SMA Backup Signing with Serial Number (4370981)

SMA Backup Signing with Serial Number

SMA Backup Signing has been introduced in version 13.1 as a security mechanism for the Backup restore process. In this case, the KACE SMA will use the serial number of the appliance as the encryption key.

This new process will prevent tampering with the backup once offloaded from the SMA, since the serial number is a unique value for the VM from where the backups were taken from.

This will ensure that only authorized admins can perform this action avoiding tampering of backups.

There are multiple situations on which the SMA may require a migration or reasons to have the backups restored in a new VM such as:

• Unrecoverable appliance from an outage.
• Moving to a different platform for example: 
  • From Physical to Virtual/Cloud solution
  • Moving Between different virtual environments such as KACE as a Service/VMWare/Azure/Hyper-V/Nutanix
• VM coming from old version and running with small partitions
• Need to deploy a second VM for Test or Dev box for Regression testing before an upgrade.

Steps and considerations for restoring from backups in version 13.1 and up.

Pre-requisites:

• Make sure backups on the appliance completes and offboard
• Make sure to notate the appliance serial number (note that this is unique per VM/Box, so new VM will have different serial), the serial number can be obtained in the following ways:
  • Clicking the need help button and the "circled I" about icon.
  • From kbox logs in the klicencepinger_output log "\kbox\kboxwww\logs"
  • If the box is down and none of the above options are available, support can retrieve it internally as last resort.

  Very Important: The serial number is case sensitive, most of the time is all UPPERCASE

Migration/ Restore from Backups

• Once base and incremental files are offboarded as usual there are two ways to upload the needed files in order to initiate the migration or backup restore:
  • Via Web UI:
    • Requires the Base and Incremental file.
    • The serial number from the VM that the backups were taken from, this will be input in the "Backup Serial Number" of the Backup Settings and Restore page.

• Via FTP (for uploads bigger than 4GB is the only option)
  • Backup via FTP needs to be enabled from security settings page and Make FTP writable or via Netdiag.
  • Via FTP a file containing the serial number needs to be created for the restore to be successful when uploading base and incr files to the new appliance, the file needs to follow same naming convention as the base file adding extension ".serial" at the end e.g for appliance with base file named: "20230412_k1_base_13.1.73.tgz" the serial number file would be. "20230412_k1_base_13.1.73.tgz.serial".
  • When creating the "serial number file" make sure to save it as type "All files" instead of "Text Document".

• The 3 files needs to be uploaded to the VM on which the restore is going to be done

• Once the needed files are uploaded with the respective serial number, then is just a matter to click "Restore From Backup" for the migration to begin.
  • In case you need to assign a different IP address or for any reason, the new should not have same IP address or network settings as the previous VM, make sure to select the option to "Override Network Configuration"

Note that access to the Web UI will be lost for few minutes or hours while the restored settings are applied, this is totally expected and Login page should come back after restore process completes. 

For additional assistance feel free to contact our KACE Support team.