NetBackup legacy encryption restore process
The prerequisites for restoring a legacy encrypted backup are as follows:
The legacy encryption software must be loaded on the client.
Note:
The encryption software is automatically installed with the NetBackup UNIX server and client installations.
The encryption software must include the 40-bit DES library. The name of the 40-bit DES library is libvdes40.suffix; the suffix is so, sl, or dll depending on the client platform.
If the CRYPT_STRENGTH configuration option is set to DES_56, the encryption software must also include the 56-bit DES library. The name of the 56-bit DES library is libvdes56.suffix; the suffix is so, sl, or dll depending on the client platform.
A key file must exist as specified with the CRYPT_KEYFILE configuration option. You create the key file when you specify a NetBackup pass phrase with the server bpinst command or the client bpkeyfile command.
The server determines from the backup image whether the backup was encrypted. The server then connects to bpcd on the client to initiate the restore. The server sends to the client an encryption flag and backup time from the backup image on the restore request.
If the prerequisites are met, the following occurs:
The server sends file names, attributes, and encrypted file data to the client to be restored.
The client takes its key file data and merges it with the backup time to generate one or more 40-bit DES keys. If the 56-bit DES library is available, the client also generates one or more 56-bit DES keys.
If the client reads an encryption tar header, the client compares the checksum in the header with the checksums of its DES keys. If the checksum of a DES key matches the checksum in the header, NetBackup uses that DES key to decrypt the file data.
The file is decrypted and restored if a DES key is available. If the DES key is not available, the file is not restored and an error message is generated.