OpenVMS Backup Encryption on V6.2/7.1

[Russ Carraro]

Customer wants to run "backup /encrypt" on their VAX/ALPHA clusters running OpenVMS 6.2 and 7.1. Has anyone done this? I can install a license and ENCRYPT 1.6 but what can be done about backup executables and shares?

[Hoff]

The "Encryption for OpenVMS Installation and Reference Manual" is available at the following URL:

http://h71000.www7.hp.com/doc/encryption.html

and this manual describes the function, installation, configuration and operation of the product -- including how the package interfaces with the BACKUP utility.

In this specific case, the Command Reference
section of the manual describes the BACKUP /ENCRYPT command.

If you should have any questions remaining after a quick review of the available documentation, do stop back. Remember to describe the particular goal(s), the command(s) used, and any error messages seen, too.

As for Google, the Google "site" keyword can be invaluable for targeting a search. Here's a specific example Google search string that's relevant to this topic:

site:h71000.www7.hp.com "backup /encrypt"

Stephen Hoffman
HoffmanLabs LLC

[Russ Carraro]

Thanks Hoff. I'd already looked at the manual. The customer uses DCL backup to create image saves of all their disks to tape each weekend. Those tapes are sent off site for disaster recovery purposes. They have a new corporate mandate saying all tapes sent off site must be encrypted. They are running Vaxs and Alphas with OpenVMS 6.2 and 7.1. "ENCRYPTION for OpenmVMS" says it is only supported on later versions of OpenVMS. What they want to know is, is there a way to get ENCRYPTION for OpenVMS installed and running on the OpenVMS 6.2 and 7.1?

[Robert Gezelter]

Russ,

Since Encrypt 1.6 (emphasis "1.6") requires OpenVMS 7.2-1 on either VAX or Alpha (according to page 2-1 of the manual).

Offhand, I do not remember when Encrypt 1.0 was released. I would have to dig through the old Consolidated Distributions (or which I have a goodly set) to find which versions were compatible with which releases.

Presuming we could find an old-enough version, there is the somewhat related question of obtaining the appropriate PAK.

- Bob Gezelter, http://www.rlgsc.com

[Russ Carraro]

Bob,

I never found version 1.0, the first one I found was ENCRYPT 1.6 from Sept. 2001. If you find a V1.0, I would appreciate hearing about it. Thanks.

Russ Carraro

[Jon Pinkley]

Be aware that encrypted data will not be effectively compressed by a tape drive with data compression capabilities.

Before spending the money for software encryption to run on an ancient version of VMS, consider a hardware device to do the compression and encryption. If the customer is currently using tape drives that support compression, and assuming that their data does compress now, encrypting the data will thwart the drives ability to compress the data, since it will appear to be random data.

There are tape drives available that can compress and encrypt the data, in that order. An example is the LT04 drive. However, it is questionable as to whether the customer's VMS systems would be able to keep an LT04 drive streaming. There are also third party devices that connect between an existing tape drive and the VMS system, and these do compression and encryption before the data gets to the tape drive, so the drives compression is not needed.

The extra media required for backing up without effective compression is just something to consider. At least factor in the additional media, plus the cost of offsite storage for additional tapes you will need to store offsite. You may find that a hardware solution will have a relatively short ROI due to avoided costs.

Jon

[Hoff]

The VAX Encryption product was first released circa 1985.

The "shim" shareable images where the Encryption product "injects" itself have been present in OpenVMS distributions as part of this.

There are folks around with experience in this area.

As for more reading material, here's some:

http://64.223.189.234/node/729
http://64.223.189.234/node/137
http://64.223.189.234/node/372

There is other material around.

Or -- given it's your customer asking you for support here, after all -- image over a copy of an existing box and/or load yourself up a fresh copy of OpenVMS (insert architecture) V6.2 system and, well, um, try it.

There are ECO kits for BACKUP around that can be involved with Encryption; do ensure current mandatory ECOs and any ECOs relevant to BACKUP are applied.

[Russ Carraro]

I installed ENCRYPT V1.6 on their VAX running OpenVMS 6.2 and it works.