NetBackup™ Commands Reference Guide
- Introduction
- Appendix A. NetBackup Commands
- acsd
- backupdbtrace
- backuptrace
- bmrc
- bmrconfig
- bmrepadm
- bmrprep
- bmrs
- bmrsrtadm
- bp
- bparchive
- bpbackup
- bpbackupdb
- bpcatarc
- bpcatlist
- bpcatres
- bpcatrm
- bpcd
- bpchangeprimary
- bpcleanrestore
- bpclient
- bpclimagelist
- bpclntcmd
- bpclusterutil
- bpcompatd
- bpconfig
- bpdbjobs
- bpdbm
- bpdgclone
- bpdown
- bpduplicate
- bperror
- bpexpdate
- bpfis
- bpflist
- bpgetconfig
- bpgetdebuglog
- bpimage
- bpimagelist
- bpimmedia
- bpimport
- bpinst
- bpkeyfile
- bpkeyutil
- bplabel
- bplist
- bpmedia
- bpmedialist
- bpminlicense
- bpnbat
- bpnbaz
- bppficorr
- bpplcatdrinfo
- bpplclients
- bppldelete
- bpplinclude
- bpplinfo
- bppllist
- bpplsched
- bpplschedrep
- bpplschedwin
- bppolicynew
- bpps
- bprd
- bprecover
- bprestore
- bpretlevel
- bpschedule
- bpschedulerep
- bpsetconfig
- bpstsinfo
- bpstuadd
- bpstudel
- bpstulist
- bpsturep
- bptestbpcd
- bptestnetconn
- bpup
- bpverify
- cat_convert
- cat_export
- cat_import
- configureCerts
- configureMQ
- configureWebServerCerts
- create_nbdb
- csconfig cldinstance
- csconfig cldprovider
- csconfig meter
- csconfig reinitialize
- csconfig throttle
- duplicatetrace
- importtrace
- jbpSA
- jnbSA
- ltid
- mklogdir
- msdpcldutil
- nbauditreport
- nbcallhomeproxyconfig
- nbcatsync
- NBCC
- NBCCR
- nbcertcmd
- nbcertupdater
- nbcldutil
- nbcmdrun
- nbcomponentupdate
- nbcplogs
- nbcredkeyutil
- nbdb_admin
- nbdb_backup
- nbdb_move
- nbdb_ping
- nbdb_restore
- nbdb_unload
- nbdb2adutl
- nbdbms_start_server
- nbdbms_start_stop
- nbdc
- nbdecommission
- nbdelete
- nbdeployutil
- nbdevconfig
- nbdevquery
- nbdiscover
- nbdna
- nbemm
- nbemmcmd
- nbepicfile
- nbfindfile
- nbfirescan
- nbfp
- nbftadm
- nbftconfig
- nbgetconfig
- nbhba
- nbholdutil
- nbhostidentity
- nbhostmgmt
- nbhypervtool
- nbidpcmd
- nbimageshare
- nbinstallcmd
- nbjm
- nbkmiputil
- nbkmscmd
- nbkmsutil
- nboraadm
- nborair
- nboracmd
- nbpem
- nbpemreq
- nbmariadb
- nbmlb
- nbperfchk
- nbplupgrade
- nbrb
- nbrbutil
- nbreplicate
- nbrepo
- nbrestorevm
- nbseccmd
- nbserviceusercmd
- nbsetconfig
- nbshvault
- nbsmartdiag
- nbsnapimport
- nbsnapreplicate
- nbsqladm
- nbsqlite
- nbstl
- nbstlutil
- nbstop
- nbsu
- nbsvrgrp
- netbackup_deployment_insights
- resilient_clients
- restoretrace
- stopltid
- tldd
- tldcd
- tpautoconf
- tpclean
- tpconfig
- tpext
- tpreq
- tpunmount
- verifytrace
- vltadm
- vltcontainers
- vlteject
- vltinject
- vltoffsitemedia
- vltopmenu
- vltrun
- vmadd
- vmchange
- vmcheckxxx
- vmd
- vmdelete
- vmoprcmd
- vmphyinv
- vmpool
- vmquery
- vmrule
- vmupdate
- vnetd
- vssat
- vwcp_manage
- vxlogcfg
- vxlogmgr
- vxlogview
- W2KOption
Name
nbkmiputil — executes the various external KMS server operations.
SYNOPSIS
-getKey -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path -keyId key_ID [-kadLength KAD_length] | -nbKeyGroup key_group_name [-kadLength KAD_length] | -kad key_associated_data [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-getDetails] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]
-listKeyIDs -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-nbKeyGroup key_group_name] [-activeKey] [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-getDetails] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-maxItems number] [-offset number] [-jsonCompact]
-setAttribute -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path -keyId key_ID -attributeName attribute_name -attributeValue attribute_value [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]
-validate -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]
-ekmsCheckCompat | -ecc -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-kmipVersion version] [-jsonCompact] [-extended] [-verbose]
-setState -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path -keyId key_ID -stateType 1 | 2 | 3 | 4 [-revocationReason 1 | 2 | 3 | 4 | 5 | 6 | 7] [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-connectTimeout time_in_seconds] [-requestTimeout seconds] [-kmipVersion version] [-jsonCompact]
On UNIX systems, the directory path to this command is /usr/openv/netbackup/bin/goodies/
On Windows systems, the directory path to this command is install_path\NetBackup\bin\goodies\
DESCRIPTION
The nbkmiputil runs the various external KMS server operations like retrieving keys, listing key IDs, setting key attributes, setting key states, and validating KMS servers.
