Encryption in ontape for version 11.5
Pete asked whether ontape in 11.5 can encrypt archives directly, since his database is too big to dump to disk and encrypt afterwards. Answer: yes — use the BACKUP_FILTER and RESTORE_FILTER configuration parameters (documented in the Backup and Restore Guide) to pipe archives through an encryption or compression program; alternatively TAPEDEV/ontape -t STDIO with shell pipes works even on v10. Caveats raised: archecker can't read filtered/encrypted archives (APAR C56775, fix promised for a later 11.50 fixpack), filters also break onlog, and logical log backups handle BACKUP_FILTER/block sizes inconsistently. A dd-based workaround passing the archive header through unchanged was mentioned.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
Compressing or encrypting ontape/onbar archives via BACKUP_FILTER/RESTORE_FILTER breaks archecker's ability to read the archive (a documented defect, APAR C56775, affecting 10.00 and early 11.10/11.50 releases) unless the file is manually decompressed/decrypted first. A DBA who sets this up for routine backups without knowing this can find a table-level restore or archive validation impossible during an actual emergency.
onconfig:BACKUP_FILTER onconfig:RESTORE_FILTER archecker
Advisory only — not a substitute for testing in a non-production environment first.
I've seen a bunch of posts where users do archives to disk, THEN
encrypt the files and then send them (maybe) to tape, but is there any
"direct" encryption by the ontape command in version 11.5? We're only
on version 10, but plan on getting to 11.5 (or whatever is the latest
begging of next year), and we've been asked by some of our customers
if our archives to tape are encrypted. Our database is too large to
archive to disk, encrypt the file, then tar (or whatever) that
encrypted file to tape. I would think by now that ontape has a
"direct" encryption but....
Thanks in advance,
Pete
Yes, it is possible.
The keywords are BACKUP_FILTER and RESTORE_FILTER.
Check out these in the "IBM Informix Backup and Restore
Guide" manual.
Using these mechanisms you can encrypt, compress, etc.
Regards, Martin
--
Martin Fuerderer
IBM Informix Development Munich, Germany
Information Management
IBM Deutschland Research & Development GmbH
Chairman of the Supervisory Board: Martin Jetter
Board of Management: Erich Baier
Corporate Seat: Boeblingen, Germany
Reg.-Gericht: Amtsgericht Stuttgart, HRB 243294
informix-list-bounces@iiug.org wrote on 10/08/2009 04:09:46 PM:
>
> I've seen a bunch of posts where users do archives to disk, THEN
> encrypt the files and then send them (maybe) to tape, but is there any
> "direct" encryption by the ontape command in version 11.5? We're only
> on version 10, but plan on getting to 11.5 (or whatever is the latest
> begging of next year), and we've been asked by some of our customers
> if our archives to tape are encrypted. Our database is too large to
> archive to disk, encrypt the file, then tar (or whatever) that
> encrypted file to tape. I would think by now that ontape has a
> "direct" encryption but....
>
> Thanks in advance,
>
> Pete
> _______________________________________________
> Informix-list mailing list
> Informix-list@iiug.org
> http://www.iiug.org/mailman/listinfo/informix-list
Yes using the BACKUP_FILTER and RESTORE_FILTER configuration parameters.
See the Backup and Restore manual.
Art
Art S. Kagel
Oninit (www.oninit.com)
IIUG Board of Directors (art@iiug.org)
Disclaimer: Please keep in mind that my own opinions are my own opinions and
do not reflect on my employer, Oninit, the IIUG, nor any other organization
with which I am associated either explicitly or implicitly. Neither do
those opinions reflect those of other individuals affiliated with any entity
with which I am affiliated nor those of the entities themselves.
On Thu, Oct 8, 2009 at 10:09 AM, Pete <pete.dickson.ats@gmail.com> wrote:
> I've seen a bunch of posts where users do archives to disk, THEN
> encrypt the files and then send them (maybe) to tape, but is there any
> "direct" encryption by the ontape command in version 11.5? We're only
> on version 10, but plan on getting to 11.5 (or whatever is the latest
> begging of next year), and we've been asked by some of our customers
> if our archives to tape are encrypted. Our database is too large to
> archive to disk, encrypt the file, then tar (or whatever) that
> encrypted file to tape. I would think by now that ontape has a
> "direct" encryption but....
