Introduction

The nimadm command is a tool for system administrators to create a duplicate of the client rootvg on available disks while simultaneously upgrading it to a newer version or release of IBM AIX. This process uses the Network Installation Management (NIM) resources to accomplish the task.

The existing behavior of the nimadm command does not provide support to add logical volume (LV) encryption to newly created altinst_rootvg boot logical volumes during a nimadm operation.

With AIX 7.3 TL3, nimadm allows to encrypt altinst_rootvg boot logical volumes using the Platform KeyStore (PKS) encryption authentication method.

This tutorial explains how to encrypt the altinst_rootvg default LVs using the nimadm command in the PKS encryption authentication method.

Prerequisites

You need to make sure that the following prerequisites are fulfilled to perform LV encryption for nimadm:

NIM Master OS version and SPOT resource should be AIX 7.3 TL3 or later for nimadm migrate and update encryption operation.
PKS should be enabled on the client logical partition (LPAR). There should be sufficient PKS slots to encrypt the selected rootvg default logical volumes.

Enable LV encryption for nimadm

The users need to create a bosinst_data resource in the NIM server and pass it to nimadm with the -o argument. Within the 'bosinst.data' file, users need to modify following fields:

Update the ENCRYPTPLV field in the control_flow stanza of the bosinst_data file to one of the following values: yes, preserve, or no.
- ENCRYPTLV=yes: Enables LV encryption for the altinst_rootvg LVs and reads the user's choice from the bosinst_data resource.
- ENCRYPTLV=no: Enables the newly created altinst_rootvg LVs to remain in a plain (unencrypted) state.
- ENCRYPTLV=preserve: Retains the encryption status of the client's rootvg default logical volumes when creating altinst_rootvg.
Modify the lv_encryption stanza with three available options corresponding to each LV.
- yes - Encrypt the LV.
- no - Keep LV plain.
- preserve – Retain the previous state of the LV.

Notes:

If you are going to encrypt, say five LVs, then you need to have one extra slot as buffer, so total 6 slots as needed. This is because the total PKS slot count is an estimated number.
If the user has not provided the bosinst_data resource, but the client rootvg LVs are encrypted with PKS, then after cloning, the same LVs in altinst_rootvg will also be encrypted with PKS (provided PKS is enabled and sufficient slots are available).
hd5 boot logical volume and hd8 log device are not part of LV encryption.

Configuring the NIM master

Perform the following steps to configure the NIM master:

Create a copy of the bosinst.template file, modify the lv_encryption and ENCRYPTPLV fields in the control_flow stanza as stated earlier.

-------Preview of bosinst.template file-------
control_flow:
<other fields>
ENCRYPTLV = yes

lv_encryption:
 ROOT_HD4 = yes
 USR_HD2 = yes
 VAR_HD9VAR = yes
 TMP_HD3 = yes
 HOME_HD1 = yes
 OPT_HD10OPT = yes
 ADMIN_HD11ADMIN = yes
 DUMPLV = yes
 PAGING_HD6LV = yes
 LIVEDUMPLV= yes

Create the bosinst_data resource.

nim -o define -t bosinst_data -a server=master -a location=/home/bosinst.data nim_bosinst_res

bash-5.2# lsnim -l nim_bosinst_res
nim_bosinst_res:
   class       = resources
   type        = bosinst_data
   Rstate      = ready for use
   prev_state  = unavailable for use
   location    = /home/bosinst.data
   alloc_count = 0
   server      = master

Make sure that lpp_source and spot resources are ready.

bash-5.2# lsnim -l lpp_source_2442A_73F
lpp_source_2442A_73F:
  class        = resources
  type         = lpp_source
  arch         = power
  Rstate       = ready for use
  prev_state   = unavailable for use
  location     = /export/lpp_source/lpp_source_2442A_73F
  simages      = yes
  alloc_count  = 0
  server       = master
  date_updated = Wed Nov 27 03:33:15 2024
bash-5.2# lsnim -l spot_2442A_73F
spot_2442A_73F:
  class         = resources
  type          = spot
  plat_defined  = chrp
  arch          = power
  bos_license   = yes
  Rstate        = ready for use
  prev_state    = verification is being performed
  location      = /export/spot/spot_2442A_73F/usr
  version       = 7
  release       = 3
  mod           = 3
  oslevel_r     = 7300-03
  oslevel_s     = 7300-03-00-2446
  alloc_count   = 0
  server        = master
  if_supported  = chrp.64 ent
  Rstate_result = success
  date_updated  = Wed Nov 27 03:50:09 2024

Run the nimadm command.

nimadm -c CLIENT-LPAR -s spot_2442A_73F -l lpp_source_2442A_73F -o nim_bosinst_res -d hdisk1 -Y`

Initializing the NIM master.
Initializing NIM client CLIENT-LPAR .
Verifying alt_disk_migration eligibility.
Initializing log: /var/adm/ras/alt_mig/CLIENT-LPAR_alt_mig.log
Starting Alternate Disk Migration.

