Security

The Security page allows you to configure security settings for the DXi6900, including access passwords, LDAP/AD, SSL settings, and the inactivity timeout.

To access the Security page, click the Configuration menu, and then click the Security tab.

The Security page contains the following tabs:

The Local Access page allows you to change the account passwords for the remote management console (GUI) and the command line interface (CLI).

The DXi6900 has the following access levels for logging onto the remote management console or the GUI:

Local Access Level Description
Graphical User Interface (GUI)
GUI Administrator Allowed to view and change information on the DXi6900 remote management console.
GUI Monitor Allowed to view information on the DXi6900 remote management console but cannot make changes.The Access Control page is view only.
GUI Service Allowed to view and change information on the DXi6900 GUI. The Access Control page is view only.
Command Line Interface (CLI)
Viewer Allowed to view information on the DXi6900 CLI  but cannot make changes.
Administrator Allowed to view and change information on the DXi6900 CLI.
Service Login
SSH/CLI Service Allow Secure Shell (SSH) remote access to the ServiceLogin account.

To access the Local Access Settings page, on the Security page, click the Local Access tab.

Tasks

Use the Local Access Settings page to perform the following tasks:

Use the GUI password when logging onto the remote management console as an administrator (see Accessing Remote Management).

  1. Under GUI Administrator enter the following information:

    Old Password Enter the old password.
    New Password Enter the new password.
    Confirm New Password Enter the new password again to confirm it.

    Additional Information

    • Disabling the GUI Administrator - You cannot disable this account unless LDAP/AD is enabled. In addition, you must also be logged in to the system as an LDAP/AD user (see LDAP/AD).
    • Passwords can be up to 32 characters. Alphanumeric characters and special characters are allowed.
    • Loss of this password will require Quantum service support.
  2. Click Apply.

Use the GUI password when logging onto the remote management console as a monitor (see Accessing Remote Management).

  1. Under GUI Monitor do one of the following steps:

    • Select the Enable account check box to enable the GUI monitor account.
    • Clear the Enable account check box to disable the GUI monitor account.

  2. Enter the following information:

    New Password

    Enter the new password.
    Confirm New Password Enter the new password again to confirm it.

    Additional Information

    Passwords can be up to 32 characters. Alphanumeric characters and special characters are allowed.

  3. Click Apply.

The CLI accounts provide access to the DXi6900 command line interface as an administrator or viewer.

Note: For more information about using the CLI, see the DXi6900 Command Line Interface (CLI) Guide.

  1. Under CLI Administrator or CLI Viewer, do one of the following steps:

    • Select the Enable account check box to enable the CLI administrator or viewer account
    • Clear the Enable account check box to disable the CLI administrator or viewer account

  2. The CLI administrator and view accounts may be configured with Secure Shell (SSH) key-based authentication.

    Add an SSH Public Key

    1. Click Add.

      The Add Public Key page displays.

    2. Enter an SSH Alias for the public key.

      Additional Information

      • An alias can be up to 20 characters.
      • Alias must be an alphanumeric string (no spaces or special characters).
      • It is OK to have the same alias for different accounts (CLI Administrator and CLI Viewer).

    3. Copy and paste the Public Key generated from a SSH key.

      Additional Information

      • A public key should be in the following form: <key-type> <base64 encoded string>.
      • A public key length can be up to 16kb.

    4. Click Apply.

      The "Successfully performed Security action" message appears.

    5. Click OK.

      The new key appears in the CLI Administrator or View Available SSH Public Keys table.

      The Available SSH Public Keys table contains the following information:

      Alias Name of key.
      Fingerprint Short sequence of bytes used to identify a public key.

    Edit an SSH Public Key

    1. Select the check box next to the public key in the Available SSH Public Keys table.

    2. Click Edit.

      The Edit Public Key page displays.

    3. Edit the Alias name.

      Note: The key cannot be modified. To remove a key, see Delete an Alias Name.

    4. Click Apply.

      The "Successfully performed Security action" message appears.

    5. Click OK.

      The updated key appears in the Available SSH Public Keys table.

    Delete an Alias Name

    1. Select the check box next to the public key in the Available SSH Public Keys table.

    2. Click Delete.

      The Delete Public Key page displays.

