After you use the nzconfigcrypto command
to enable enhanced cryptography support on your Netezza Performance Server system, you could
encounter errors when starting the NPS software.
Table 1. Troubleshooting nzstart errors
| Message |
Problem |
Corrective Action |
nzstart: Error: Hostkey is not set.
Cannot start the system in SP800-131a mode |
An administrator might have changed the
host key to one that is not compliant with the enhanced crypto support
before stopping the NPS software. |
If you know the correct host key to use, use
the nzconfigcrypto -HK keystore.keyname -enable command
to set the host key and then re-run the nzstart command.
Otherwise, you can use this process:
- Use the nzconfigcrypto -disable command to
disable crypto support.
- Restart NPS by
using the nzstart command.
- Connect to a Performance Server database and use the SHOW SYSTEM DEFAULT HOSTKEY command to see
the current host key. You can also view the current keystores and keys to locate the host key, or
you can create a new AES-256 host key for the crypto support.
- Close the database connection and as the nz user, use the nzconfigcrypto
-HK keystore.keyname -enable command
to enable crypto support with the correct host key.
- Stop and restart the NPS software using the nzstop and nzstart commands.
|
nzstart: Error: Connection Authentication
types MD5 and CRYPT are not allowed in SP800-131a mode. |
Starting NPS in crypto
mode with MD5/CRYPT authentication type. MD5/CRYPT authentication
type is not allowed in crypto mode. |
See Updating connections for crypto support. |
nzstart: Error: Please drop the current
LDAP configuration and restart NPS with a new LDAP configuration. |
Starting NPS in crypto
mode without dropping old LDAP connection. Old LDAP connection/configuration
is not compatible with crypto mode and must be dropped and recreated. |
- Use the nzconfigcrypto -disable command to
disable crypto support.
- Restart NPS by
using the nzstart command.
- Connect to a Performance Server database and drop the current LDAP authentication by using the
SET AUTHENTICATION LOCAL command.
- Use the nzconfigcrypto -enable command to enable
crypto support.
- Stop and restart the NPS software using the nzstop and nzstart commands.
- Connect to a Performance Server database and restore the LDAP configuration by using the SET
AUTHENTICATION LDAP command
|
nzstart: Error: The DSA key used for
audit signing must be of type DSA_KEYPAIR_2048 in SP800-131a mode. |
Starting NPS in crypto
mode but the current audit history configuration is not digitally
signed and compatible with crypto mode. An administrator could have
changed the history configuration to one that is not digitally signed
with a key of type DSA_KEYPAIR_2048. After stopping the NPS software,
the NPS software
could not be restarted with the new audit configuration. |
- Use the nzconfigcrypto -disable command to
disable crypto support.
- Restart NPS by
using the nzstart command.
- Connect to a Performance Server database and use the SHOW HISTORY CONFIGURATION command to
review the current configuration. Look for values in the KEYSTORE_NAME and KEY_ALIAS fields, and use
the SHOW KEYSTORE <keystore_name> VERBOSE command to determine whether the host key is of type
DSA_KEYPAIR_2048.
- If the key is of a different type, you can change the audit history
configuration to specify a different DSA_KEYPAIR_2048 key. To alter
the current history configuration, you must set the history configuration
to another value, stop and restart the NPS software, then re-connect
to a database and use the ALTER HISTORY CONFIGURATION <name> KEY <keystore.keyname>
command. You can then set the history configuration to the altered
audit configuration.
- Close the database connection and as the nz user, use the nzconfigcrypto
-HK keystore.keyname -enable command
to enable crypto support.
- Stop and restart the NPS software using the nzstop and nzstart commands.
|