Encrypted Volume and File System v2.2 Administrator Guide (777846-001, April 2014)

file. The value of key_manager in the /etc/evfs/evfs.conf file must not change once the
key manager’s key pair is created, or all group keys which are associated with the key manager
will become inaccessible.
Since the key manager’s key is used to protect group keys and is possibly linked to user keys, there
are several limitations to use the key manager:
• For security reasons, the key manager is not allowed to have a secure session (this voids using
the same key to encrypt files).
• Ensure that the system administrator does not take the key manager’s role on behalf of the
key manager. The system administrator is not allowed to run the su command to become the
key manager and perform key functions.
To create the key manager key, the user designated as the key manager logs into the system
using the user account configured in key_manager in the /etc/evfs/evfs.conf file,
then creates a key pair by running the evfspkey keygen command.
Managing a user key
A user must have a key to use the EFS subsystem to encrypt or decrypt files. Although in previous
EVFS releases, a user is allowed to have multiple keys by specifying the –k <keyname> option
during key creation, only the user key with the default key name is recognized by EFS (the default
key name is the same as the user name).
Unlike in EFS, EVS allows the user to specify a different user key name with the –k <keyname>
option to manage volumes configured for encryption.
This section describes the following key operations:
• “Creating a user key ” (page 132)
• “Changing the passphrase” (page 134)
• “Displaying user key information” (page 136)
• “Exporting a user key” (page 136)
• “Importing a user key” (page 137)
• “Deleting a user key” (page 138)
Creating a user key
The keygen is the primary subcommand of the evfspkey command to create keys. A user key
can also be implicitly created when the user logs into the EFS subsystem for the first time. A user
key can be created by one of the following roles:
1. The user implicitly – for example, the key owner. HP recommends this method.
Without a key pair, a user is allowed to log into EFS. In that case, the user is prompted to
determine if the key pair should be created as part of the EFS login process. If the user decides
to have the key created, the user will be prompted to enter a passphrase to protect the key
pair, as follows:
# evfsauth login
You don't have a key pair to use EFS, do you want to create one?
Answer [yes/no]: yes
Enter passphrase:
Re-enter passphrase:
2. The system administrator or the key manager.
The system administrator or the key manager is allowed to create a key pair for other users
by specifying the user name with the option –u. The command prompts for a passphrase to
protect the private key. When the user runs the evfsauth command to log into EFS, the user
132 Managing keys