Please Note:

Integrations and Solutions
CTE Agent for AIX Integration Guide
- Using CTE with Oracle
  - CTE on Oracle ACFS Overview
  - Creating an Oracle ASM Disk Group for Guarding
  - Oracle RAC ASM
    - Important ASM Commands and Concepts
    - Determining Best Method for Encrypting Disks
    - General Prerequisites
    - Specific Prerequisites
  - About Oracle RAC ASM Raw Devices
  - Oracle RAC ASM Multi-Disk Online Method
  - Oracle RAC ASM Multi-Disk Offline Method (Backup/Restore)
  - Surviving the Reboot and Failover Testing
  - Basic Troubleshooting Techniques
- Using CTE with PowerTech Antivirus
CTE Agent for Linux Integration Guides
- Installing CTE on Hadoop
  - Overview
  - Implementing CTE on HDFS
    - Create an Encryption Zone in HDFS Name Space for AWS EMR
    - Using the Original Information from HDFS
    - Create an HDFS Host Group and GuardPoint in CipherTrust Manager
    - Adding a New DataNode to a CTE-protected HDFS
    - Configure NameNodes
    - Take a DataNode Offline and Perform Data Transformation
    - Implementing CTE on HDFS on a Single Host
  - Deploy Cloudera Hadoop on CTE
  - HDFS Upgrade with CTE
    - Configure the Hadoop Cluster for CTE
    - Create a CipherTrust Configuration Group
    - Update the Hadoop-env Template with CTE Settings
    - Modify the HDFS IOCTL
    - Change the HDFS File Rename Check
    - User Information Push
    - Uninstalling CTE for the Hadoop Cluster
  - CTE Installation and Configuration
    - Configuring Hadoop to Use CTE
  - Deleting Metadata in HDFS when Migrating Out of LDT
- Using CTE with Oracle
  - Basic Troubleshooting Techniques
    - Verifying Database Encryption
  - Oracle RAC ASM and ASMLib
    - Important ASM Commands and Concepts
    - Determining Best Method for Encrypting Disks
    - General Prerequisites
    - Specific Prerequisites
  - Oracle RAC ASMLib Multi-Disk Online Method
  - About Oracle RAC ASM Raw Devices
  - Oracle RAC ASM Multi-Disk Online Method
  - Oracle RAC ASM Multi-Disk Offline Method (Backup/Restore)
  - Surviving the Reboot and Failover Testing
  - Using CTE with Oracle ASM Filter Driver
    - Audience
    - Enable Oracle ASMFD for CTE
    - Configure CTE and create a guarded Oracle ASMFD
    - Convert a baseline ASMFD disk group to a CTE guarded ASMFD disk group using the Offline method
    - Convert a baseline ASMFD disk group to a CTE guarded ASMFD disk group using the Online method
    - Uninstall/ Upgrade CTE with active ASMFD Setup
  - Using Oracle with CTE-U
- Integrating and Configuring EDB
- Integration with Pacemaker
  - Performing CTE maintenance with an LDT GuardPoint in a Pacemaker Setup
  - Using CTE with Pacemaker
- Using CTE with SQL Server on Linux on Red Hat 8
- Configuring Support for SAP HANA
- Using CTE with GlusterFS
- NetApp Snapshot Directory
- Using CTE with Quantum StorNext
  - Overview of using CTE with Quantum StorNext
  - CTE and Quantum StorNext Compatibility
  - Setting up CTE and Quantum StorNext Integration
  - Stop secfs Before Upgrading StorNext LAN Clients
- Using CTE with McAfee Endpoint Security for Linux Threat Prevention
- Using CTE with Trend Micro Deep Security Software
- CTE for Cloud Object Storage
  - Overview
  - System and Software Requirements
  - Client Software Requirements
  - CTE COS S3 Installation Overview
  - Install Required Linux Packages
  - Install CTE with COS Service
  - Configure the AWS CLI to use the COS Root CA Certificate
  - Configure the AWS CLI Network Proxy
  - Configure CTE COS S3
  - Configure a CTE COS S3 Role for Guarded Buckets
    - Secure an S3 Bucket with the CTE COS S3 Role
    - Disable the CTE COS S3 Role for an S3 Bucket
  - Guard an AWS Bucket
  - Additional COS Proxy Root CA Certificate Information
  - Protecting Python Programs with CTE
  - Enable COS on an Agent with no COS Service
  - Creating a COS Policy
  - Uninstall COS from an Agent
- CTE-Efficient Storage for Linux
  - Introduction to CTE-Efficient Storage
    - CTE-Efficient Storage Enhanced Storage Arrays
    - Efficient Storage Device Header and CTE Private Region
    - Device Size
    - ES GuardPoint Encryption Keys
    - Policy Requirements for ES GuardPoints
  - Guarding an Efficient Storage Device on Linux
    - Requirements for Efficient Storage GuardPoints on Linux
    - Initialize Linux Efficient Storage Devices
    - Guard the Linux Device with an ES GuardPoint
      - Data Relocation on Existing Linux Devices
      - Data Transformation on Existing Linux Devices
    - Example of Creating an ES GuardPoint on an Existing Linux Device
  - Guarding a CTE-Efficient Storage Device with Multiple IO Paths on Linux
  - Linux System and ES GuardPoint Administration
    - voradmin ESG Commands on Linux
    - Viewing Device Status and the ES Header on Linux
