Managing Secure Connect with OST or RDA plug-in 4.1.0.265 or later
Unless manually disabled, Secure Connect is always running on the QoreStor server. Starting with QoreStor plug-in version 4.1.0.265, Secure Connect is enabled by default on the client machine. Review the sections below for the procedures to check Secure Connect status or disable and enable Secure Connect.
The commands below can be run both on the QoreStor server and the client machines. In both cases, the sc_manager command must be run from the directory that includes the sc.client.properties file. By default this is:
- On the QoreStor server /opt/qorestor/bin
|
|
NOTE: When configuring Secure Connect on the QoreStor server, the changes made are applicable only for container or optimized replication in which the QoreStor instance is a source. |
- For client machines, this is the plug-in installation directory. For example, for NetVault:
- Linux clients - /usr/local/ocarda
- Windows clients - C:\Program Files\Quest\RDA\Dynlib
|
|
IMPORTANT: The procedures below use the sc_manager command which must be run by the root account. |
Checking Secure Connect status
To check the status of Secure Connect
- Run the command sc_manager status according to one of the methods below:
- The status of Secure Connect will be displayed:
SecureConnect.enabled = true
Disabling Secure Connect
To disable Secure Connect
- Run the sc_manager disable command as described below:
- The status of Secure Connect will be displayed as confirmation:
SecureConnect.enabled = false
- After disabling Secure Connect, a service restart must be performed.
- If you disabled Secure Connect on the QoreStor server, restart the QoreStor services using the commands:
/opt/qorestor/bin/ctrlrpc -p 9901 node.stop
/opt/qorestor/bin/ctrlrpc -p 9901 node.start
- If you disabled Secure Connect on the client machine, services of the DMA application on that machine need to be restarted.
Enabling Secure Connect
To enable Secure Connect
- Run the sc_manager enable command as described below:
- The status of Secure Connect will be displayed as confirmation:
SecureConnect.enabled = true
- After enabling Secure Connect, a service restart must be performed.
- If you enabled Secure Connect on the QoreStor server, restart the QoreStor services using the commands:
/opt/qorestor/bin/ctrlrpc -p 9901 node.stop
/opt/qorestor/bin/ctrlrpc -p 9901 node.start
- If you enabled Secure Connect on the client machine, services of the DMA application on that machine need to be restarted.
Adding certificates for Secure Connect
The QoreStor Secure Connect feature requires custom certificates on both the client and QoreStor server machine.
|
|
NOTE: The certificates on both the client machine and QoreStor server must be from the same certificate authority. |
Adding a Secure Connect certificate - Windows Client
- Prepare custom certificates chain and install them to the certificate store using the Microsoft Management Console (MMC) Certificates snap-in.
- Install the Root certificate to Trusted Root Certification Authorities.
- If necessary, install the Intermediate certificate to Intermediate Certification Authorities.
- Install the Server certificate to Personal.
- In the client installation directory, open the sc_client.properties file with a text editor.
- Edit the entries below:
- openSSL.client.caConfig - The path to the file of the trusted root certificate or directory containing the trusted root certificates chain. For specifying directory path, be sure that directory contains certificates in the PEM format and symbolic links to the certificate files, created by the c_rehash utility.
- openSSL.client.certificateFile - The path to the file containing the server's or client's certificate in PEM format.
- openSSL.client.privateKeyFile - The path to the file containing the private key for the certificate in PEM format.
Example in case there is the chain of 3 certificates (root, intermediate, server), private key and they are located in the same directory as sc_client.dll:
- openSSL.client.caConfig = ${application.configDir}
- openSSL.client.certificateFile = ${application.configDir}server-certificate-name.pem
- openSSL.client.privateKeyFile = ${application.configDir}privat-key-name.key
Example in case there is the chain of 2 certificates (root, server), private key and they are located at C:\certificates:
- openSSL.client.caConfig = C:\certificates\root-certificate-name.pem
- openSSL.client.certificateFile = C:\certificates\server-certificate-name.pem
- openSSL.client.privateKeyFile = C:\certificates\privat-key-name.key
- Make c_rehash for the certificates:
- Download perl from https://www.activestate.com/ActivePerl.
- Download the perl script c_rehash, stored inside OpenSSL (https://wiki.openssl.org/index.php/Binaries)
- Set the new openssl environment variable with the path to openssl.
- Run the command prompt.
