IBM Developer

Tutorial

Encrypt rootvg logical volumes (LVs) during preservation and migration installation

Using the Platform KeyStore (PKS) authentication method to encrypt rootvg LVs

By Saikrishna Akkela, Srikanth Thanneeru, Durgarao Simhadri

On this page

Introduction

Logical volume (LV) encryption refers to the process of securing data stored on LVs by encrypting it, ensuring that only authorized users or systems can access the data.

When encryption is applied, the data on the LV is stored in an encrypted format and can only be decrypted with the appropriate authentication method. This protects the data from unauthorized access, even if the physical storage device is compromised.

Previously, LV encryption was supported only for overwrite installations. However, starting with IBM AIX 7.3 TL3, preservation and migration installations also support LV encryption for all default root volume group (rootvg) LVs using the PKS authentication method.

PKS is a hardware-backed non-volatile random access memory (NVRAM) that offers secure storage for sensitive material. With the platform keystore encryption authentication method, rootvg LVs will be automatically unlocked without user intervention.

This step-by-step tutorial explains how to enable encryption for the default logical volumes (LVs) in rootvg using the SMS menu during preservation and migration installations.

Prerequisites

To enable rootvg default LVs encryption during preservation or migration installation, the system must meet the following requirements:

  • System firmware FW950 and Hardware Management Console (HMC) 9.2.950 or a later version must be available.

  • PKS must be enabled through HMC and sufficient PKS slots must be available.

    alt

    Users can check the PKS slot availability on the logical partition (LPAR) using the following command: hdcryptmgr pksshow

There are two ways to configure LV encryption for default rootvg LVs during installation:

  • Prompt mode – Using the SMS menu
  • Non-prompt mode – Using the bosinst.data file

However, this tutorial focuses on the prompt mode.

Encrypt LVs using the prompt mode

Perform the following steps to encrypt logical volumes using the prompt mode:

  1. Run the hdcryptmgr showlv rootvg command and note that none of the rootvg default LVs is encrypted before installation.

    alt

  2. Invoke AIX installation on the LPAR where the user wants to perform preservation/migration install. Detailed steps for installation are provided in the following post: https://community.ibm.com/community/user/power/blogs/rae-yang/2022/03/03/aix-73-migration

  3. When LPAR is booted from installation media the following screen is presented. Type 1 and press Enter to use the terminal as the system console.

    alt

  4. Type 1 and press Enter to choose English language during installation.

    alt

  5. Type 2 and press Enter to change/show installation settings.

    alt

  6. Type 3 to access the security model.

    alt

    In the Security Models screen, the second option is LV Encryption, which by default is set to preserve. There are three possible values for the LV encryption item.

    • preserve: Retains the previous state of LVs (no jump to the Select LVs for Encryption menu)
    • no: Decrypts all the LVs (No jump to the Select LVs for Encryption menu)
    • yes: Jumps to the Select LVs for Encryption menu, where the user has the option to select yes, no, or preserve for each LV

  7. Type 2 and press Enter to toggle the LV Encryption value to no. Again type 2 and press Enter to set the LV Encryption value to yes. Then, the user jumps to the Select LVs for Encryption screen.

    alt

    alt

    alt

    In the Select LVs for Encryption screen, three options are provided: preserve, no, and yes.

    • preserve: Retains the previous crypto state of the logical volume.
    • no: Decrypts the logical volume.
    • yes: Encrypts the logical volume.

  8. To change the LV encryption option, enter the index number corresponding to each LV. For example, type 1 and press Enter to toggle hd4 from preserve to no, and again type 1 and press Enter to toggle to yes.

    alt

    alt

    Note: When attempting to encrypt an LV by selecting yes in the 'Select LVs for Encryption' menu, if the LV is already encrypted, it will not undergo encryption. Similarly, when attempting to decrypt an LV by selecting no in the same menu, if the LV is already in a plain state, it will not be decrypted.

    hd4, hd2, hd9var, hd3, hd1,hd10opt, hd11admin, dumplv, hd6 and livedump are the default rootvg LVs that supports LV encryption.

  9. Here, we have a few configured to yes, no, and preserve. Type 0 and press Enter to return to the security model option.

    alt

Verification

After installation, the user can verify the crypto status of LVs from two sources:

  • Post installation, run the hdcryptmgr showlv rootvg command to verify the crypto status of rootvg LVs.

  • In the Select LVs for Encryption menu, we chose to encrypt hd4, hd2, and hd9var. Post installation, the hdcryptmgr showlv rootvg command shows that hd4, hd2, and hd9var are encrypted. Also, the user can check the PKS status of the LV by running the hdcryptmgr pksshow command.

    alt

  • The latest crypto status of rootvg default logical volume is updated in the lv_encryption stanza of the '/var/adm/ras/bosinst.data' file.

The system appends the result of the hdcryptmgr showlv rootvg command to the /var/adm/ras/BosMenus.log file before making LV encryption changes so that users can verify the crypto status of the rootvg before and after installation.

Preservation installation

Preserved LVs are those that are not recreated during preservation installation. hd3, hd1, dump_lv*, hd6, and livedump are preserved during the preservation installation. New LVs are those that are recreated every time during preservation installation. hd4, hd2, hd9var, hd10opt, and hd11admin are recreated during the preservation installation.

In case the user selects preserve for LVs in the Select LVs for Encryption menu, and if the LV belongs to Preserved LVs, then the old PKS is retained. In case the LV belongs to the New LVs, then a new PKS is added for that LV.

Migration installation

In the case of migration installation, all 10 LVs are preserved. In some memory constraint scenarios, the dumplv LV is recreated during preservation and migration installation. The hd3 LV (that is, the /tmp file system) is preserved, but its data is cleaned during the preservation installation.

Summary

This tutorial explained the steps to convert a non-encrypted rootvg to an encrypted rootvg during preservation or migration installations using the SMS menu. It enhances system security by leveraging the PKS authentication method, which ensures data protection.