evfs.conf.4 (2010 09)

e
evfs.conf(4) evfs.conf(4)
(EVFS Software Required)
NAME
evfs.conf - configuration file for the EVFS module
SYNOPSIS
/etc/evfs/evfs.conf
DESCRIPTION
The evfs.conf file is the EVFS configuration file that enables the user to set global parameters for the
EVFS subsystem. The EVFS subsystem reads the evfs.conf
file when it starts, and the EVFS utilities
(
evfsadm, evfspkey, evfsvol, evfsauth
, and evfsfile) read it each time they start.
Each entry in this file is of the form:
attribute_name
=attribute_value
Each entry must be on one input line, with no line breaks or line continuation characters.
Supported Attributes
The attributes supported are:
data_cipher Specifies the cipher suite used for volume-level mode data
encryption/decryption.
Valid values:
aes-128-cfb, aes-192-cfb
, aes-256-cfb,
aes-128-cbc, aes-192-cbc,oraes-256-cbc
.
emd_backup Specifies the parent directory for backup EMDs.
emd_digest Specifies the message digest algorithm used in the EMD. Only sha1 is sup-
ported.
emd_envelopes Specifies the maximum number of envelopes to allow when creating a new
EMD.
Valid values: 1 - 1024.
efs_recovery_keyname
Specifies the recovery key name for file data encryption. If this is configured
and the recovery key is created, all encrypted files created will use this key as
the recovery key. If this is not specified, encrypted files will not be recoverable.
evfs_user Specifies the name of the EVFS pseudo-user.
evfsconf_vers Specifies the configuration file format version. Do not modify the value for this
attribute.
file_cipher Specifies the cipher suite used for file-level mode data encryption/decryption.
Valid values:
aes-128-cfb, aes-192-cfb
,oraes-256-cfb.
kernel_encryption_mode
Specifies the kernel encryption mode. This attribute is ignored on single-
processor systems.
Valid values:
distributed or local.
Default:
distributed.
In distributed mode, the administrator can specify the number of kernel
encryption threads to create when EVFS starts using the
-n option with the
evfsadm start command. EVFS forwards encryption and decryption
requests to the common thread pool regardless of the CPU on which the I/O
originates.
In local mode, each CPU has its own local thread, and encryption requests are
processed on the CPU on which the I/O originates. Local mode may provide
better performance on systems with Cache Coherent Non-Uniform Memory
(ccNUMA) Architecture or in installations where data-intensive applications
bind to a single CPU.
key_manager Specifies the user account of the key manager. This must be configured to
enable key manager’s functions, which include managing group keys and
resetting the key passphrase of other users. Once the key manager’s key is
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1