    - File System Mount Points on Linux
    - Linux System Utilities for Signing
  - Changing the Encryption Key on Linux ESG Devices
  - Resizing Guarded Efficient Storage Devices
    - Example: Resizing a Linux Device
  - Use Cases involving Efficient Storage GuardPoints
    - Use Case 1: Single Encryption Key
    - Use Case 2: Device-Level GuardPoints
    - Use Case 3: Directory-Level GuardPoints
      - Challenges with Root Access on Linux
    - Best Practices for the Migration of a legacy Raw Device Guardpoint to an Efficient Storage Guardpoint
    - Migration Prerequisites
    - Migration
    - Use Case 4: Using CTE-Efficient Storage with LVM
  - Alerts and Errors on Linux
- CTE with Teradata Database Appliances
  - IDT-Capable GuardPoints and Teradata Database Appliances
  - Requirements and Considerations
  - Guarding a Teradata Database Device
    - Install CTE on the Teradata Database Appliance
    - Identify the Devices to Be Guarded
    - Select the Initial Configuration Method
    - Initialize and Guard the Database Devices Using the Standard Initialization Method
    - Initialize and Guard the Teradata Database Devices Using the Backup/Restore Method
  - Changing the Encryption Key on Teradata Devices
  - Access Rules to Apply on the Teradata Database Appliance
  - Replication of IDT Metadata Files Across Members of a Clique
  - Best Practices
  - Uninstalling CTE from the Teradata Cluster
  - Alerts and Errors
  - Generating IDT-capable Metadata for Teradata Storage Expansion
- Integrating CTE with an Exasol Database
- Integrating CTE with a Couchbase Database
- Integrating CTE with an EnterpriseDB Postgres Advanced Server
- Integrating CTE with a MongoDB database
- Integrating CTE with an Apache Cassandra database
- Integrating CTE with a Neo4j Database
CTE Agent for Windows Integration Guides
- Using CTE with Microsoft SQL AlwaysOn and SQL File Tables
  - Using CTE with Microsoft SQL
    - Using CTE with SQL
    - Using CTE with SQL FileTables
      - Supported FileTables Use Cases
      - Unsupported FileTables Use Cases
    - Installing CTE on Microsoft SQL AlwaysOn
    - Data Transformation (Encryption in place)
    - Copy/Restore
    - SQL Server Policy Tuning
  - Using LDT with Microsoft SQL
    - Using LDT with SQL AlwaysOn
    - Using LDT with SQL FILESTREAM
- CTE with DFSR
  - Overview
  - Creating Required DFSR Policy Components
  - Using the Standard Encryption Method
    - Creating Standard Policies for DFSR
    - Creating Standard GuardPoints with the DFSR Hub and Spoke Topology
    - Creating Standard GuardPoints with the DFSR Full Mesh Topology
  - Using the CTE-LDT Encryption Method
    - Creating a CTE-LDT Policy for DFSR
    - Creating a CTE-LDT GuardPoint for DFSR
- Secure Start
  - Secure Start Overview
  - Prerequisites
  - Encrypt by Moving the AD Service into a Guarded Directory
  - Encrypt Data in Place with Offline Transformation
  - Encrypt with an LDT Transformation Policy
  - Configure the Time Out Failure
  - Recover a Server After it Loses Connection to the Key Manager
  - Other Use Cases
  - Best Practices for Encrypting and Protecting the AD Service
- Exchange DAG
  - Exchange DAG Overview
  - CTE Policies for Exchange DAG
    - Creating a Policy for CTE-LDT Encryption with CipherTrust Manager
    - Creating Policies for Standard Encryption with CipherTrust Manager
  - Encrypting with CTE-LDT in an Exchange DAG Environment
  - Encrypting with a Standard CTE Policy in the Exchange DAG Environment
  - Decrypting with CTE-LDT in an Exchange DAG Environment
- Storage Spaces Direct
- Using CTE with Quantum StorNext
  - Overview of using CTE with Quantum StorNext
  - CTE and Quantum StorNext Compatibility
  - Setting up CTE and Quantum StorNext Integration
- CTE-Efficient Storage for Windows
  - Introduction to CTE-Efficient Storage
    - CTE-Efficient Storage Enhanced Storage Arrays
    - Efficient Storage Device Header and CTE Private Region
    - Device Size
    - ES GuardPoint Encryption Keys
    - Policy Requirements for ES GuardPoints
  - Guarding an Efficient Storage Device on Windows
    - Requirements for Efficient Storage GuardPoints on Linux
    - Limitations for ES GuardPoints on Windows
    - Initialize Windows CTE-Efficient Storage Devices
    - Guard the Windows Device with an ES GuardPoint
  - Windows System and ES GuardPoint Administration
  - Changing the Encryption Key for a Windows ES GuardPoint
  - Resizing Guarded Efficient Storage Devices
  - Use Cases involving Efficient Storage GuardPoints
    - Use Case 1: Single Encryption Key
    - Use Case 2: Device-Level GuardPoints
    - Use Case 3: Directory-Level GuardPoints
    - Use Case 4: Full Device Protection
  - Alerts and Errors on Windows
- Encrypt Microsoft OneDrive files with CTE

