Changing master keys to ensure data security

Changing master keys on the CDA on NetCache

ContentDirector contains two master key files

The ContentDirector core application generates two separate master key files that can be used to install the master key on the CDAs. These two files are

master_key.sh
The master_key.sh file is a shell script that automatically installs the master key on the CDA. Install the master_key.sh file by using the NetCache automatic configuration feature on the CDA. See Installing the master key from the NetCache Manager utility and Installing the master key from the CLI for more information.
master_key
The master_key file is a Java Serialized Object file that can be used to install the master key on a CDA if you want to avoid the security risks involved in transferring the master_key.sh file over the network. See If you want a more secure way of installing the master key for more information.

Note
To upload or download files using the Secure Sockets Layer (https://), you must have purchased and installed the SecureAdmin^TM software. See your Network Appliance sales representative for more information.

About using the automatic configuration feature

The primary function of the NetCache automatic configuration feature (also called multiple cache management) is to automate the periodic propagation of configuration settings to multiple target NetCache appliances. Although the automatic configuration feature can be used to install the ContentDirector master key, you must exercise caution because you can alter preexisting configuration rules.

Before performing the procedure described in Installing the master key from the NetCache Manager utility, consider the following recommendations:

When you enter the URL of the master_key.sh file in the Automatic Configuration Files Box, do not overwrite any preexisting configuration rules.
After you have downloaded the master_key.sh file, remove the MasterKey.sh URL from the Automatic Configuration Files box so that the action will not be repeated.

For more information about the automatic configuration feature, see the multiple cache management information in the Routine Administration Guide.

Installing the master key from the NetCache Manager utility

To use the NetCache automatic configuration feature to install the master key onto the CDA, complete the following steps.

Step	Action
1	Verify that the master_key.sh file has been copied from the config directory on the core application to an FTP or Web server that is accessible to the remote CDA. For example, the Tomcat Web server, which resides on the ContentDirector core application, can be used to serve the MasterKey.sh file. Record the URL of the master_key.sh file.
2	From the NetCache Manager utility, select Setup > ContentDirector > General.
3	Under ContentDirector Agent Enable, disable the ContentDirector service.
4	Click Commit Changes.
5	Access the NetCache CLI on the CDA for which you are installing the master_key.sh file.
6	Enter the following NetCache CLI command to clear any preexisting local master key: clear config.cd.master_key
7	From the NetCache Manager utility, select Setup tab > System > Automatic Configuration.
8	Enter the URL of the master_key.sh file (refer to Step 1) in the Automatic Configuration Files box. Caution Do not overwrite any preexisting automatic configuration rules. Use the following syntax: {http\|https\|ftp}://[user:paswrd@]ccm_srvr:ccm_port/directory/ master_key.sh In the preceding URL, user is the user name, paswrd is the password, ccm_srvr is the FTP or Web server host name or IP address, and ccm_port is the Content Control Manager port (the default is port 8080). Note You need only provide a user name and password if the server requires authentication. For example: http://Tomcat:8080/ContentDirector/master_key.sh
9	In the Get Configuration Files Now option, click Manual Update to immediately install the master key. Result The master key is installed on the CDA.
10	Enter the following NetCache CLI command to ensure that the master key was successfully installed: show config.cd.master_key
11	From the NetCache Manager utility, select Setup > ContentDirector > General.
12	Under ContentDirector Agent Enable, enable the ContentDirector service.
13	Click Commit Changes.
14	For security reasons, delete the master_key.sh file from the ContentDirector directory on the Tomcat Web server.

Installing the master key from the CLI

To install the master_key.sh file from the NetCache CLI, complete the following steps.

Step	Action
1	Copy the master_key.sh file to a temporary directory on an FTP or HTTP server. Ensure that the master_key.sh URL is accessible to the remote CDA. For example: http://tomcat:8080/ContentDirector/master_key.sh
2	From the NetCache Manager utility, select Setup > ContentDirector > General.
3	Under ContentDirector Agent Enable, disable the ContentDirector service.
4	Click Commit Changes.
5	Access the NetCache CLI on the CDA for which you are installing the master_key.sh file.
6	Use the NetCache CLI `add config.admin.config.list` command to import the master_key.sh file from its temporary FTP or HTTP location. Use the following syntax: add config.admin.config.list before local.cfg {http\|https\|ftp}://[userid:paswrd@]temp_srvr:port/direct orypath/master_key.sh In the preceding syntax, userid is the user name, paswrd is the password, temp_srvr is the FTP or HTTP server host name or IP address, and port is the FTP or HTTP server port. For example: add config.admin.config.list before local.cfg http://tomcat:8080/ContentDirector/master_key.sh
7	Enter the following NetCache CLI command to confirm that the master key was installed successfully: show config.cd.master_key If the master key installation is successful, a master key code number is displayed.
8	Use the NetCache CLI `delete` command to delete the master_key URL from the NetCache appliance configuration file download list. For example: delete config.admin.config.list http://tomcat:8080/ContentDirector/master_key.sh
9	From the NetCache Manager utility, select Setup > ContentDirector > General.
10	Under ContentDirector Agent Enable, enable the ContentDirector service.
11	Click Commit Changes.
12	Delete the master_key.sh file from its temporary transfer location on the FTP or HTTP server.

If you want a more secure way of installing the master key

If you are concerned about the security risks involved in transferring the master_key.sh file over the network, you can install the Java Serialized Object master_key file. The master_key file can be copied to disk and manually transported to the local network, where it can be copied directly to the CDA.

To install the master_key file, complete the following steps.

Step	Action
1	From the NetCache Manager utility, select Setup > ContentDirector > General.
2	Under ContentDirector Agent Enable, disable the ContentDirector service.
3	Click Commit Changes.
4	Enter the following NetCache CLI command to clear any preexisting local master key: clear config.cd.master_key
5	Copy the master_key file (from disk) to a location on the local network that is accessible to the CDA.
6	Using the NetCache CLI `cp` command, copy the master_key file to the following directory on the NetCache appliance: /tmp The syntax of the `cp` command is as follows: cp source_file destination_file
7	Enter the following NetCache CLI command to set the master key: setmk
8	Enter the following NetCache CLI command to ensure that the master key was successfully installed: show config.cd.master_key
9	From the NetCache Manager utility, select Setup > ContentDirector > General.
10	Under ContentDirector Agent Enable, enable the ContentDirector service.
11	Click Commit Changes.

Note
After the setmk command is executed, the master_key file is automatically deleted from the /tmp directory location on this appliance.