Veritas InfoScale™ 8.0.2 Installation Guide - Linux

To enroll the InfoScale public key

1. To download the InfoScale public key, connect to a system using ssh and then type the following command:

   # wget publickey_location

   Here, publickey_location represents the source location of the public key.

   For example, to download the key directly from the Veritas SORT website, enter the following command:

   # wget https://sort.veritas.com/public/infoscale/keys/pubkey.der

   See Get the InfoScale cryptographic public keys (for Secure Boot-enabled systems).

2. Verify that the key has downloaded successfully. Type the following command:

   # ls

   A key named pubkey.der appears in the list of local files and directories, as shown:

   Boot	etc	lib64	mnt_12345	proc	run	src	usr afs	bin	home	
   media	sys	var	sbin	dev	lib mnt	opt	root	pubkey.der
   

3. Import the downloaded public key on the system using the following command:

   # mokutil --import pubkey.der

4. On the password prompt, assign a password for the public key.

   Then type the same password again to confirm the password.

   Note:

   Make a note of this password. The password is required in the subsequent step for enrolling the key in the system MOK.

   The same password is also required if you want to delete the key from the system.

5. To add the imported public key to the Machine Owner Key (MOK) database on the system, switch to the console view of the system and then restart the system.
6. At system boot, the UEFI key management screen appears for a few seconds. Quickly press any key to enter the MOK management interface.
   

   Note:

   If you miss the UEFI key management screen at startup, restart the system and try again.

7. On the Perform MOK management screen, select Enroll MOK from the list of options that are displayed and press Enter.
   
8. On the Enroll MOK screen, select Continue and press Enter.
9. On the Enroll the key(s) screen, select Yes and press Enter.
10. On the password prompt, type the password that you assigned to the public key earlier and then press Enter.
    
11. On the Perform MOK management screen, select Reboot and press Enter to restart the system.
    
12. To verify that the public key is successfully added, connect to the system again using ssh and type the following command at the terminal:

    # mokutil --list-enrolled

    The Veritas public key appears in the list of enrolled keys on the system. The command output resembles the following:

    Certificate:
    Data:
    Version: 3 (0x2)
    Serial Number:
    31:60:a1:4b:8d:3a:af:9:94:c4:a6:8:56:08:ce:0:84:bd:b8:75
    Signature Algorithm: sha256WithRSAEncryption
    Issuer: O=Veritas Technologies LLC, CN=Veritas Technologies LLC Kernel
    signing key/emailAddress=enterprise_technical_support@veritas.com
    Validity
    Not Before: Dec 13 12:31:12 2022 GMT
    Not After I sep 26 12:31:12 2296 GMT
    

    Subject: O=Veritas Technologies LLC, CN=Veritas Technologies LLC Kernel
    signing key/emailAddress=enterprise_technical_support@veritas.com
    Subject Public Key Info:
    Public Key Algorithm: rsaEncryption
    Public-Key: (4096 bit)
    Modulus:
    00:44:09:26:05:13:76:58:18:1:8f:f0: fe:4a:1d:
    0b:6c:a5:01:94:2d:05:75:45:11:44:06:ad:2e:35:
    2e:7e:20:7a:3e:8f:d2:3e:e2:c0:fb:44:0d:15:1b:
    4c:b1:06:3:b9:93:fa:2d:5d:76:4:08:52:02:01:
    de: f2:46:48:24:44d1:1a:3c:b9:39:0:73:24:04:
    2c:dc: 58:99:75:81:b7:d1:ff:89:de: 1d: 8e: d9: ee:
    6c:9a:ba:5e:20:26:a4:dd: 96:9e:82:0a:89:95:60:
    00:5e:ba: 98:2:91:62:08:39:66:83:70:84:b6:54:
    2f:50:7a:00:9:56:7d:fe: e2:5:8a:b6:63:7a:ce:
    47:33:44:04:20:e3: d6:74:51:0:96: da: 20:80:ff:
    21:e4:96:eb:27:dc:93:24:dd:e3:53:5c:5e:ec:47:
    08:28:d3:88:ae:27:8c:11:80:C4:47:04:46:ff:54:
    95:13:98:d6:14:9:01:87:1a:6b:07:4:8:72:d7:

    The process of enrolling the InfoScale public key on the system is now complete.

    Repeat these steps on all the systems where you intend to deploy the InfoScale packages that contain digitally signed kernel modules.