Using CTE with PowerTech Antivirus

When Powertech Antivirus is configured to use on-access scanning, CipherTrust Transparent Encryption Data Transformation may find files within the Data Transformation GuardPoint that are busy. These files are not processed by Data Transformation and are left unencrypted.

Note

This problem only occurs if Powertech is configured to use on-access scanning. This problem does not occur when using on-demand scanning.

Issue

When Powertech uses on-access scanning, it opens a file and keeps it open. Before the Data Transformation program encrypts a file, it checks to see if the file is in use by another process. If the file is in use, Data Transformation does not encrypt the file but rather appends the path to the file in the dataxform_status_error-<guardpoint> file located in /var/log/vormetric/. This prevents any retry of Data Transformation from succeeding.

Resolving PowerTech/Data Transformation "in-use" Errors

For the following scenario, Powertech is configured with on_access scanning and both Powertech and the Thales CTE agent have been installed at default locations. The example assumes the Data Transformation GuardPoint is /test-dataxform.

Running Data Transformation with Powertech Antivirus code deactivated

Type the following to prevent the Powerteck package from starting on system boot.
```
/opt/sgav/avsvcctl disable
```
Reboot the system.

After the system restarts, verify that Powertech is not running, type:

/opt/sgav/avsvcctl status

Response

The following output indicates Powertech is not running:
Subsystem Group PID Status
avsvc powertech inoperative
Device driver is not loaded

Perform a Data Transformation conversion on the Data Transformation GuardPoints.

Example
```
dataxform --rekey --gp /test-dataxform
```
Enable Powertech to start after system boot, type:
```
/opt/sgav/avsvcctl enable
```

Start Powertech, type:

/opt/sgav/avsvcctl start

Response

There is a delay before Powertech is completely loaded and active. The
Powertech status may be found by the following command.

Verify the status, type:

/opt/sgav/avsvcctl status

Response

The Powertech avsvc subsystem should be `active' and the device driver loaded:
Subsystem Group PID Status
avsvc powertech 5964286 active
Device driver is loaded
The avsvc subsystem is configured to run at boot

Recovering from Data Transformation/Powertech Antivirus code errors

A Data Transformation rekey performed while Powertech is active can result in failed file conversion due to "busy" faults. The following section describes how to recover from this type of error.