+-----------------------------------------------------------------------------+
Executing nimadm phase 1.
+-----------------------------------------------------------------------------+
Cloning altinst_rootvg on client, Phase 1.
Client alt_disk_install command: alt_disk_copy -k bosinst.data -M 7.3 -P1 -d "hdisk1"
Calling mkszfile to create new /image.data file.
Checking disk sizes.
LOGICAL_VOLUME= hd11admin
FS_LV= /dev/hd11admin
Creating cloned rootvg volume group and associated logical volumes.
Creating logical volume alt_hd5
Creating logical volume alt_hd6
Creating logical volume alt_hd8
Creating logical volume alt_hd4
Creating logical volume alt_hd2
Creating logical volume alt_hd9var
Creating logical volume alt_hd3
Creating logical volume alt_hd1
Creating logical volume alt_hd10opt
Creating logical volume alt_hd11admin
Creating logical volume alt_lg_dumplv
Creating logical volume alt_livedump
Creating /alt_inst/ file system.
Creating /alt_inst/admin file system.
Creating /alt_inst/home file system.
Creating /alt_inst/opt file system.
Creating /alt_inst/tmp file system.
Creating /alt_inst/usr file system.
Creating /alt_inst/var file system.
Creating /alt_inst/var/adm/ras/livedump file system.
Generating a list of files
for backup and restore into the alternate file system...
Backing-up the rootvg files and restoring them to the
alternate file system...
Phase 1 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 2.
+-----------------------------------------------------------------------------+
Exporting alt_inst filesystems from client CLIENT-LPAR 
to NIM master MASTER-LPAR :
Exporting /alt_inst from client.
Exporting /alt_inst/admin from client.
Exporting /alt_inst/home from client.
Exporting /alt_inst/opt from client.
Exporting /alt_inst/tmp from client.
Exporting /alt_inst/usr from client.
Exporting /alt_inst/var from client.
Exporting /alt_inst/var/adm/ras/livedump from client.
Phase 2 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 3.
+-----------------------------------------------------------------------------+
NFS mounting client's alt_inst filesystems on the NIM master:
Mounting CLIENT-LPAR :/alt_inst.
Mounting CLIENT-LPAR :/alt_inst/admin.
Mounting CLIENT-LPAR :/alt_inst/home.
Mounting CLIENT-LPAR :/alt_inst/opt.
Mounting CLIENT-LPAR :/alt_inst/tmp.
Mounting CLIENT-LPAR :/alt_inst/usr.
Mounting CLIENT-LPAR :/alt_inst/var.
Mounting CLIENT-LPAR :/alt_inst/var/adm/ras/livedump.
Phase 3 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 4.
+-----------------------------------------------------------------------------+
nimadm: There is no user customization script specified for this phase.
Phase 4 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 5.
+-----------------------------------------------------------------------------+
Saving system configuration files.
0505-161 nimadm: WARNING, client nfs mounts may be out of sync.
Checking for initial required migration space.
Setting up for base operating system restore.
/tmp
Restoring base operating system.
Merging system configuration files.
Running migration merge method: ODM_merge Config_Rules.
Running migration merge method: ODM_merge SRCextmeth.
Running migration merge method: ODM_merge SRCsubsys.
Running migration merge method: ODM_merge SWservAt.
Running migration merge method: ODM_merge pse.conf.
Running migration merge method: privcmds_mig.
Running migration merge method: privdevs_mig.
Running migration merge method: ODM_merge vfs.
Running migration merge method: ODM_merge xtiso.conf.
Running migration merge method: ODM_merge PdAtXtd.
Running migration merge method: ODM_merge PdDv.
Running migration merge method: convert_errnotify.
Running migration merge method: passwd_mig.
Running migration merge method: login_mig.
Running migration merge method: user_mrg.
Running migration merge method: secur_mig.
Running migration merge method: RoleMerge.
Running migration merge method: methods_mig.
Running migration merge method: mkusr_mig.
Running migration merge method: methods_mig.
Running migration merge method: mkusr_mig.
Running migration merge method: group_mig.
Running migration merge method: ldapcfg_mig.
Running migration merge method: ldapmap_mig.
Running migration merge method: secvarscfg_mig.
Running migration merge method: convert_errlog.
Running migration merge method: ODM_merge GAI.
Running migration merge method: ODM_merge PdAt.
Running migration merge method: merge_smit_db.
Running migration merge method: ODM_merge fix.
Running migration merge method: merge_swvpds.
Running migration merge method: SysckMerge.
Running migration merge method: nscontrol_mig.
Phase 5 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 6.
+-----------------------------------------------------------------------------+
Installing and migrating software.
....
....
....
Phase 6 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 7.
+-----------------------------------------------------------------------------+
nimadm: There is no user customization script specified for this phase.
Phase 7 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 8.
+-----------------------------------------------------------------------------+
Creating client boot image.
Expanding /alt_inst/tmp client filesystem.
Filesystem size changed to 655360
bosboot: Boot image is 69633 512 byte blocks.
Writing boot image to client's alternate boot disk hdisk1.
Phase 8 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 9.
+-----------------------------------------------------------------------------+
Unmounting client mounts on the NIM master.
forced unmount of /CLIENT-LPAR_alt/alt_inst/var/adm/ras/livedump
forced unmount of /CLIENT-LPAR_alt/alt_inst/var
forced unmount of /CLIENT-LPAR_alt/alt_inst/usr
forced unmount of /CLIENT-LPAR_alt/alt_inst/tmp
forced unmount of /CLIENT-LPAR_alt/alt_inst/opt
forced unmount of /CLIENT-LPAR_alt/alt_inst/home
forced unmount of /CLIENT-LPAR_alt/alt_inst/admin
forced unmount of /CLIENT-LPAR_alt/alt_inst
Phase 9 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 10.
+-----------------------------------------------------------------------------+
Unexporting alt_inst filesystems on client CLIENT-LPAR :
Phase 10 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 11.
+-----------------------------------------------------------------------------+
Cloning altinst_rootvg on client, Phase 3.
Client alt_disk_install command: alt_disk_copy -k bosinst.data -M 7.3 -P3 -d "hdisk1"
## Phase 3 ################### 
Verifying altinst_rootvg...
Modifying ODM on cloned disk.
forced unmount of /alt_inst/var/adm/ras/livedump
forced unmount of /alt_inst/var/adm/ras/livedump
forced unmount of /alt_inst/var
forced unmount of /alt_inst/var
forced unmount of /alt_inst/usr
forced unmount of /alt_inst/usr
forced unmount of /alt_inst/tmp
forced unmount of /alt_inst/tmp
forced unmount of /alt_inst/opt
forced unmount of /alt_inst/opt
forced unmount of /alt_inst/home
forced unmount of /alt_inst/home
forced unmount of /alt_inst/admin
forced unmount of /alt_inst/admin
forced unmount of /alt_inst
forced unmount of /alt_inst
Changing logical volume names in volume group descriptor area.
Fixing LV control blocks...
Fixing file system superblocks...
Bootlist is set to the boot disk: hdisk1 blv=hdhdcryptmgr showlv rootvg. e 11 complete.

