Search <book_title>...

Veritas NetBackup™ Deduplication Guide

Last Published: 2020-02-18

Product(s): NetBackup (8.2)

Upgrading KMS for MSDP

During the NetBackup upgrade, KMS rolling conversion runs along with MSDP encryption rolling conversion.

The supported NetBackup upgrade paths are:

NetBackup 7.7.3 to 8.1.2
NetBackup 8.0 to 8.1.1
NetBackup 8.1 to 8.1.1

For additional information, refer to the Configuring KMS section in the &CompanyNameShort; NetBackup Security and Encryption Guide.

Before you upgrade KMS, complete the following steps:

Note:

The following steps are not supported on Solaris OS. For Solaris, refer to the following article:

Upgrade KMS encryption for MSDP on the Solaris platform

Create an empty database using the following command:
- For UNIX:
  /usr/openv/netbackup/bin/nbkms -createemptydb
- For Windows:
  <install_path>\&CompanyNameShort;\NetBackup\bin\nbkms.exe -createemptydb
  Enter the following parameters when you receive a prompt:
  - Enter the HMK passphrase
    Enter a password that you want to set as the host master key (HMK) passphrase. Press Enter to use a randomly generated HMK passphrase. The passphrase is not displayed on the screen.
  - Enter HMK ID
    Enter a unique ID to associate with the host master key. This ID helps you to determine an HMK associated with any key store.
  - Enter KPK passphrase
    Enter a password that you want to set as the key protection key (KPK) passphrase. Press Enter to use a randomly generated HMK passphrase. The passphrase is not displayed on the screen.
  - Enter KPK ID
    Enter a unique ID to associate with the key protection key. This ID helps you to determine a KPK associated with any key store.
After the operation completes successfully, run the following command on the master server to start KMS:
- For UNIX:
  /usr/openv/netbackup/bin/nbkms
- For Windows:
  sc start NetBackup Key Management Service
Create a key group and an active key by entering the following commands:
- For UNIX:
  /usr/openv/netbackup/bin/admincmd/nbkmsutil -createkg -kgname msdp
  /usr/openv/netbackup/bin/admincmd/nbkmsutil -createkey -kgname msdp -keyname name - activate
- For Windows:
  <install_path>\&CompanyNameShort;\NetBackup\bin\admincmd\nbkmsutil.exe -createkg -kgname msdp
  <install_path>\&CompanyNameShort;\NetBackup\bin\admincmd\nbkmsutil.exe -createkey -kgname msdp -keyname name -activate
Enter a password that you want set as the key passphrase.
Create a kms.cfg configuration file at the following location on the NetBackup media server where you have configured the MSDP storage:
- On UNIX:
  /usr/openv/pdde/kms.cfg
- On Windows:
  <install_path>\&CompanyNameShort;\pdde\kms.cfg
Add the following content to the kms.cfg file:
```
[KMSOptions]
KMSEnable=true
KMSKeyGroupName=YourKMSKeyGroupName
KMSServerName=YourKMSServerName
KMSType=0
					
```
For KMSServerName, enter the hostname of the server where the KMS service runs, mainly the master server hostname.

After completing the steps, you can upgrade MSDP.