Implementing Informix Encryption at Rest
I
m
p
l
e
m
e
n
t
i
n
g
I
n
f
o
r
m
i
x
E
n
c
r
y
p
t
i
o
n
a
t
R
e
s
t
A
1
3
–
S
e
p
t
e
m
b
e
r
2
5
–
1
1
:
3
0
a
m
J
e
f
f
F
i
l
i
p
p
i
I
n
t
e
g
r
a
t
e
d
D
a
t
a
C
o
n
s
u
l
t
i
n
g
,
L
L
Cmoc.gnitlusnocatadti@ippilif.ffej
Introduction
•
29 years of working with Informix products
•
25 years as an Informix DBA
•
Worked for Informix for 5 years 1996 – 2001
•
Certified Informix DBA
•
Started my own company in 2001 specializing in
Informix Database Administration consulting
•
IBM Business Partner
•
OLTP and Data warehouse systems
•
Informix 4 thru 14.10
What is Encryption At Rest (EAR)
•
It was introduced in Informix 12.10xC8.
•
It provides disk level encryption for dbspaces in your
informix instance.
•
The encryption is done during the disk I/O operations.
EAR – What is EAR
What are the cases to use Encryption At Rest (EAR)
•
EAR is useful in IOT environments where the Informix
instances are outside your local environments where the
devices can be lost or stolen.
•
EAR is also useful in Cloud environments, ex. AWS, IBM
Cloud.
•
Looking to encrypt dbspaces in your environment.
EAR – Use Cases
How to Setup EAR
•
If you have a new instance you are creating, you can
encrypt your dbspaces when you initialize the Informix
instance.
•
Now in most cases you already have an existing instance
that you will want to encrypt.
•
For an existing instance there are more steps to be done.
•
When you enable EAR on an existing instance, new dbspaces will
be encrypted, but existing ones are not.
•
The only way to get existing instances to be encrypted is to perform
a restore using ontape/onbar using the “-encrypt” option.
EAR – Setting up
Preparing the Environment
•
There is a new ONCONFIG parameter named
“DISK_ENCRYPTION”.
•
N
O
T
E
:
i
t
i
s
n
o
t
i
n
c
l
u
d
e
d
i
n
t
h
e
d
e
f
a
u
l
t
O
N
C
O
N
F
I
G
f
i
l
e
s
i
n
c
e
t
h
i
s
f
e
a
t
u
r
e
c
a
n
c
a
u
s
e
m
o
r
e
i
s
s
u
e
s
b
y
a
c
c
i
d
e
n
t
a
l
l
y
t
u
r
n
i
n
g
i
t
o
n
.
I
f
y
o
u
d
i
d
t
h
i
s
a
n
d
w
a
n
t
e
d
t
o
t
u
r
n
i
t
o
f
f
,
y
o
u
o
n
l
y
o
p
t
i
o
n
w
o
u
l
d
b
e
t
o
d
o
a
n
I
n
f
o
r
m
i
x
r
e
s
t
o
r
e
.
EAR – Preparing
DISK_ENCRYPTION - options
•
keystore
(The keystore specifies the name of the
keystore and stash file names. The files are created in the
$INFORMIXDIR/etc directory.
•
Keystore.p12 = The keystore file that contains the security certificates.
•
Keystore.sth = The stash file that contains the encryption password.
•
N
O
T
E
:
y
o
u
m
u
s
t
m
a
n
u
a
l
l
y
b
a
c
k
u
p
t
h
e
k
e
y
s
t
o
r
e
a
n
d
p
a
s
s
w
o
r
d
s
t
a
s
h
f
i
l
e
s
.
T
h
e
s
e
f
i
l
e
s
a
r
e
n
o
t
b
a
c
k
e
d
u
p
w
h
e
n
y
o
u
r
u
n
a
n
o
n
t
a
p
e
o
r
o
n
b
a
r
b
a
c
k
u
p
.
EAR – Preparing
DISK_ENCRYPTION - options
•
cipher
(Specifies the encryption cipher)
•
aes128 = Default. Advanced Encryption Standard cipher with 128-
bit keys.
•
aes192 = Advanced Encryption Standard cipher with 192-bit keys.
•
aes256 = Advanced Encryption Standard cipher with 256-bit keys.
EAR – Preparing
DISK_ENCRYPTION - options
•
rollfwd_create_dbs
(Specifies whether to encrypt a
storage space that is created by the rolling forward of the
logical log during a restore)
•
Encrypt = Encrypt the newly create storage space.
•
Decrypt = Do not encrypt the newly created storage space.