+-----------------------------------------------------------------------------+
Executing nimadm phase 12.
+-----------------------------------------------------------------------------+
Cleaning up alt_disk_migration on the NIM master.
Cleaning up alt_disk_migration on client CLIENT-LPAR.
Phase 12 complete.

Verification

After nimadm phase 12 is complete, users can verify the crypto status of the LVs by running the hdcryptmgr showlv rootvg command on the client LPAR post reboot. This command shows the values for CRYTO_STATUS and ENCRYPT PERCENTAGE.

The crypto status is also updated in the file /var/adm/ras/bosinst.data file on the client. For example, if the user has selected preserve corresponding to an LV in the lv_encryption stanza, it will be changed with either yes or no based on the crypto status of the LV.

Log in to the client LPAR and verify that altinst_rootvg is created.

# lspv
hdisk0          00e0b90467aff9de                    rootvg          active      
hdisk1          00e0b904b5666091                    altinst_rootvg

Reboot the client LPAR.

#  reboot

Post reboot, notice that the LPAR is booted from the newly created altinst_rootvg.

bash-5.2# lspv
hdisk0          00e0b90467aff9de                    old_rootvg                  
hdisk1          00e0b904b5666091                    rootvg          active

Run the hdcryptmgr showlv rootvg command to verify that all the LVs are encrypted which were provided in lv_encryption stanza of the bosinst.data file.

bash-5.2# hdcryptmgr showlv rootvg
NAME                 CRYPTO_STATUS    %ENCRYPTED       NOTE
hd5                  not_enabled          0
hd6                  unlocked            100
hd8                  not_enabled          0
hd4                  unlocked            100
hd2                  unlocked            100
hd9var               unlocked            100
hd3                  unlocked            100
hd1                  unlocked            100
hd10opt              unlocked            100
hd11admin            unlocked            100
lg_dumplv            unlocked            100
livedump             unlocked            100

Summary

This tutorial explained how to encrypt the default LVs of a rootvg using the nimadm command with the PKS encryption authentication method. The benefit of this approach is that users can add PKS encryption to the cloned rootvg LVs during the nimadm operation.

Reference

https://www.ibm.com/docs/en/aix/7.3?topic=n-nimadm-command

Logical volume (LV) encryption support for rootvg using nimadm

Logical volume (LV) encryption support for rootvg using nimadm