    3. Click Yes.

      The "Successfully performed Security action" message appears.

    4. Click OK.

      The key is removed in the Available SSH Public Keys table.

  3. In addition to configuring SSH authentication, the CLI Administrator and view accounts may also be configured with password authentication.

    • Select the Allow login with password check box to enable a password on a CLI Administrator or CLI Viewer account
    • Clear the Allow login with password check box to disable a password on a CLI Administrator or CLI Viewer account

    Enter the following information:

    New Password Enter the new password.
    Confirm New Password Enter the new password again to confirm it.

    Additional Information

    • Passwords can be up to 32 characters. Alphanumeric characters and special characters are allowed.
    • For accounts enabled with both SSH and password authentication, the DXi system will first attempt SSH authentication . If there are no keys defined or no client key matches, the DXi system will fall back to password authentication.
  4. Click Apply.

Use the GUI password when logging onto the remote management console as a service account (see Accessing Remote Management).

To enable or disable the GUI service account:

  1. Under GUI Service do one of the following steps:

    • Select the Enable account check box to enable the GUI service account.
    • Clear the Enable account check box to disable the GUI service account.

  2. Enter the following information:

    New Password Enter the new password.
    Confirm New Password Enter the new password again to confirm it.

    Additional Information

    • Passwords can be up to 32 characters. Alphanumeric characters and special characters are allowed.

  3. Click Apply.

The SSH service account provides SSH remote access to the DXi6900 system.

  1. Under SSH Service, do one of the following steps:

    • Select the Enable account check box to enable SSH service account
    • Clear the Enable account check box to disable the SSH service account

  2. The SSH service account may be configured with Secure Shell (SSH) key-based authentication.

    Add an SSH Public Key

    1. Click Add.

      The Add Public Key page displays.

    2. Enter an SSH Alias for the public key.

      Additional Information

      • An alias can be up to 20 characters.
      • Alias must be an alphanumeric string (no spaces or special characters)..

    3. Enter the Public Key generated from a SSH key.

      Additional Information

      • A public key should be in the following form: <key-type> <base64 encoded string>.
      • A public key length can be up to 16kb.

    4. Click Apply.

      The "Successfully performed Security action" message appears.

    5. Click OK.

      The new key appears in the Available SSH Public Keys table.

      The Available SSH Public Keys table contains the following information:

      Alias Name of key.
      Fingerprint Short sequence of bytes used to identify a public key.

    Edit an SSH Public Key

    1. Select the check box next to the public key in the Available SSH Public Keys table.

    2. Click Edit.

      The Edit Public Key page displays.

    3. Edit the Alias name.

      Note: The key cannot be modified. To remove a key, see Delete an Alias Name.

    4. Click Apply.

      The "Successfully performed Security action" message appears.

    5. Click OK.

      The updated key appears in the Available SSH Public Keys table.

    Delete an Alias Name

    1. Select the check box next to the public key in the Available SSH Public Keys table.

    2. Click Delete.

      The Delete Public Key page displays.

    3. Click Yes.

      The "Successfully performed Security action" message appears.

    4. Click OK.

      The key is removed from the Available SSH Public Keys table.

  3. In addition to configuring SSH authentication, the SSH service account may also be configured with password authentication.

    • Select the Allow login with password check box to enable a password on a CLI administrator or CLI viewer account
    • Clear the Allow login with password check box to disable a password on a CLI administrator or CLI viewer account

    Enter the following information:

    New Password Enter the new password.
    Confirm New Password Enter the new password again to confirm it.

    Additional Information

    • Passwords can be up to 20 characters. Alphanumeric characters and special characters are allowed.
    • For accounts enabled with both SSH and password authentication, the DXi system will first attempt SSH authentication . If there are no keys defined or no client key matches, the DXi system will fall back to password authentication.
  4. Click Apply.

The LDAP/AD page allows the DXi6900 system to connect to a Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) server.

Lightweight Directory Access Protocol (LDAP) stores information about users and groups in a hierarchical directory composed of organizational units (OUs), object classes, and attributes. Microsoft Active Directory (AD) stores information about Users and Groups. The DXi6900 can use LDAP/AD to authenticate user credentials and assign access levels to the system.

