Back up and restore volume groups on encrypted physical volumes in IBM AIX

The objective of this tutorial is to explain the methods to back up and restore a volume group on an encrypted physical volume. This can be highly beneficial for restoring a system during disaster recovery, migration, or installing multiple systems with the same volume group structure. This tutorial explains how to securely back up and recover critical data while preserving encryption configurations and maintaining data integrity.

What is savevg and why do we need it?

The savevg command in IBM AIX is used to back up an entire volume group, including its configuration and optionally, the data stored within it. It captures essential information such as logical volume structure, file system layout, and mount points, making it useful for planning disaster recovery, system migrations, or hardware replacements. When used with the -r option, it backs up only the configuration files (excluding user data) allowing you to rebuild the volume group structure without restoring its contents.

What is restvg and why do we need it?

The restvg command in AIX is used to restore a volume group from a backup created with the savevg command. It re-creates the volume group’s structure, including its logical volumes, file systems, and mount points, and optionally restores the data stored within those file systems. This command is essential in disaster recovery situations, system migrations, or when rebuilding systems after hardware failures. The restvg command simplifies the restoration process by automatically configuring the volume group based on the saved metadata, reducing the chances of manual errors.

Understanding platform keystore in AIX

In IBM Power and AIX environments, platform keystore (PKS) is a secure, firmware-managed key storage mechanism that integrates tightly with the system’s hardware security features. Its primary purpose is to safely store and manage cryptographic keys within the platform firmware, ensuring that sensitive keys used for boot-time decryption and data protection remain protected from unauthorized access.

Platform keystore plays a critical role in enabling secure handling of cryptographic keys, especially for boot and disk encryption use cases. By using platform keystore, administrators can maintain encryption integrity across system operations without compromising security.

Note: Steps to enable platform keystore from the Hardware Management Console (HMC) are explained later in the Defining the keystore size in the HMC section.

Current restrictions and requirements

Before performing the backup and restore of volume group operations on encrypted physical volumes, it is better to make a note of the following limitations:

• Platform keystore support The platform keystore must be supported and enabled on the virtual machine (VM).
• Available platform keystore slots Ensure that at least three free PKS slots are available.
• Boot device limitation The boot device (hd5) cannot be encrypted.
• Paging space and dump device Active paging space and active dump devices cannot be encrypted or decrypted.

Create volume group backup on encrypted physical volumes

The following steps describe how to prepare encrypted physical volumes and perform a secure volume group backup, ensuring that encryption is properly enabled before initiating the backup operation.

1. Encrypt the physical volumes. Run the pvenable command to enable encryption on the target disks:

   

2. Create an encrypted volume group. After the disks are encrypted, create a volume group using the mkvg command.

   

3. Create encrypted logical volumes. From the encrypted volume group, create logical volumes with encryption enabled, and passphrase added, and platform keystore authentication set.

   

4. Create a JFS2 file system and mount points. Format the logical volume with JFS2 and mount it:

   

5. Back up the entire volume group. Run the savevg command to back up the entire volume group:

   savevg -f <device or filename> <VGname>

   

Restore a volume group on an encrypted physical volume

Perform the following steps to restore a volume group on an encrypted physical volume:

1. Run the restvg command. Use the restvg command and specify the backup file and target disks:

   restvg -s -f <device name of the backup media> <Disknames>
   

   

2. Respond to the encryption prompt for destination physical volumes. Because the source VG was encrypted, the system will prompt: Do you want to set the same encryption policy on target PV(s) ? Respond with yes.

   

3. Provide encryption details. Enter the required passphrase and public key store authentication details when prompted. These credentials ensure that the restored volume group maintains encryption integrity.

   

Restoring a volume group with the restvg command ensures that the destination physical volumes are encrypted, the original volume group structure is recreated on the specified disks, and all logical volumes, file systems, and mount points are restored in accordance with the original configuration.

After the restore operation is complete, the encryption status can be verified using the hdcryptmgr pksshow command. The output confirms that encryption keys for the encrypted volume group and physical volumes are securely stored in the physical keystore and are in a valid state, ensuring uninterrupted access to encrypted disks during normal operation and recovery scenarios.

Defining the keystore size in the HMC

Perform the following steps to enable platform keystore for encryption, you need to allocate memory for the platform keystore in the HMC. Follow these steps:

1. Navigate to the Advanced Settings section of the logical partition (LPAR) / virtual machine (VM). Locate the Platform KeyStore Size field.

   Set this value within the supported range for your hardware. For example, if the range displayed is 4–128 KB, you can choose any value within that range. This value determines the amount of memory allocated for platform keystore on the LPAR.

   

2. Specify the required size from the available range. In this example, we have configured 128 KB for the platform keystore.

   

Summary

This tutorial explained how to back up and restore AIX volume groups on encrypted physical volumes, including key preparation, secure backup operations, restore behavior, and post‑restore verification. It also described the role of the platform keystore and how encryption keys are preserved and validated after recovery.

References

• hdcryptmgr Command - IBM Documentation
• Enabling Platform Key Store capability for User-Space applications on AIX