mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
202ded5d11
Hyphens are converted by groff to a different unicode character leading to failing command execution of copy-pasted options or examples. Ensure that all hyphens are properly escaped. Reviewed-by: Stefan Haberland <sth@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
109 lines
3.1 KiB
Groff
109 lines
3.1 KiB
Groff
.\" Copyright 2017 IBM Corp.
|
|
.\" s390-tools is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the MIT license. See LICENSE for details.
|
|
.\"
|
|
.TH TAPE390_CRYPT 8 "Apr 2006" "s390-tools"
|
|
|
|
.SH NAME
|
|
tape390_crypt \- encryption support for zSeries tape devices.
|
|
|
|
.SH SYNOPSIS
|
|
.B tape390_crypt
|
|
[OPTION] [DEVICE]
|
|
|
|
.SH DESCRIPTION
|
|
.B tape390_crypt
|
|
exploits encryption features available in zSeries tape devices.
|
|
It can be used to enable or disable tape encryption and to set
|
|
KEK (Key Encrypting Key) labels.
|
|
|
|
.SH OPTIONS
|
|
.TP
|
|
.BR "\-h" " or " "\-\-help"
|
|
Print help information, then exit.
|
|
|
|
.TP
|
|
.BR "\-v" " or " "\-\-version"
|
|
Print version information, then exit.
|
|
|
|
.TP
|
|
.BR "\-q" " or " "\-\-query"
|
|
Print current encryption status of the specified tape device and of the
|
|
loaded medium.
|
|
If encryption is on and the medium is encrypted ,
|
|
additional information on the encryption keys is displayed.
|
|
|
|
.TP
|
|
.BR "\-e " { "on" | "off" } " " or " \-\-encryption=" { "on" | "off" }
|
|
sets tape encryption on or off.
|
|
|
|
.TP
|
|
.BR "\-k <value>" [ "<char>label" | "<char>hash" ] " " or " \-\-key=<value>" [ "<char>label" | "<char>hash" ]
|
|
sets tape encryption keys.
|
|
.br
|
|
<value> specifies the KEK
|
|
(Key Encrypting Key), which can be maximal 64 characters long.
|
|
.br
|
|
The store type (either label or hash) specifies how the KEK in <value> is to be stored on the tape medium. Since labels are
|
|
human readable strings and hence more user friendly than hashes,
|
|
the default store type is label.
|
|
.br
|
|
The \-k option can only be specified, if the tape medium is at load point.
|
|
.br
|
|
While processing the \-k option, the tape medium is initialized and all
|
|
data eventually contained on the tape medium is lost.
|
|
To avoid inadvertent data loss a prompt message is issued asking the user
|
|
whether he or she really wants to proceed.
|
|
.br
|
|
The \-k option can be specified maximal twice, because on the tape medium
|
|
maximal two EEDKs (External Encrypted Data Keys) can be stored.
|
|
If specified once, two identical EEDKs are stored.
|
|
.br
|
|
<char> is a character separating the KEK in <value> from the store type
|
|
(either label or hash). This
|
|
delimiter can be specified with the \-d option as explained below.
|
|
|
|
.TP
|
|
.BR "\-d <char>" " or " "\-\-delimiter=<char>
|
|
specifies the character which separates the KEK
|
|
in <value> from the store type (either label or hash).
|
|
The default delimiter is : (colon).
|
|
The \-d option can only be specified together with the \-k option.
|
|
|
|
.TP
|
|
.BR "\-f " " or " "\-\-force
|
|
specifies that no prompt message is to be issued before writing the KEK
|
|
information and initializing the tape medium.
|
|
The \-f option can only be specified together with the \-k option.
|
|
|
|
.TP
|
|
.BR device
|
|
specifies the device node of the tape device.
|
|
|
|
.SH EXAMPLES
|
|
1. Scenario:
|
|
.br
|
|
mount non-encrypted tape and write data with the
|
|
.B "default"
|
|
KEKs:
|
|
.br
|
|
tape390_crypt \-e on /dev/ntibm0
|
|
.br
|
|
tar cfz /dev/ntibm0 /data
|
|
|
|
2. Scenario:
|
|
.br
|
|
mount non-encrypted tape and write data with
|
|
.B "specific"
|
|
KEKs:
|
|
.br
|
|
tape390_crypt \-k my_first_key \-k my_second_key:hash /dev/ntibm0
|
|
.br
|
|
tar cfz /dev/ntibm0 /data
|
|
|
|
3. Scenario:
|
|
.br
|
|
mount tape and display current encryption status:
|
|
.br
|
|
tape390_crypt \-q /dev/ntibm0
|