LDAP and AD Terms

 

Common Name (CN)

An attribute that is commonly used to identify the name of Organizational Unit (OU).

Example

The SysAdmin group would have cn=sysadmin.

Domain Component (DC)

The domain of the directory, which often identifies the organization or company.

Example

Mycompany.com would have a domain of dc=mycompany,dc=com.

Distinguished Name (DN)

A pathway that tells LDAP where information is stored in its directory. LDAP reads the pathway from right to left, with the farthest right components providing the domain of the directory and the farthest left component providing the information for which LDAP is looking.

Organizational Unit (OU)

A component used to organize information into a hierarchical structure. OUs can be used at multiple levels within the LDAP or AD directory, such as to act as a larger Group bucket that then holds individual group OUs.

Tasks

Use the LDAP/AD page to perform the following tasks:

  1. Select the Enable LDAP/AD check box to enable the Connection Settings and Search Strings tables.

  2. Enter the following Connection Settings information:

    Primary Server Domain

    Enter the LDAP/AD domain server.

    LDAP Server Cache

    • If the LDAP domain server is changed once LDAP is enabled, the server cache will allow user credentials from the previous LDAP server to authenticate until the cache times out (default setting is 90 minutes).
    • If the new LDAP domain server is invalid, user credentials from the previous LDAP server will continue to authenticate from the server cache.
    Alternate Server Domain (Optional) Enter an alternate LDAP/AD domain server
    StartTLS/LDAPS

    Select one of the following:

    • Start TLS - Select to encrypt the connections to the LDAP/AD server. This enables a secure connection over a standard port. Do not enable Start TLS to encrypt connections if the server URL uses a secure protocol (LDAPS).
    • LDAPS - Select if the server URL uses the LDAPS secure protocol.
    Port
    • Start TLS - Default port is 389.
    • LDAPS - Default port is 636.

    Note: Entering a port setting will disable the default port settings.

    Certificate URL

    Enter the URL where the Certificate Authority (CA) certificate in PEM format can be downloaded from.

    CA Certificate Expiration Alerts

    The following system alerts occur as a certificate approaches expiration:

    • 14 days from expiration - An admin alert is created (see Admin Alerts).
    • 3 days from expiration - If the local GUI Admin account is enabled, an admin alert is created (see Admin Alerts). If the local GUI Admin account is disabled, a service ticket is created (see Service Tickets).
    • 1 day from expiration - If the local GUI Admin account is enabled, an admin alert is created (see Admin Alerts). If the local GUI Admin account is disabled, the account is enabled and a service ticket is created (see Service Tickets).
    Principal (bind) DN

    Enter the domain name of the principal user. The principal user is any user who is authorized to add a system to the LDAP or AD domain.

    Example - uid=admin,ou=People,dc=mycompany,dc=com
    Password Enter the password for the simple authentication.
    Confirm Password Re-enter the password for the simple authentication.

  3. Enter the following Search Strings information:

    User DN

    Enter a distinguished name for retrieving user information.

    Example - dc=mycompany,dc=com
    Monitor Group

    Enter a distinguished name or common name for the monitor users allowed on the DXi system. One one group (Monitor or Admin) is required for LDAP/AD configuration.

    Example - cn=user,ou=Group,dc=mycompany,dc=com

    Note: OpenLDAP servers require the Slapo-MemberOf overlay to be installed on the server. Refer to http://manpages.courier-mta.org/htmlman5/slapo-memberof.5.html for more information on the overlay.

    Admin Group

    Enter a distinguished name or common name for the admin users allowed on the DXi system. One one group (Monitor or Admin) is required for LDAP/AD configuration.

    Example - cn=sysadmin,ou=Group,dc=mycompany,dc=com

    Note: OpenLDAP servers require the Slapo-MemberOf overlay to be installed on the server. Refer to http://manpages.courier-mta.org/htmlman5/slapo-memberof.5.html for more information on the overlay.

  4. (Recommended) Test the LDAP/AD settings before applying the settings to the DXi system (see Test LDAP/AD Settings).

    Note: User LDAP/AD settings must be applied before being tested. See step 6 below.

