19.3. Using volume_key in a larger organization

download PDF
In a larger organization, using a single password known by every system administrator and keeping track of a separate password for each system is impractical and a security risk. To counter this, volume_key can use asymmetric cryptography to minimize the number of people who know the password required to access encrypted data on any computer.
This section will cover the procedures required for preparation before saving encryption keys, how to save encryption keys, restoring access to a volume, and setting up emergency passphrases.

19.3.1. Preparation for saving encryption keys

In order to begin saving encryption keys, some preparation is required.

Procedure 19.3. Preparation

  1. Create an X509 certificate/private pair.
  2. Designate trusted users who are trusted not to compromise the private key. These users will be able to decrypt the escrow packets.
  3. Choose which systems will be used to decrypt the escrow packets. On these systems, set up an NSS database that contains the private key.
    If the private key was not created in an NSS database, follow these steps:
    • Store the certificate and private key in an PKCS#12 file.
    • Run:
      certutil -d /the/nss/directory -N
      At this point it is possible to choose an NSS database password. Each NSS database can have a different password so the designated users do not need to share a single password if a separate NSS database is used by each user.
    • Run:
      pk12util -d /the/nss/directory -i the-pkcs12-file
  4. Distribute the certificate to anyone installing systems or saving keys on existing systems.
  5. For saved private keys, prepare storage that allows them to be looked up by machine and volume. For example, this can be a simple directory with one subdirectory per machine, or a database used for other system management tasks as well.
Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.