Search <book_title>...

InfoScale™ 9.0 Storage Foundation Administrator's Guide - Linux

Last Published: 2025-04-14

Product(s): InfoScale & Storage Foundation (9.0)

Platform: Linux

Configuring a secure file system using CLI

The purpose of this section is to provide the step-by-step procedure for configuring a SecureFS and enabling corruption or ransomware protection using CLI. These procedures are presented separately for clarity and ease of understanding.

Before configuring SecureFS, make sure that the vxfstaskd service is in running state. You can use systemctl status vxfstaskd to check the state of service.

Use the following command to create filesystem on existing volume. To create volume, use vxassist command:
# /opt/VRTS/bin/mkfs -t vxfs <path_of_volume>
Sample command and output:
# mkfs -t vxfs /dev/vx/rdsk/testdg/vol1
```
version 18 layout
20971520 sectors, 10485760 blocks of size 1024,
log size 16384 blocks
rcq size 1024 blocks
largefiles supported
maxlink supported
WORM not supported
maxts supported
```
Note:
For ransomware protection, a file system should be WORM-enabled or softworm-enabled. You can enable WORM on a file system using the command: /opt/VRTS/bin/fsadm -o worm <path_of_mountpoint>. For ransomware protection, use the -o worm option with the mkfs command.
Mount the file system:
# mount -t vxfs <path of volume> <mount point>
Sample command:
# mount -t vxfs /dev/vx/dsk/testdg/vol1 /mnt1
Create SecureFS configuration file:
# vxschadm create <mount point>
Sample command:
# vxschadm create /mnt1

You can configure the same SecureFS for both corruption and ransomware protection based on your requirements.

Configure a file system for protection against corruption

Prepare the volume for snapshot:
# vxsnap -g <disk-group name> prepare <volume name>
Sample command:
# vxsnap -g testdg prepare vol1

Enable the snapshot feature:

# vxschadm add snapshot <interval in cron format> <maximum number of snapshots>

Use the following snapshot format to configure snapshots:

Format : "mm hh dd MM ww"
mm : minutes (0-59) or *
hh : hours (0-23) or *
dd : days (1-31) or *
MM: months (1-12) or *
ww: week (0-6) SUNDAY=0, SATURADAY=6

*: Refers 'per', for example, per minute, per hour, and so on.

Following is a sample output of a snapshot format:

Example 1: "30 15 * * *"
Every day at 1530 hours, task will be executed.
Example 2: "30 15 * * 6"
Every Saturday at 1530 hours, task will be executed.
Caution: "* * * * *"
Every minute and hour options are not supported.

Get the list of snapshots at a given interval:
# vxsnap -g <diskgroup name> list <volume name>
Sample command and output:
```
# vxsnap -g testdg list vol1
NAME DG            OBJTYPE      SNAPTYPE  PARENT PARENTDG SNAPDATE
vol1 testdg        vol          -         -         -        - -
secfs_1204231555vol1 testdg vol spaceopt vol1 testdg 2023/04/12 15
```
You can independently enable and disable all the features. To delete the feature use following command:
# /opt/VRTS/bin/vxschadm delete {snapshot | checkpoint | policy} <mount_point>
You can modify a configured feature using the "add" command:
# /opt/VRTS/bin/vxschadm add {snapshot | checkpoint | policy} <mount_point>
This completes the procedure for protecting the file system from corruption.

Configure a file system for protection against ransomware

Use the non-modifiable checkpoint for ransomware protection:
- Enable the checkpoint feature.
  # /opt/VRTS/bin/vxschadm add checkpoint <interval in os cron format> <maximum number of checkpoints> <retention period of checkpoint in days> <removable> <mount_point>
  Sample command and output
  # vxschadm add checkpoint "59 15 * * *" 1 0 1 /mnt1
```
Format : "mm hh dd MM ww"
mm : minutes (0-59) or *
hh : hours (0-23) or *
dd : days (1-31) or *
MM: months (1-12) or *
ww: week (0-6) SUNDAY=0, SATURADAY=6
```
  *: Refers 'per', for example, per minute, per hour, and so on.
  Following is a sample output of a snapshot format:
```
Example 1: "30 15 * * *"
Every day at 1530 hours, task will be executed.
Example 2: "30 15 * * 6"
Every Saturday at 1530 hours, task will be executed.
Caution: "* * * * *"
Every minute and hour options are not supported.
```
  The checkpoints are created as a non-modifiable checkpoint and mounted in a read-only (ro) mode.
- You can list the checkpoints using command.
  Use the following sample command if you want to recover a checkpoint or to get a list of checkpoint at a given interval:
  # fsckptadm list /mnt1 /mnt1
```
secfs_1204231559:
ctime = Wed 12 Apr 2023 03:59:31 PM IST
mtime = Wed 12 Apr 2023 03:59:31 PM IST
Retention period = 0
flags = largefiles, removable, worm
```

Create the policy file using following fsppmk command:

# fsppmk policy -b -n "worm policy" -v 6.0 > sample.xml
fsppmk rule -b -n "normal" -t data >> sample.xml
fsppmk select -b -u "root" -p "abc.txt" -r -e >> sample.xml
fsppmk worm -b -r 10Y >> sample.xml
fsppmk qualifier -b -q accage -t hours -c gt,1 -e >> sample.xml
fsppmk worm -e >> sample.xml
fsppmk rule -e >> sample.xml
fsppmk policy -e >> sample.xml

Following is the sample policy XML created using fsppmk commands:

<?xml version="1.0"?>
<!DOCTYPE PLACEMENT_POLICY SYSTEM "/opt/VRTSvxfs/etc/placement.dtd">
<PLACEMENT_POLICY Name="worm policy" Version="6.0">
	<RULE Flags="data" Name="normal  -t">
		<SELECT>
			<PATTERN Flags="recursive"> abc.txt </PATTERN>
			<USER> root </USER>
		</SELECT>
		<WORM>
			<RETENTION>
				<TIME> 10Y </TIME>
			</RETENTION>
			<WHEN>
				<ACCAGE Units="hours">
					<MIN Flags="gt"> 1 </MIN>
				</ACCAGE>
			</WHEN>
		</WORM>
	</RULE>
</PLACEMENT_POLICY>

Validate the policy file.
Sample command: # fsppadm validate /mnt1 sample.xml
Assign the policy file.
Sample command: # fsppadm assign /mnt1 sample.xml
See Administering placement policies. for more details on fsppadm.
Add the policy to the secure file system.
Sample command: # vxschadm add policy "15 16 * * *" /mnt1
The ransomware protection file system procedure is completed.

You can independently enable and disable all the features. To delete the feature, use following command:

# /opt/VRTS/bin/vxschadm delete {snapshot | checkpoint | policy} <mount_point>

You can modify a configured feature using the "add" command:

# /opt/VRTS/bin/vxschadm add {snapshot | checkpoint | policy} <mount_point>

For more details, see the vxschadm(1M) manual page.