Fortanix DSM Password-Based Backup and Restore Using SCP - SGX

1.0 Introduction

This article describes the Fortanix-Data-Security-Manager (DSM) password based backup and restore procedures for an SGX machine using SCP backup type.

2.0 Configuring Backup Using SCP

This section describes the steps to configure backups using SCP before or after creating a Fortanix Data Security Manager cluster.

Perform the following steps:

1. Edit the config.yaml file to add the following properties to enable backups in SCP, which is your backup destination. For more information about the config.yaml file, refer to “Section 5.4: Configure Other Nodes for Joining the Cluster” in the Fortanix Data Security Manager Installation Guide - On-Prem:

   NOTE

   By default, all the CRON jobs schedules are in the UTC time zone.

   • For Fortanix DSM version 3.23 and above, use the following sample configuration:

     backup:
        cron_schedule: "1 1 * * *"
        backup_mode: "snapshot"
        exclude_auditlog: true
        scp:
          server_ip: "ip_address"
          username: "administrator"
          password: "********"
          path: "/home/administrator/backup"

   • For Fortanix DSM version 4.6 and above, use the authmode parameter with the value password or privatekey:

     backup:
        cron_schedule: "1 1 * * *"
        backup_mode: "snapshot"
        exclude_auditlog: true
        scp:
          server_ip: "ip_address"
          authmode: “password”
          username: "administrator"
          password: "********"
          path: "/home/administrator/backup"

     Where,

     • authmode can be set to either password or privatekey.

     • backup_mode can be set to snapshot.

     • exclude_autditlog can be set to either true or false. It is recommended that the value is set to true.

2. Run the following command to redeploy the cluster to apply changes to the config.yaml file:

   sdkms-cluster deploy --config config.yaml --stage DEPLOY

3. Run the following command to navigate to bin folder:

   cd /opt/fortanix/sdkms/bin

4. Run the following command to execute the run_sdkms_backup.sh script to perform the manual backup:

   ./run_sdkms_backup.sh

5. Run the following command to verify the status of the backup:

   kubectl logs -l job-name=sdkms-backup-manual

   After executing the run_sdkms_backup.sh script, the DEPLOY pod and sdkms-manual backup pod starts or shows the status as RUNNING. Wait until the job is completed and the status changes to COMPLETED.

   NOTE

   Ensure that Cassandra and appropriate data and secrets are backed up to the SCP (target node) as shown in the following image:

   

For steps to back up the audit log, refer to Fortanix DSM Backup for Audit Log.

3.0 Recovering the Data

For a step-by-step procedure on data recovery, refer to Fortanix DSM Restoration Guide - Automated.