Note

There are many reasons that a data transformation may fail. This topic only considers the failure due to the interaction of Powertech with CTE. For other error recovery procedures, refer to the Data Transformation guide

The following section illustrates the process using an example data transformation and describes the steps needed to recover. The Data Transformation GuardPoint /test-dataxform.

Run Data Transformation.

dataxform --rekey --gp /test-dataxform

Response

Checking if /test-dataxform is a guardpoint with a rekey policy applied
/test-dataxform is a guardpoint with a rekey policy applied
About to perform the requested data transform operation
– Be sure to back up your data
– Please do not attempt to terminate the application
Do you wish to continue (y/n)?y
Scan found 19 files (14 MB) in 1 directories for guardpoint /test-dataxform
File /test-dataxform/xab is busy
File /test-dataxform/xaa is busy
Transformed 17 files (13 MB) of 19 files (14 MB) for guardpoint /test-dataxform
Data transform got errors on some files
File /test-dataxform/xab is busy
File /test-dataxform/xaa is busy
Number of files in error due to file being busy: 2
The data transform operation took 0 hours, 0 minutes and 3 seconds
The data transform program ran from Thu Feb 16 10:58:12 2023 until Thu Feb 16
10:58:15 2023
Data transform for guardpoint /test-dataxform finished but 2 files were not
processed due to errors

Inspect the error file (dataxform_status_error-_test-dataxform) for /test-dataxform. The file is located in /var/log/vormetric. The contents for the file contain the error messages generated by Data Transformation.

Example
```
Skipped, file is busy : /test-dataxform/xab
Skipped, file is busy : /test-dataxform/xaa
```
Note
Other Data Transformation errors may be present besides those caused by the Powertech antivirus code.
Create a "todo" file. Using Data Transformation, extract the names of the files that need to be retried for conversion.
```
dataxform --recovery --file_list my-output --gp /test-dataxform
```
This generates two files in the local directory
```
my-output_done
my-output_todo
```
The my-output_todo file contains the list of files to retry applying Data Transformation:
```
/test-dataxform/xaa
/test-dataxform/xab
```
Note
The my-output_todo file may need to be edited to remove entries not caused by the Skipped, file is busy error.
Turn off Powertech on boot, type:
```
/opt/sgav/avsvcctl disable
```
Reboot the system.

Verify the status.

/opt/sgav/avsvcctl status

Response

Subsystem Group PID Status
avsvc powertech inoperative
Device driver is not loaded

Re-issue Data Transformation to transform files listed in the my-output_todo file.

dataxform --rekey_list --gp /test-dataxform --file_list ./my-output_todo

Response

Checking if /test-dataxform is a GuardPoint with a rekey policy applied
/test-dataxform is a GuardPoint with a rekey policy applied
Previous status information does not relate to a --rekey_file operation.
Number of files previously in error due to file being busy: 2
About to perform the requested data transform operation
– Be sure to back up your data
– Please do not attempt to terminate the application
Do you wish to continue (y/n)?y
Starting data transform of /test-dataxform for files listed in ./my-output_todo
The data transform operation took 0 hours, 0 minutes and 2 seconds
The data transform program ran from Thu Feb 16 12:33:47 2023 until Thu Feb 16
12:33:49 2023

Re-enable Powertech on boot.
```
/opt/sgav/avsvcctl enable
```
Start Powertech.
```
/opt/sgav/avsvcctl start
```
There is a delay before Powertech is completely loaded and active. The Powertech status may be found by the following command:
```
/opt/sgav/avsvcctl status
```
The Powertech avsvc subsystem should be `active' and the device driver loaded:

Response

Subsystem Group PID Status
avsvc powertech 5964286 active
Device driver is loaded
The avsvc subsystem is configured to run at boot

Using CTE with PowerTech Antivirus

Issue

Resolving PowerTech/Data Transformation "in-use" Errors

Running Data Transformation with Powertech Antivirus code deactivated

Recovering from Data Transformation/Powertech Antivirus code errors

On this page

Suggest A Change