The command supports the following operations:
|
-ekmsCheckCompat or -ecc |
Use -ekmsCheckCompat or -ecc to determine if NetBackup is compatible with the specified external KMS server. You can also use this option to determine if the following KMIP operations are supported on the external KMS server: Create keys and retrieve keys by key group and key ID. |
|
-getKey |
Fetches the NetBackup keys from the external KMS server. |
|
-listKeyIDs |
Lists NetBackup key IDs that are present in the external KMS server as per the specified options. |
|
-setAttribute |
Sets the custom attribute for the given key in the external KMS server. Supported attribute names are x-application, x-keygroup, and x-comment. |
|
-setState |
Sets the state for the given key in the external KMS server. |
|
-validate |
Validates the related functionality with the external KMS server. The functionality that is validated includes:
|
OPTIONS
- -activeKey
Specifies whether to list only active NetBackup keys.
- -attributeName
Specifies the custom attribute name to be set. Supported attribute names are x-application, x-keygroup, and x-comment.
- -attributeValue
Specifies the custom attribute value to be set. Supported attribute value for attribute x-application : NetBackup.
- -certPath
Specifies the path of the PEM-encoded certificate that is to be used for authentication with the external KMS server.
- -connectTimeout
Specifies the time-out value to connect to the external KMS server in seconds. The default value is 120 seconds.
- -crlCheckLevel
Specifies the CRL check level. The possible values are: LEAF, CHAIN, and DISABLE. The default value is LEAF.
LEAF - Revocation status of peer's leaf certificate is checked.
CHAIN - Revocation status of full chain of peer certificate is checked.
DISABLE - Revocation status of peer certificate is not checked.
- -extended
Performs operations such as locate keys, get attributes, and set attributes in addition to creating and retrieving keys by key group and key ID.
- -getDetails
Displays the additional key attributes details for the NetBackup keys.
- -jsonCompact
Specifies whether to display the output in JSON compact form.
- -kad
Specifies the key associated data (KAD) of the NetBackup key to be fetched from the external KMS server.
- -kadLength
Specifies the length up to which KAD of a NetBackup key is to be generated.
- -keyId
If -keyId is used with the -getKey option, it specifies the key ID of the NetBackup key to be fetched from the external KMS server. If it is used with the -setAttribute option, it specifies the key ID of the key for which a custom attribute is to be set.
- -kmsServer
Specifies the external KMS server name with which you want to connect.
- -kmipVersion version
Specifies the KMIP version to be used. Supported KMIP versions: 1.0, 1.1, 1.2, 1.3, 1.4, and 2.0.
- -maxItems
Specifies the maximum number of key IDs to be listed.
- -nbKeyGroup
If it is used with the -getKey option, it specifies the key group name whose active and latest key is to be fetched from the external KMS server. If it is used with the -listKeyIDs option, it specifies the key group name for which keys are to be listed.
- -offset
Specifies the offset number of the key ID from where the list of key IDs starts. The default value is 0.
- -passphrasePath
Specifies the path of the file containing the passphrase that is required to access the keystore for authentication with the external KMS server.
- -port
The port number in use by the external KMS server.
- -privateKeyPath
Specifies the path of the private key that is to be used for authentication with the external KMS server.
- -requestTimeout
Specifies the time-out value for the given request to external KMS server in seconds. Default value is 300 seconds.
- -revocationReason 1 | 2 | 3| 4 | 5 | 6 | 7
Supported key revocation reasons:
For -stateType DEACTIVATED:
1 | UNSPECIFIED: The reason for key revocation is not specified.
2 | AFFILIATION_CHANGED: The key owner's affiliation with the organization has changed.
3 | SUPERSEDED: The current key needs to be replaced with the newly issued key.
4 | CESSATION_OF_OPERATION: The key is no longer required because the associated operation or the service is discontinued.
5 | PRIVILEGE_WITHDRAWN: The privileges with the given key are withdrawn.
For -stateType COMPROMISED:
6 | KEY_COMPROMISE: The key is compromised.
7 | CA_COMPROMISE: The certificate authority (CA) that issued the certificate to the external KMS server is compromised.
- -stateType 1 | 2 | 3 | 4
Supported state types:
1 | ACTIVE: You can use this key for cryptographic purpose.
2 | DEACTIVATED: You should only use this key to process cryptographic information.
3 | COMPROMISED: You should only use this key to process cryptographic information in a trusted client using managed keys that are compromised.
4 | DESTROYED: You should not use this key to process cryptographic information.
- -trustStorePath
Specifies the path of the PEM-encoded CA certificate that is to be used for authentication with the external KMS server.
- -verbose
Specifies whether to display a detailed output in a JSON form.
EXAMPLES
Example 1: Set custom attributes for the external KMS.
nbkmiputil -setAttribute -kmsServer example.veritas.com -port 5696 -certPath /usr/cert.pem -privateKeyPath /usr/key.pem -trustStorePath /usr/ca.pem -keyId EFF18E49-DBBF-4F84-BF94-13F4A6B6E32B -attributeName x-keygroup -attributeValue msdp