Cloud Volumes Backup: Support tool - Configuration
The config sub-commands are provided to verify entries in the secure_client_config.yaml configuration file. When running the config sub-commands it is recommended that you designate the current working directory as the location for the secure_client_config.yaml file (As the default configuration of provided key/certificates within the secure_client_config.yaml are relative file-system paths).
All of the sub-commands within the config command take a single parameter, the file-system path of the secure client configuration file (typically secure_client_config.yaml). The only exception is in the check-processes sub-command.
The available sub-commands in the config module are:
check-certificates.check-endpointscheck-portscheck-processesverify
check-certificates - Check certificates and keys are valid
The check-certificates sub-command enables you to verify information pertaining to the provided certificate and key. It will check whether the provided files exist, as well as file permissions for owner and group. Finally, it will output discovered info for the provided certificate. Certificates are expected to have permissions of 644 while keys are expected to have permissions of 600. If you have set up a secureclient user as the owner of these files, you should run the command as the secureclient user.
Example usage:
To check the permissions/existence on certificates provided in secure_client_config.yaml, run the following command:
bash$ ./cvbu-support-tool config check-certificates ./secure_client_config.yaml
File Exists
---------- --------
ca.crt True
client.crt True
client.key True
File Owner Group. Permissions Recommended permissions
---------- ------------ ------------ ------------- -------------------------
ca.crt secureclient secureclient 644 644
client.crt secureclient secureclient 644 644
client.key secureclient secureclient 600 600
------------ ------------------------------------
Store name tom-test-store
Store id 980eabd0-ef8e-4b13-989a-225f8c456c9d
Cmd forward 10.10.13.111:30828
Data forward 10.10.13.111:31536
Expiry 2020-09-24 09:11:15
Expired False
------------ ------------------------------------
Certificate verified to CA successfully
Key and certificate match!
check-endpoints - Check endpoints are valid
The check-endpoints sub-command enables you to verify that the provided endpoints specified as target1/target2 are valid targets. It does so by verifying against the api/v2/services endpoint within Cloud Volumes Backup to determine if the specified endpoint is in the returned endpoint set.
The optional parameter --api-endpoint can be provided to change the endpoint this verification is completed against. Valid options are: demo or production
Example usage:
To check the endpoints specified under target1/target2 in ./secure_client_config.yaml, run the following command:
bash$ ./cvbu-support-tool config check-endpoints ./secure_client_config.yaml
Endpoint: eu-dublin-2.cloudvolumes.hpe.com valid
Endpoint: eu-dublin-2.cloudvolumes.hpe.com valid
check-ports - Check local ports
The check-ports sub-command enables you to check the bind status of secure_client processes on the system. It is recommended that you run the command with superuser/sudo access (Alternatively you can set the CAP_NET_ADMIN capability bit on the binary with: setcap cap_net_admin+eip ./cvbu-support-tool). If the secure client is running as the current user, sudo is not required. If Bound is 0 for CMD or DATA, the secure client is not detected listening on the required ports. If Bound is 1, the secure_client is bound successfully to the ports. If Bound > 1, you may have more than 1 secure client processes listening on the same port, potentially causing transport errors. The ports tested are specified in the config file as source1/source2.
Example usage:
To check if the secure client is listening on the specified ports on the local system, run the following command:
bash$ sudo ./cvbu-support-tool config check-ports ./secure_client_config.yaml
Name Port Bound
------ ------ -------
CMD 9387 1
DATA 9388 1
check-processes - Check secure client process state
The check-processes sub-command enables you to check the number of secure_client processes running on the current machine. Running multiple secure_client processes on the same machine is an advanced configuration setup, and for most users, having more than 1 entry should be considered a mis-configuration.
Note that this command does not require a configuration parameter.
The --cmd optional parameter allows you to modify the command checked for. If you have renamed the binary to something other than secure_client you will need to set this flag.
Example usage:
To view running secure_client processes on the local node, run the following command:
bash$ sudo ./cvbu-support-tool config check-processes
PID CMD USER PORTS
----- ------------- ------------ ----------
21278 secure_client secureclient 9387, 9388
verify - Check config file values
The verify sub-command enables you to run all component tests from the configuration module. It takes as parameter a configuration file and optionally an --api-endpoint.
The --api-endpoint optional parameter can be provided to change the endpoint this verification is completed against. Valid options are: demo or production
Example usage:
To verify the configuration file ./secure_client_config.yaml, run the following command:
bash$ sudo ./cvbu-support-tool config verify ./secure_client_config.yaml
Validate: ca, key, cert
File Exists
---------- --------
ca.crt True
client.crt True
client.key True
File Owner Group Permissions Recommended permissions
---------- ------------ ------------ ------------- -------------------------
ca.crt secureclient secureclient 644 644
client.crt secureclient secureclient 644 644
client.key secureclient secureclient 600 600
------------ ------------------------------------
Store name tom-test-store
Store id 980eabd0-ef8e-4b13-989a-225f8c456c9d
Cmd forward 10.10.13.111:30828
Data forward 10.10.13.111:31536
Expiry 2020-09-24 09:11:15
Expired False
------------ ------------------------------------
Certicicate verified to CA successfully
Key and certificate match!
Validate: target1, target2
Endpoint: eu-dublin-2.cloudvolumes.hpe.com valid
Endpoint: eu-dublin-2.cloudvolumes.hpe.com valid
Validate: source1, source2
Name Port Bound
------ ------ -------
CMD 9387 1
DATA 9388 1