  5. (Recommended) Test LDAP/AD usernames and passwords before applying the LDAP/AD settings to the DXi system (see Test LDAP/AD User).

  6. Click Apply. Changes to LDAP/AD settings forces a log out of the DXi system. Click Yes to continue.

De-select the Enable LDAP/AD check box to disable LDAP/AD on the DXi6900 system. The LDAP/AD settings remain saved.

Click Test Settings to test the connection settings between the DXi6900 system and LDAP/AD domain server. A successful connection will be indicated by a Success dialog box. A test connection that fails will be indicated by a Failure dialog box containing the reason for the failure.

Note: User LDAP/AD setting changes must first be applied before being tested.

  1. Click Test User to test the ability of a LDAP/AD user to successfully log into the DXi6900 system. The Test Username and Search Strings dialog box opens.

  2. Enter the following information:

    Username Enter the user name.
    Password Enter the user password.
  3. Click Test.

The SSL/TLS page allows you to enable or disable SSL/TLS on the DXi6900. You can also install a new SSL certificate to replace the Quantum default SSL/TLS certificate.

To access the SSL/TLS page, on the Security page, click the SSL/TLS tab.

Additional Information

  • If you enable SSL,/TLS see Server Authentication Warnings for important information about Web browser settings.

  • SSL/TLS is automatically enabled by default after a fresh installation of DXi software.

Tasks

  • Use the SSL/TLS page to perform the following tasks:
  • Enable or disable SSL/TLS on the DXi6900 (see Enabling SSL/TLS).

SSL (Secure Sockets Layer)/TLS (Transport Layer Security) is a protocol that provides security and privacy over the Internet by negotiating encryption keys before transmitting data between a client and a server.

To establish a secure connection, the DXi6900 must have an encryption key assigned to it by a Certification Authority in the form of a certificate file, private key file, and pass phrase. After you install these components, you can establish a secure connection using the SSL/TLS protocol. The DXi6900 comes with a Quantum default SSL/TLS certificate.

To enable or disable SSL/TLS:

1. Under SSL/TLS Properties, select the Enable SSL/TLS option to enable SSL/TLS.

Or select the Disable SSL/TLS option to disable SSL/TLS.

Note: The default setting is disabled.

2. Click Apply.

Enabling SSL/TLS with the default Quantum certificate allows you to securely communicate with the DXi6900 Web-based interface using SSL/TLS encryption. However, you may receive a warning from your Web browser and network security scanners stating that the server you are attempting to connect to does not match the server embedded within the certificate.

This is expected behavior because the default certificate can only be used for encryption and not server authentication. Quantum recommends the default Quantum certificate be replaced with your own official certificate specific to your DXi system. You can install your own custom certificate in order to take advantage of server authentication in addition to encrypted communication.

To suppress server authentication warnings for the default certificate:

  • Internet Explorer - If a dialog box displays warning you of a possible certificate error, add the IP address for the DXi6900 to the Trusted Sites list (Tools > Internet Options > Security > Trusted Sites). If subsequent warning pages display along with an option to close your Web browser or continue to the Web site, click Continue. This suppresses the warnings until you restart your Web browser.
  • Firefox and Chrome - If the Secure Connection Failed dialog box displays, click the link at the bottom of the dialog box and follow the instructions to add an exception for your DXi6900.

You can purchase and install your own custom SSL/TLS certificate in order to take advantage of server authentication in addition to encrypted communication on the DXi6900.

To install an SSL/TLS certificate:

  1. Under Certificate, click New.

    The Install New Certificate page displays.

  2. In the Certificate File box, type the location and filename of the new SSL/TLS certificate file.

    Or click Browse to browse the system and locate the SSL/TLS certificate file. The SSL/TLS certificate file must be named server.crt.

  3. Click Upload.
  4. Type your SSL/TLS private key and press <Enter>.

  5. Type your SSL/TLS passphrase and press <Enter>.

    A Successful Upload page displays stating that the SSL/TLS certificate file has been installed on the system.

  6. Click OK.

    The certificate displays in the Certificate section.