- Use perl.exe with path_to_the_c_rehash and path_to_the_cert_dir arguments (e.g. perl.exe C:\<path to the c_rehash> C:\<path to the certificates directory>)
- When Secure Connect is used with any DMA - restart DMA services.
|
|
NOTE: If certificate validation fails, the connection between client and server will fail back to a normal connection. |
Adding a Secure Connect certificate - Linux Client and QoreStor server
- Prepare custom certificates chain
- Place the certificate to be trusted (in PEM format) in /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust at the prompt.
If the certificate is in OpenSSL’s extended BEGIN TRUSTED CERTIFICATE format, place it in /etc/pki/ca-trust/source and run sudo update-ca-trust.
- Make c_rehash for the certificates:
- Install the openssl-perl package.
- Run c_rehash <path-to-the-folder-with-certificates>.
- In the client installation directory, open the sc_client.properties file with a text editor.
- Edit the entries below:
- openSSL.client.caConfig - The path to the file of the trusted root certificate or directory containing the trusted root certificates chain. For specifying directory path, be sure that directory contains certificates in the PEM format and symbolic links to the certificate files, created by the c_rehash utility.
- openSSL.client.certificateFile - The path to the file containing the server's or client's certificate in PEM format.
- openSSL.client.privateKeyFile - The path to the file containing the private key for the certificate in PEM format.
Example in case there is the chain of 3 certificates (root, intermediate, server), private key and they are located in the same directory with sc_client.so, server side:
- openSSL.server.caConfig = ${application.configDir}
- openSSL.server.certificateFile = ${application.configDir}server-certificate-name.pem
- openSSL.server.privateKeyFile = ${application.configDir}privat-key-name.key
Example in case there is the chain of 2 certificates (root, server), private key and they are located at /usr/certificates on the client machine:
- openSSL.client.caConfig = /usr/certificates/root-certificate-name.pem
- openSSL.client.certificateFile = /usr/certificates/server-certificate-name.pem
- openSSL.client.privateKeyFile = /usr/certificates/privat-key-name.key
- When Secure Connect is used with any DMA - restart DMA services.
|
|
NOTE: If certificate validation fails, the connection between client and server will fail back to a normal connection. |
Enabling MultiConnect
Before using MultiConnect, ensure that the default port configuration is appropriate for your environment. The port used by MultiConnect is:
- 11000 - This is the standard MultiConnect communication port for backup.
- 9920 - This is the standard MultiConnect communication port for managed replication.
To enable Secure Connect on a Windows client
- On the client server, press Win+R to open the Run window.
- Type sysdm.cpl and click OK.
- Click the Advanced tab, then Environment Variables.
- In the System Variables section, click New.
- In the Variable name field, enter REMOTE_CLNT_MAX_CONNS.
- In the Variable value field, enter one of the following:
- 4 - establishes 4 connections.
- 8 - establishes 8 connections.
- 16 - establishes 16 connections.
- Click OK, then OK.
- Restart the DMA services for the change to take effect.
To enable MultiConnect on a Linux client
- At the command prompt on the client machine, enter the following command
echo 'export REMOTE_CLNT_MAX_CONNS=<4|8|16>' >> /etc/profile
Where:
- 4 - establishes 4 connections.
- 8 - establishes 8 connections.
- 16 - establishes 16 connections.
- Restart the DMA services for the change to take effect.
To enable MultiConnect between QoreStor servers
- At the command prompt on the source machine, enter the following command
echo 'export REPL_CLNT_MAX_CONNS=16' >> /etc/oca/oca.cfg
- Restart the ocards service for the change to take effect.
Configuring and using Rapid NFS and Rapid CIFS
Rapid NFS and Rapid CIFS enable write operation acceleration on clients that use NFS and CIFS file system protocols. Similar to OST and RDS, these accelerators allow for better coordination and integration between QoreStor backup, restore, and optimized duplication operations with Data Management Applications (DMAs) such as CommVault, EMC Networker, and Tivoli Storage Manager. For the current list of supported DMAs, see the QoreStor Interoperability Guide.
Rapid NFS is a new client file system type that ensures that only unique data is written to QoreStor. It uses user space components and file system in user space (FUSE) to accomplish this. Metadata operations such as file creates and permission changes go through the standard NFS protocol, whereas write operations go through Rapid NFS.
Rapid CIFS is a Windows-certified filter driver that also ensures that only unique data is written to QoreStor. All chunking and hash computations are done at the client level.
|
|
NOTE: The supported DMAs listed in the QoreStor Interoperability Guide are the DMAs that have been tested and qualified with Rapid NFS and Rapid CIFS. You can use Rapid NFS and Rapid CIFS with other DMAs, but those products have not been tested and qualified with Rapid NFS or Rapid CIFS. |
