Disabling the encryption recovery key

The encryption recovery key can be disabled using either the management GUI or the command-line interface.

Note: For security, encryption methods (including the recovery key) can only be disabled when physically connected to the technician port on the configuration node.

Using the management GUI

When disabling encryption using the management GUI, encryption recovery key is automatically disabled in the process. See Decommissioning encryption for instructions on disabling encryption using the management GUI.

To disable only the encryption recovery key, refer to the instructions described in Using the command-line interface.

Using the command-line interface

Follow these steps to disable the encryption recovery key:

  1. Identify the configuration node of the system. For more information, see Configuration node.
  2. Connect your computer to the technician port of the configuration node. For more information, see the Node canisters page in the relevant Hardware Guide.
  3. In a terminal window, use Secure Shell (SSH) software to connect to the cluster IP address of the system and authenticate using the credentials of any user with the SecurityAdmin role:
    ssh username@cluster_ip

    For more information, see Connecting to the CLI with OpenSSH.

  4. To disable the encryption recovery key, enter the following command:
    chencryption -recoverykey disable

    For more information, see chencryption command.

  5. The recovery key has been disabled successfully when the recovery_key_name field is blank and the recovery_key_status field is licensed. For more information, see lsencryption command.