>
> Thanks in advance,
>
> Pete
> _______________________________________________
> Informix-list mailing list
> Informix-list@iiug.org
> http://www.iiug.org/mailman/listinfo/informix-list
>
You could also look at using TAPEDEV STDIO and "|" and "tee" etc. etc. (or ontape -t STDIO) and any encryption routine that takes in
stdio (even under 10).
Art Kagel wrote:
> Yes using the BACKUP_FILTER and RESTORE_FILTER configuration
> parameters. See the Backup and Restore manual.
>
> Art
>
> Art S. Kagel
> Oninit (www.oninit.com <http://www.oninit.com>)
> IIUG Board of Directors (art@iiug.org <mailto:art@iiug.org>)
>
> Disclaimer: Please keep in mind that my own opinions are my own opinions
> and do not reflect on my employer, Oninit, the IIUG, nor any other
> organization with which I am associated either explicitly or implicitly.
> Neither do those opinions reflect those of other individuals affiliated
> with any entity with which I am affiliated nor those of the entities
> themselves.
>
>
>
> On Thu, Oct 8, 2009 at 10:09 AM, Pete <pete.dickson.ats@gmail.com
> <mailto:pete.dickson.ats@gmail.com>> wrote:
>
> I've seen a bunch of posts where users do archives to disk, THEN
> encrypt the files and then send them (maybe) to tape, but is there any
> "direct" encryption by the ontape command in version 11.5? We're only
> on version 10, but plan on getting to 11.5 (or whatever is the latest
> begging of next year), and we've been asked by some of our customers
> if our archives to tape are encrypted. Our database is too large to
> archive to disk, encrypt the file, then tar (or whatever) that
> encrypted file to tape. I would think by now that ontape has a
> "direct" encryption but....
>
> Thanks in advance,
>
> Pete
> _______________________________________________
> Informix-list mailing list
> Informix-list@iiug.org <mailto:Informix-list@iiug.org>
> http://www.iiug.org/mailman/listinfo/informix-list
>
>
Yes, but be careful! If you compress or encrypt an archive under 10.00 (or
due to a bug in early releases of archecker in 11.10 & 11.50) you will note
be able to use archecker on that archive unless you manually uncompress or
unencrypt the file/tape first! Ontape and onbar are easy to deal with if
you compress or encrypt using a method other than employing the
BACKUP_FILTER/RESTORE_FILTER, but archecker cannot use a pipe to read the
archive, so you are hosed if you encrypt and have to recover a table using
archecker or want to use archecker to validate the archive.
Art
Art S. Kagel
Oninit (www.oninit.com)
IIUG Board of Directors (art@iiug.org)
Disclaimer: Please keep in mind that my own opinions are my own opinions and
do not reflect on my employer, Oninit, the IIUG, nor any other organization
with which I am associated either explicitly or implicitly. Neither do
those opinions reflect those of other individuals affiliated with any entity
with which I am affiliated nor those of the entities themselves.
On Thu, Oct 8, 2009 at 2:51 PM, theBP <theBP@usenet-news.net> wrote:
> You could also look at using TAPEDEV STDIO and "|" and "tee" etc. etc. (or
> ontape -t STDIO) and any encryption routine that takes in
> stdio (even under 10).>
> Art Kagel wrote:
> > Yes using the BACKUP_FILTER and RESTORE_FILTER configuration
> > parameters. See the Backup and Restore manual.
> >
> > Art
> >
> > Art S. Kagel
> > Oninit (www.oninit.com <http://www.oninit.com>)
> > IIUG Board of Directors (art@iiug.org <mailto:art@iiug.org>)
> >
> > Disclaimer: Please keep in mind that my own opinions are my own opinions
> > and do not reflect on my employer, Oninit, the IIUG, nor any other
> > organization with which I am associated either explicitly or implicitly.
> > Neither do those opinions reflect those of other individuals affiliated
> > with any entity with which I am affiliated nor those of the entities
> > themselves.