The Data Encryption page allows you to select the type of encryption to use for Replication, OST, and Accent data transfers. Data sent from the media server (OST/Accent) or source DXi (Replication) to the DXi can be encrypted using AES (Advanced Encryption Standard) encryption methods.

To access the Data Encryption page, on the Security page, click the Data Encrypton tab.

Important Information

  • If TLS with AES 256 is selected, the factory installed certificates are inadequate for security. The factory installed certificates should be considered public domain and are provided only for convenience. You must install new certificates for secure encryption.

  • The DXi uses the TLS with AES 256 certificate authority as the arbiter of trust. To ensure the security of your data on the DXi blockpool, you must generate your own private certificate authority.
  • Installing new certificates requires a reboot of the system.

To enable or disable data encryption:

  1. Select an Encryption option in OST and Accent Data Transfer Encryption:

    None Data is not encrypted.
    Default AES 128 OST and Accent data is encrypted using AES 128-bit encryption.
    Default AES 256 OST and Accent is encrypted using AES 256-bit encryption.
    TLS with AES 256

    OST, Accent, and Replication data is encrypted using AES 256-bit encryption with Transport Layer Security (TLS).

    For replication, you must specify encryption settings when configuring the replication or failback targets (see Replication ).

    Note: AES encryption options are available only if the Data-in-Flight license is installed (see License Keys).

  2. If you selected the TLS with AES 256 encryption option, install the required TLS Certificate and key files on the DXi :

    • Certificate File
    • Private Key File
    • Certificate Authority File
    • Certificate Revocation List (Optional)

    OST Media Server with TLS Encryption

    The certificate and key files installed on the DXi system must match the files on the OST media server. For more information on certificate and key files, see the OST Plug-in Installation Instructions.

    Replication with TLS Encryption

    To successfully use replication with TLS encryption, you must do the following:

    • Configure target DXi with TLS Encryption.
    • Configure source DXi with TLS Encryption (system reboot required).
    • Select TLS with AES 256 when configuring the target DXi (see Adding a Replication Target).

    The source DXi key and target DXi key do not need to match, but must meet the following criteria:

    • The target key must be signed by a certificate in the source key.
    • The source key must be signed by a certificate in the target key.

    To install a file, click the Browse button to browse the system and locate the file, and then click Open.

    Caution: Installing certificate files requires a system reboot immediately after the changes are applied. Wait for at least 15 minutes before logging back in.

    Note: You can install new certificate and key files at any time, as long as there are no active network connections between the server and the DXi .

  3. Click Apply.

    Note: To clear all changes without saving them, click Reset. To remove user installed certificate and key files, click Restore Factory Defaults.

The Login Session page allows you to specify the inactivity timeout for the DXi6900 remote management console. The default timeout is 30 minutes.

When the remote management console is inactive for the specified period of time, the user is automatically logged off and must log back on to continue (see Accessing Remote Management).

To access the Login Session page, on the Security page, click Login Session.

To specify the inactivity timeout:

  1. In the Inactivity Timeout box, enter the number of minutes of inactivity before a user is automatically logged off (1–600 minutes).
  2. Click Apply.

The Security Notice page allows you to specify a message that will appear to all users when logging on to the remote management console or the CLI (command line interface).

If a security notice message has been specified, the user must accept the message in order to begin using the system. If no security notice has been specified, the user can use the system immediately after logging on.

To access the Security Notice page, on the Security page, click Security Notice.

To add or update a security notice message, enter the message in the box and click Apply.

The Data-at-Rest page allows you to enable Data-at-Rest Encryption on the DXi6900 and manage security keys.

DXi6900

Data-at-Rest Encryption uses Self Encrypting Drive (SED) technology to secure all data stored on the DXi6900. This includes file data and metadata, configuration files, and the DXi software and operating system. To enable Data-at-Rest Encryption, you must supply a passphrase. The passphrase ensures that all physical disks are paired with their respective controllers, and that data can only be read back from the disk by the same controller that wrote it. If a controller must be replaced, the passphrase is needed to enable the new controller to access the data on the physical disks.