N
O
T
E
:
B
y
d
e
f
a
u
l
t
t
h
e
s
t
o
r
a
g
e
s
p
a
c
e
s
t
h
a
t
a
r
e
c
r
e
a
t
e
d
b
y
t
h
e
r
o
l
l
i
n
g
f
o
r
w
a
r
d
o
f
t
h
e
l
o
g
i
c
a
l
l
o
g
s
h
a
v
e
t
h
e
s
a
m
e
e
n
c
r
y
p
t
i
o
n
s
t
a
t
e
a
s
t
h
e
o
r
i
g
i
n
a
l
s
t
o
r
a
g
e
s
p
a
c
e
.
EAR - Preparing
Turning EAR on
•
So now that we have the ONCONFIG setup for EAR and
we restart Informix, here are some of the messages you will
see.
•
To verify the EAR is on, run “oncheck –pr”.
•
There are now the keystore files that are stored in the
$INFORMIXDIR/etc directory.
•
DEMO
EAR – Initializing EAR
Add dbspaces
•
So now that EAR is enabled, lets create a new dbspace
and show that it is encrypted.
•
DEMO
EAR – Adding Encrypted Dbspaces
Encrypt ALL Dbspaces
•
As was discussed before, in order to encrypt all dbspaces
you either have to create the instance from scratch or for an
existing instance you need to perform an Informix restore
with the “-encrypt” flag.
•
ontape –r -encrypt
•
DEMO
EAR – Encrypt ALL Dbspaces
Here are some questions you may have about EAR
•
Does the keystore files “.sth” and “.p12” change and if so when, ex. After an
Informix backup, chunk added, etc?
No, the keystore files can only be re-generated if you restore the
dbspaces from an archive.
•
When an Informix level 0 backup is taken, do the keystore files change?
No, only at restore the keystore files are re-generated. You can also
change them manually using the following command:
Changing the master key for the keystore
https://www.ibm.com/support/knowledgecenter/en/SSGU8G_12.1.0/com.i
bm.sec.doc/ids_sec_030.htm
EAR – Some Questions You May Have
Here are some questions you may have about EAR
•
If I want to restore and Informix ontape file to an instance on
another server and use the encrypt option to do the restore,
are there any issues with this?
No, there is no issue with this, you will only have two
separate instances of a server, where one is encrypted.
•
The encrypt option only occurs on the restore, correct?
Yes, the encrypt option is on restore only.
EAR – Some Questions You May Have
Here are some questions you may have about EAR
•
If you have HDR or RSS, when you run the restore to the
other instance, do both need to be encrypted or not
encrypted?
Encryption is a local feature to each server, it does not
impact replication.
EAR – Some Questions You May Have
Here was an issue I ran into when trying to restore using
the encrypt option.
•
Received the error:
•
“ICC library load failed”
•
After searching around, we reinstalled the “gskit” on the
server and then the restore with encryption worked.
•
$INFORMIXDIR/gskit/installgskit
EAR – Issue I ran into
•
Shawn Moe’s Blog
•
https://www.ibm.com/developerworks/community/blogs/smoe/entry/Encry
ption_at_Rest_feature_in_12_10_xC8_supports_encryption_of_your_Info
rmix_server_storage?lang=en
•
2017 Roadshow – Carlton Doe
•
Informix 12.10 Information Center
•
https://www.ibm.com/support/knowledgecenter/SSGU8G_12.1.0/com.ibm
.adref.doc/ids_adr_1199.htm
References
Jeff Filippi
Integrated Data Consulting, LLC
jeff.filippi@itdataconsulting.com
www.itdataconsulting.com
Discover how to implement Encryption At Rest (EAR) in Informix, providing disk-level encryption for dbspaces within your instance. Learn about use cases, setting up EAR for new and existing instances, preparing the environment, and configuring disk encryption options like keystore and stash file names. Gain insights from Jeff Filippi, a seasoned professional with extensive experience in Informix products and database administration.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Implementing Informix Encryption at Rest A13 September 25 11:30am Jeff Filippi Integrated Data Consulting, LLC jeff.filippi@itdataconsulting.com
Introduction 29 years of working with Informix products 25 years as an Informix DBA Worked for Informix for 5 years 1996 2001 Certified Informix DBA Started my own company in 2001 specializing in Informix Database Administration consulting IBM Business Partner OLTP and Data warehouse systems Informix 4 thru 14.10
EAR What is EAR What is Encryption At Rest (EAR) It was introduced in Informix 12.10xC8. It provides disk level encryption for dbspaces in your informix instance. The encryption is done during the disk I/O operations.