> >
> >
> >
> > On Thu, Oct 8, 2009 at 10:09 AM, Pete <pete.dickson.ats@gmail.com
> > <mailto:pete.dickson.ats@gmail.com>> wrote:
> >
> > I've seen a bunch of posts where users do archives to disk, THEN
> > encrypt the files and then send them (maybe) to tape, but is there
> any
> > "direct" encryption by the ontape command in version 11.5? We're only
> > on version 10, but plan on getting to 11.5 (or whatever is the latest
> > begging of next year), and we've been asked by some of our customers
> > if our archives to tape are encrypted. Our database is too large to
> > archive to disk, encrypt the file, then tar (or whatever) that
> > encrypted file to tape. I would think by now that ontape has a
> > "direct" encryption but....
> >
> > Thanks in advance,
> >
> > Pete
> > _______________________________________________
> > Informix-list mailing list
> > Informix-list@iiug.org <mailto:Informix-list@iiug.org>
> > http://www.iiug.org/mailman/listinfo/informix-list
> >
> >
> _______________________________________________
> Informix-list mailing list
> Informix-list@iiug.org
> http://www.iiug.org/mailman/listinfo/informix-list
>
There is a manual work-around based on "dd" originally proposed by Eric
Herber, in which the header (size TAPEBLK) of the "ontape" level 0 archive
is passed through unchanged but the rest is put through RESTORE_FILTER,
creating another file which "archecker" can then read.
We raised the "archecker" issue with IBM two years ago! The details are
(complete with miss-spelling!):
APAR C56775 AC_RESTORE_FILTER has no effect with zipped achieves using
archecker
IBM R&D have agreed to code a fix for the defect. However, as there is so
much code change involved, it may not make it into the 11.50.XC6 product and
may slip into the XC7 version. One of my colleagues believes the problem may
be that "archecker" was originally written by a third party, and might
therefore not share code with the rest of IDS.
David Linthwaite recently discovered (which I can corroborate) that filters
also break 11.50 "onlog".
Note also that 11.10 "ontape" logical log backup ignores BACKUP_FILTER, and
11.50 "ontape" logical log backup uses TAPEBLK not LTAPEBLK :-)
Regards,
Doug Lawry
"Art Kagel" <art.kagel@gmail.com> wrote in message
news:mailman.152.1255028396.6236.informix-list@iiug.org...
Yes, but be careful! If you compress or encrypt an archive under 10.00 (or
due to a bug in early releases of archecker in 11.10 & 11.50) you will note
be able to use archecker on that archive unless you manually uncompress or
unencrypt the file/tape first! Ontape and onbar are easy to deal with if
you compress or encrypt using a method other than employing the
BACKUP_FILTER/RESTORE_FILTER, but archecker cannot use a pipe to read the
archive, so you are hosed if you encrypt and have to recover a table using
archecker or want to use archecker to validate the archive.
On Thu, Oct 8, 2009 at 2:51 PM, theBP <theBP@usenet-news.net> wrote:
You could also look at using TAPEDEV STDIO and "|" and "tee" etc. etc. (or
ontape -t STDIO) and any encryption routine that takes in
stdio (even under 10).
Art Kagel wrote:
> Yes using the BACKUP_FILTER and RESTORE_FILTER configuration
> parameters. See the Backup and Restore manual.
> On Thu, Oct 8, 2009 at 10:09 AM, Pete <pete.dickson.ats@gmail.com
> <mailto:pete.dickson.ats@gmail.com>> wrote:
>
> I've seen a bunch of posts where users do archives to disk, THEN
> encrypt the files and then send them (maybe) to tape, but is there any
> "direct" encryption by the ontape command in version 11.5? We're only
> on version 10, but plan on getting to 11.5 (or whatever is the latest
> begging of next year), and we've been asked by some of our customers
> if our archives to tape are encrypted. Our database is too large to
> archive to disk, encrypt the file, then tar (or whatever) that
> encrypted file to tape. I would think by now that ontape has a
> "direct" encryption but....
>
> Thanks in advance,