To enable Data-at-Rest Encryption, the feature must be licensed, and all of the drive controllers and hard drives (active and hot spares) in the DXi must support Self Encrypting Drive (SED) technology (not available in all regions). A DXi6900 configuration with all 4TB SED hard drives in the Array (RBOD)/Expansion (EBOD) modules and 1.2 TB SED hard drives in the Node meets the requirements for Data-at-Rest Encryption.

DXi6900-S

Data-at-Rest Encryption uses Self Encrypting Drive (SED) technology to secure all customer data stored on the DXi6900-S Arrays. To enable Data-at-Rest Encryption, you must supply a passphrase. The passphrase ensures that all physical disks are paired with their respective Array controllers, and that data can only be read back from the disk by the same controller that wrote it. If a controller must be replaced, the passphrase is needed to enable the new controller to access the data on the physical disks.

To enable Data-at-Rest Encryption, the feature must be licensed, and all of the drive controllers and hard drives (active and hot spares) in the DXi must support Self Encrypting Drive (SED) technology (not available in all regions). A DXi6900-S configuration with all 8 TB SED hard drives in the Array (RBOD)/Expansion (EBOD) modules meets the requirements for Data-at-Rest Encryption.

Note: The Data-at-Rest page displays only if the Data-at-Rest Encryption feature is supported on the DXi6900 and is licensed for use. For information about installing the Data-at-Rest Encryption license, see Licensing Data-at-Rest Encryption and Obtaining Premium Feature Keys.

Caution: After you enable Data-at-Rest Encryption, you cannot disable it or turn it off. Make sure to back up your passphrase and recovery files, as they may be required for future capacity expansion or in certain, rare hardware failure scenarios (see Managing Recovery Files).

To access the Data-at-Rest page, on the Security page, click the Data-at-Rest tab.

Tasks

Use the Data-at-Rest page to perform the following tasks:

The current status of Data-at-Rest Encryption can be Disabled (default) or Enabled. If it is enabled, all drives in the DXi6900 are securely encrypted and cannot be read if removed from the system.

Click Check Status to view detailed information about the status of Data-at-Rest Encryption and to see if the DXi6900 supports all requirements for enabling the feature.

When Data-at-Rest Encryption is enabled, all hard drives in the DXi6900 are paired to their respective RAID controllers using encryption keys. These keys are generated using a passphrase that you supply.

Note: Before you can enable Data-at-Rest Encryption, you must install the required license (see Licensing Data-at-Rest Encryption and Obtaining Premium Feature Keys). You must also upload a Premium Feature Key (PFK) file for each Array module in the DXi6900 (see Uploading a PFK File).

Caution: Make sure you are certain you want to enable Data-at-Rest Encryption before proceeding. After you enable Data-at-Rest Encryption, you cannot disable it or turn it off.

To enable Data-at-Rest Encryption:

  1. Verify that the system is in an optimal state:

    • All hardware statuses on the system are Normal (see Hardware).

      Caution: All storage arrays must show Normal condition (see Details). If any storage arrays are degraded, do not enable Data-at-Rest Encryption.

    • All outstanding administration alerts are deleted (see Admin Alerts).
    • All service tickets are closed (see Service Tickets).

  2. Under Enable Data-at-Rest Encryption, type a security passphrase in the Passphrase box.

    Caution: If you are re-enabling Data-at-Rest Encryption, you must enter the same passphrase that was used when encryption was originally enabled.

    The passphrase must meet all of the following requirements:

    • Must be 8–32 characters long.
    • Must contain at least 1 digit [0–9].
    • Must contain at least 1 uppercase letter [A–Z].
    • Must contain at least 1 lowercase letter [a–z].

    • Must contain at least 1 non-alphanumerical character, for example, ‘+’ or ‘@’.

      Note: An underscore [ _ ] is considered an alphanumeric character.

    • Must not contain a space, tab, single quote [‘], double quote [“], or dollar sign [$].
  3. Enter the passphrase again in the Confirm Passphrase box.
  4. Click Enable.

Data-at-Rest Encryption is now enabled, and all hard drives are secured so that, if they are removed from the DXi6900, they cannot be read using another system or device.

Be sure to record the passphrase in a safe location. You should also save a backup copy of the Data-at-Rest Recovery file (see Managing Recovery Files).

