Andreas Jaeger b86d6b5660 move documentation into the new standard layout

This change moves existing files.
It is not meant to be the final word on how the main page looks or how the
other files are organized, but it gets everything roughly into shape. If
the barbican team wants to make changes, please do those as follow-up patches.

Note this does not touch the api directory, this one needs to be
migrated to the api-ref.

This is part of the docs migration work for Pike.

Change-Id: Ibb9d971806964ac185882272514ee9563089d69d

2017-06-30 20:12:52 +02:00

2.9 KiB

Raw Blame History

Barbican Service Management Utility

Description

barbican-manage is a utility that is used to control the barbican key manager service database and Hardware Secure Module (HSM) plugin device. Use cases include migrating the secret database or generating a Master Key Encryption Key (MKEK) in the HSM. This command set should only be executed by a user with admin privileges.

Options

The standard pattern for executing a barbican-manage command is:

barbican-manage <category> <command> [<args>]

Running barbican-manage without arguments shows a list of available command categories. Currently, there are 2 supported categories: db and hsm.

Running with a category argument shows a list of commands in that category:

barbican-manage db --help
barbican-manage hsm --help
barbican-manage --version shows the version number of barbican service.

The following sections describe the available categories and arguments for barbican-manage.

Barbican Database

Warning

Before executing barbican-manage db commands, make sure you are familiar with Database Migration first.

barbican-manage db revision [--db-url] [--message] [--autogenerate]

Create a new database version file.

barbican-manage db upgrade [--db-url] [--version]

Upgrade to a future version database.

barbican-manage db history [--db-url] [--verbose]

Show database changeset history.

barbican-manage db current [--db-url] [--verbose]

Show current revision of database.

barbican-manage db clean [--db-url] [--verbose] [--min-days] [--clean-unassociated-projects] [--soft-delete-expired-secrets] [--log-file]

Clean up soft deletions in the database. More documentation can be found here: Database Cleaning <database_cleaning>

Barbican PKCS11/HSM

barbican-manage hsm gen_mkek [--library-path] [--passphrase] [--slot-id] [--label] [--length]

Create a new Master key encryption key in HSM. This MKEK will be used to encrypt all project key encryption keys. Its label must be unique.

barbican-manage hsm gen_hmac [--library-path] [--passphrase] [--slot-id] [--label] [--length]

Create a new Master HMAC key in HSM. This HMAC key will be used to generate an authentication tag of encrypted project key encryption keys. Its label must be unique.

barbican-manage hsm rewrap_pkek [--dry-run]

Rewrap project key encryption keys after rotating to new MKEK and/or HMAC key(s) in HSM. The new MKEK and HMAC key should have already been generated using the above commands. The user will have to configure new MKEK and HMAC key labels in /etc/barbican.conf and restart barbican server before executing this command.

2.9 KiB Raw Blame History