Name
nbkmiputil — executes the various external KMS server operations.
SYNOPSIS
-getKey -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path -keyId key_ID [-kadLength KAD_length] | -nbKeyGroup key_group_name [-kadLength KAD_length] | -kad key_associated_data [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-getDetails] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]
-listKeyIDs -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-nbKeyGroup key_group_name] [-activeKey] [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-getDetails] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-maxItems number] [-offset number] [-jsonCompact]
-setAttribute -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path -keyId key_ID -attributeName attribute_name -attributeValue attribute_value [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]
-validate -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]
-ekmsCheckCompat -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-kmipVersion version] [-jsonCompact]
On UNIX systems, the directory path to this command is /usr/openv/netbackup/bin/goodies/
On Windows systems, the directory path to this command is install_path\NetBackup\bin\goodies\
DESCRIPTION
The nbkmiputil executes the various external KMS server operations like retrieving keys, listing key IDs, setting key attributes, and validating KMS servers.
The command supports the following operations:
|
-ekmsCheckCompat |
Use -ekmsCheckCompat to determine if NetBackup is compatible with the specified external KMS server. You can also use this option to determine if the following KMIP operations are supported on the external KMS server: Discover supported versions; create, get, or locate keys; and get, set, modify, or delete attributes. |
|
-getKey |
Fetches the NetBackup keys from the external KMS server. |
|
-listKeyIDs |
Lists NetBackup key IDs that are present in the external KMS server as per the specified options. |
|
-setAttribute |
Sets the custom attribute for the given key in the external KMS server. Supported attribute names are x-application, x-keygroup, and x-comment. |
|
-validate |
Validates the related functionality with the external KMS server. The functionality that is validated includes:
|
OPTIONS
- -activeKey
Specifies whether to list only active NetBackup keys.
- -attributeName
Specifies the custom attribute name to be set. Supported attribute names are x-application, x-keygroup, and x-comment.
- -attributeValue
Specifies the custom attribute value to be set. Supported attribute value for attribute x-application : NetBackup.
- -certPath
Specifies the path of the PEM-encoded certificate that is to be used for authentication with the external KMS server.
- -connectTimeout
Specifies the time-out value to connect to the external KMS server in seconds. The default value is 120 seconds.
- -crlCheckLevel
Specifies the CRL check level. The possible values are: LEAF, CHAIN, and DISABLE. The default value is LEAF.
LEAF - Revocation status of peer's leaf certificate is checked.
CHAIN - Revocation status of full chain of peer certificate is checked.
DISABLE - Revocation status of peer certificate is not checked.
- -getDetails
Displays the additional key attributes details for the NetBackup keys.
- -jsonCompact
Specifies whether to display the output in JSON compact form.
- -kad
Specifies the key associated data (KAD) of the NetBackup key to be fetched from the external KMS server.
- -kadLength
Specifies the length up to which KAD of a NetBackup key is to be generated.
- -keyId
If -keyId is used with the -getKey option, it specifies the key ID of the NetBackup key to be fetched from the external KMS server. If it is used with the -setAttribute option, it specifies the key ID of the key for which a custom attribute is to be set.
- -kmsServer
Specifies the external KMS server name with which you want to connect.
- -kmipVersion version
Specifies the KMIP version to be used. Supported KMIP versions: 1.0, 1.1, 1.2, 1.3, 1.4, and 2.0.
- -maxItems
Specifies the maximum number of key IDs to be listed.
- -nbKeyGroup
If it is used with the -getKey option, it specifies the key group name whose active and latest key is to be fetched from the external KMS server. If it is used with the -listKeyIDs option, it specifies the key group name for which keys are to be listed.
- -offset
Specifies the offset number of the key ID from where the list of key IDs starts. The default value is 0.
- -passphrasePath
Specifies the path of the file containing the passphrase that is required to access the keystore for authentication with the external KMS server.
- -port
The port number in use by the external KMS server.
- -privateKeyPath
Specifies the path of the private key that is to be used for authentication with the external KMS server.
- -requestTimeout
Specifies the time-out value for the given request to external KMS server in seconds. Default value is 300 seconds.
- -trustStorePath
Specifies the path of the PEM-encoded CA certificate that is to be used for authentication with the external KMS server.
EXAMPLES
Example 1: Set custom attributes for the external KMS.
nbkmiputil -setAttribute -kmsServer example.veritas.com -port 5696 -certPath /usr/cert.pem -privateKeyPath /usr/key.pem -trustStorePath /usr/ca.pem -keyId EFF18E49-DBBF-4F84-BF94-13F4A6B6E32B -attributeName x-keygroup -attributeValue msdp