When Data-at-Rest Encryption is enabled, the system generates security keys based on the supplied passphrase. The DXi6900 maintains a copy of the security keys on the system, and they are accessed automatically as needed.

There are a few, rare situations which may require manual entry of the passphrase, such as performing a capacity expansion, or in certain hardware failure scenarios. The Data-at-Rest Recovery file is a password protected .xml file that contains an encryption key identifier and passphrase for the controller. The encryption key identifier provides the system serial number, product ID, and location for the controller.

Figure 1: Sample Data-at-Rest Recovery File

?xml version="1.0" encoding="UTF-8"?>

<xml>

<EncryptionKeyAttributes>

<LastModified>Tue May 08 17:14:29 2018</LastModified>

<SASAddress>500605b00cb96080</SASAddress>

<EncryptionKeyIdentifier>YM6D003111-EP420e-a0</EncryptionKeyIdentifier>

<Passphrase>SamplePassword</Passphrase>

</EncryptionKeyAttributes>

</xml>

To download or send a copy of the recovery file:

  1. Under Download/Send Data-at-Rest Recovery File, select an option:

    Download Downloads a copy of the recovery file using the Web browser.
    Email Sends a copy of the recovery file using e-mail. If selecting this option, type the e-mail address where you want to send the recovery file in the Email Recipient box.

    Note: For the DXi6900 to send an e-mail, you must specify an outgoing e-mail server (see Email).

  2. Type a security password in the Password box, and type it again in the Confirm Password box.

    This password is used to protect the recovery file. You will be prompted for this password when opening the recovery file.

    The password must meet all of the following requirements:

    • Must be 8–32 characters long.
    • Must contain at least 1 digit [0–9].
    • Must contain at least 1 uppercase letter [A–Z].
    • Must contain at least 1 lowercase letter [a–z].

    • Must contain at least 1 non-alphanumerical character, for example, ‘+’ or ‘@’.

      Note: An underscore [ _ ] is considered an alphanumeric character.

    • Must not contain a space, tab, single quote [‘], double quote [“], or dollar sign [$].
  3. Click Apply.

For the download option, click OK or Save to save the recovery file to your computer. For the e-mail option, the recovery file is automatically sent to the e‑mail address you specified.

Keep a copy of the recovery file in a safe location in case it is needed later. The recovery file is a password-protected ZIP format file. To unzip the file, you must enter the password specified in step 2 above. The recovery file contains the passphrase used to enable Data-at-Rest Encryption as well as the security keys.

To enable Data-at-Rest Encryption, a Premium Feature Key (PFK) file is required for each Array module in the DXi6900. After you have uploaded a PFK file to an Array module, it can be enabled for Data-at-Rest Encryption.

Typically you will upload a PFK for each Array module prior to enabling Data-at-Rest Encryption. A PFK file must also be uploaded when adding an Array module to a DXi6900 that has Data-at-Rest Encryption enabled, or else the module will not be encrypted.

Note: The Upload Premium Feature Key (PFK) File section displays only if a PFK file is required. For instructions on how to obtain the required PFK file for each Array module, see Licensing Data-at-Rest Encryption and Obtaining Premium Feature Keys.

Note: Before uploading a PFK file, make sure you are using a supported Web browser (see Supported Browsers on page 50).

To upload a PFK file to an Array module:

1. Under Upload Premium Feature Key (PFK) File, select an Array module in the Storage Array drop-down box. The PFK will be uploaded to this module (Qarray1 or Qarray2) (Qarray1, Qarray2, or Qarray3).

The following information displays:

Qarray ID - The identification number of the Array module.

Feature ID - The feature identification number of the Array module.

PFK Installed - The PFK status (No for not installed, or Yes for installed).

Note: The Qarray ID and Feature ID are required to initially obtain the PFK file. If a PFK is already installed, there is no need to upload a PFK file.

2. In the PFK File Upload box, type the location and filename of the PFK file. Or click the button to browse the system and locate the PFK file.

Caution: If you are uploading more than one PFK file, check the file names carefully, and make sure to upload the correct file to each Array module.

3. Click Upload.

The PFK file is uploaded to the selected Array module. The module can now be enabled for Data-at-Rest Encryption.