

b. List the devices, type:

# ls -l /dev/secvm/dev/rhdisk3

crw-rw----    1 grid     dba          43,  1 Sep 28 15:21 /dev/secvm/dev/rhdisk3

Add the following client settings for both RAC nodes that are set in the $GRID_HOME & $ORACLE_HOME variables.
```
$ echo $GRID_HOME
```
Response
```
/u01/app/19.0.0/grid

$ echo $ORACLE_HOME
```
Response
```
/u01/app/oracle/product/19.0.0/db_1
```
For each node in the cluster, in the client settings, type:
```
|authenticator_euid|/u01/app/19.0.0/grid/bin/grid
|authenticator_euid|/u01/app/19.0.0/grid/bin/orarootagent.bin
|authenticator_euid|/u01/app/oracle/product/19.0.0/db_1/oracle
|authenticator_euid|/u01/app/oracle/product/19.0.0/db_1/bin/oracle
```
Note
This step is optional because it does not effect Oracle behavior. However, without these setting, CipherTrust Transparent Encryption can generate authentication error messages in the CTE log in /var/log/vormetric. These errors do not interfere with Oracle functions.
Launch the GUI for the GRID (./asmca) to create the new CipherTrust Transparent Encryption guarded ASM disk group:
Update the discovery path to the following in order for both the baseline and guarded disks to be found:
```
/dev/rhdisk*,/dev/secvm/dev/rhdisk*
```
Select targeted rhdisk3 disk with the guarded path of secvm.
The end result should show your new CTE guarded ASM disk group called CTE1.
When creating your RAC database, choose DB files to reside in the CTE guarded ASM disk group that you just created:

You can now use the secvm disk that you created to create a guarded Oracle RAC ASM or ASMLib disk group.

Creating an Oracle ASM Disk Group for Guarding

Creating a new ASM Disk Group

On this page

Suggest A Change