EAR Use Cases What are the cases to use Encryption At Rest (EAR) EAR is useful in IOT environments where the Informix instances are outside your local environments where the devices can be lost or stolen. EAR is also useful in Cloud environments, ex. AWS, IBM Cloud. Looking to encrypt dbspaces in your environment.
EAR Setting up How to Setup EAR If you have a new instance you are creating, you can encrypt your dbspaces when you initialize the Informix instance. Now in most cases you already have an existing instance that you will want to encrypt. For an existing instance there are more steps to be done. When you enable EAR on an existing instance, new dbspaces will be encrypted, but existing ones are not. The only way to get existing instances to be encrypted is to perform a restore using ontape/onbar using the -encrypt option.
EAR Preparing Preparing the Environment There is a new ONCONFIG parameter named DISK_ENCRYPTION . NOTE: it is not included in the default ONCONFIG file since this feature can cause more issues by accidentally turning it on. If you did this and wanted to turn it off, you only option would be to do an Informix restore.
EAR Preparing DISK_ENCRYPTION - options keystore keystore and stash file names. The files are created in the $INFORMIXDIR/etc directory. Keystore.p12 = The keystore file that contains the security certificates. Keystore.sth = The stash file that contains the encryption password. (The keystore specifies the name of the NOTE: you must manually backup the keystore and password stash files. These files are not backed up when you run an ontape or onbar backup.
EAR Preparing DISK_ENCRYPTION - options cipher (Specifies the encryption cipher) aes128 = Default. Advanced Encryption Standard cipher with 128- bit keys. aes192 = Advanced Encryption Standard cipher with 192-bit keys. aes256 = Advanced Encryption Standard cipher with 256-bit keys.
EAR - Preparing DISK_ENCRYPTION - options rollfwd_create_dbs (Specifies whether to encrypt a storage space that is created by the rolling forward of the logical log during a restore) Encrypt = Encrypt the newly create storage space. Decrypt = Do not encrypt the newly created storage space. NOTE: By default the storage spaces that are created by the rolling forward of the logical logs have the same encryption state as the original storage space.
EAR Initializing EAR Turning EAR on So now that we have the ONCONFIG setup for EAR and we restart Informix, here are some of the messages you will see. To verify the EAR is on, run oncheck pr . There are now the keystore files that are stored in the $INFORMIXDIR/etc directory. DEMO
EAR Adding Encrypted Dbspaces Add dbspaces So now that EAR is enabled, lets create a new dbspace and show that it is encrypted. DEMO
EAR Encrypt ALL Dbspaces Encrypt ALL Dbspaces As was discussed before, in order to encrypt all dbspaces you either have to create the instance from scratch or for an existing instance you need to perform an Informix restore with the -encrypt flag. ontape r -encrypt DEMO
EAR Some Questions You May Have Here are some questions you may have about EAR Does the keystore files .sth and .p12 change and if so when, ex. After an Informix backup, chunk added, etc? No, the keystore files can only be re-generated if you restore the dbspaces from an archive. When an Informix level 0 backup is taken, do the keystore files change? No, only at restore the keystore files are re-generated. You can also change them manually using the following command: Changing the master key for the keystore https://www.ibm.com/support/knowledgecenter/en/SSGU8G_12.1.0/com.i bm.sec.doc/ids_sec_030.htm
EAR Some Questions You May Have Here are some questions you may have about EAR If I want to restore and Informix ontape file to an instance on another server and use the encrypt option to do the restore, are there any issues with this? No, there is no issue with this, you will only have two separate instances of a server, where one is encrypted. The encrypt option only occurs on the restore, correct? Yes, the encrypt option is on restore only.
EAR Some Questions You May Have Here are some questions you may have about EAR If you have HDR or RSS, when you run the restore to the other instance, do both need to be encrypted or not encrypted? Encryption is a local feature to each server, it does not impact replication.
EAR Issue I ran into Here was an issue I ran into when trying to restore using the encrypt option. Received the error: ICC library load failed After searching around, we reinstalled the gskit on the server and then the restore with encryption worked. $INFORMIXDIR/gskit/installgskit
References Shawn Moe s Blog https://www.ibm.com/developerworks/community/blogs/smoe/entry/Encry ption_at_Rest_feature_in_12_10_xC8_supports_encryption_of_your_Info rmix_server_storage?lang=en 2017 Roadshow Carlton Doe Informix 12.10 Information Center https://www.ibm.com/support/knowledgecenter/SSGU8G_12.1.0/com.ibm .adref.doc/ids_adr_1199.htm
Jeff Filippi Integrated Data Consulting, LLC jeff.filippi@itdataconsulting.com www.itdataconsulting.com
