IBM Global Security Kit configuration

Edit online

IBM® Storage Protect Snapshot uses the security suite IBM Global Security Kit (GSKit), for Secure Socket Layer (SSL) and Transport Layer Security (TLS) TCP/IP connections. GSKit supports Federal Information Processing Standards (FIPS140-2) and also incorporates the security standards as defined in the Special Publications 800131 (SP 800-131). GSKit is automatically installed by IBM Storage Protect Snapshot.

This security standard requires longer key lengths, stronger cryptographic algorithms, and incorporates TLS Protocol version 1.2.

During the installation, IBM Storage Protect Snapshot automatically creates a new key pair and a self-signed certificate if no default certificate exists. The key pair is stored in the local key database file. The self-signed certificate is created from the key pair and automatically distributed to all backup servers by the setup script through the existing SSH remote deployment mechanisms.

If you do not use the SSH remote deployment capabilities of IBM Storage Protect Snapshot, you must complete the following steps:

  1. Globally install GSKit on each server by activating the instance. The required installation files are available in the gskit_install subdirectory of the IBM Storage Protect Snapshot instance directory.
  2. Manually copy the fcmselfcert.arm file to the backup server. The manually copied certificate is imported automatically when the setup script is run on the backup server.
  • To install or reinstall GSKit separately, enter the command, ./setup_gen.sh -a install_gskit -d <instance directory>

Alternatively, use a CA-signed certificate. The signed certificate can be from an internal or external certificate authority (CA). When SP800-131 encryption is enforced by setting the ENFORCE_TLS12 profile parameter to YES in the IBM Storage Protect Snapshot profile, the signed certificate must comply with the standard as defined by the National Institute of Standards and Technology (NIST) SP800-131 standard encryption. This standard requires a minimum key size = 2048 bits and a signature algorithm = RSA with SHA-224 or higher. Import the CA-signed certificate to the key database on the production server.

If you use a standard CA-signed certificate, you do not need to handle fcmselfcert.arm files. You must import the CA-signed certificate manually into the production server key ring. Use the GSKit command-line utilities to import the certificate to the production server. If the CA-signed certificate is not a standard certificate that GSKit has a root certificate for, you must import the certificate to all sites. No further action is necessary on the auxiliary servers.

The following GSKit files are installed by IBM Storage Protect Snapshot:
  • A key database file, fcmcert.kdb, is in the instance directory.

    The KDB file on the production server contains a new key pair and a self-signed certificate. On the backup and cloning servers, the KDB file contains the public part of the self-signed certificate.

  • A request database file, fcmcert.rdb, is in the instance directory.

    The request database file is used to store certificate requests that are associated with the key database. This file is automatically created when IBM Storage Protect Snapshot creates a key database file.

  • An encrypted stash file, fcmcert.sth.

    The password that is protecting the key database file is generated automatically and is stored in the encrypted stash file.

  • An ASCII encoded binary file, fcmselfcert.arm.

    This file is used to export the public part of the self-signed certificate. It is also used to import the public part of the self-signed certificate to the backup and cloning servers.

    When you install backup and clone servers separately without the use of SSH, the installation process installs and sets up IBM GSKit. In this scenario, after IBM GSKit installation, manually copy fcmselfcert.arm file to the backup and cloning servers.

  • A certificate revocation list file, fcmcert.crl.

    This file contains a list of revoked certificates.

The .kdb, .rdb, .crl, and the .sth files contain critical security parameters and these parameters must be protected against unauthorized access by the operating system. It is advisable to back up the key database files regularly, especially if you are using a CA-signed certificate.

Enforcing SP800-131 compliant encryption

The files that are needed for IBM GSKit are automatically installed during the installation. To enforce SP800-131 compliant encryption, during the configuration of IBM Storage Protect Snapshot, you must set the ENFORCE_TLS12 parameter to YES in the IBM Storage Protect Snapshot profile file. You must use the advanced mode during the configuration to specify this parameter. Otherwise, TLS Protocol version 1.0 and 1.1 is enabled as the default value for the ENFORCE_TLS12 parameter is NO.

Any existing self-signed certificates that were created by a previous version of IBM Storage Protect Snapshot must be deleted to allow IBM Storage Protect Snapshot to create new self-signed certificates. To remove any existing self-signed certificates, go to the IBM Storage Protect Snapshot instance directory and enter the following command: 
rm fcmcert.*
Note: Do not delete certificates signed by certificate authority (CA). However, if the CA-signed certificate does not meet the minimum SP800-131 criteria, you must manually replace it with a new one.