Oracle^® SuperCluster M8 and SuperCluster M7 Security Guide

Enable Encrypted Swap Space

Encrypt swap space, whether it is a ZFS volume or raw device. Encryption ensures that any sensitive data, such as user passwords, are protected if the system needs to swap those pages out to disk.

1. Log in to one of the compute servers and access the host console as superuser.

   See Log into a Compute Server.

2. Edit the /etc/vfstab file and set swap to encrypted.

   # pfedit /etc/vfstab
   ...
   /dev/zvol/dsk/rpool/swap - - swap - no encrypted
   

3. Create and initialize a PKCS #11 keystore.

   # pktool setpin keystore=pkcs11
   Enter token passphrase: ********
   Create new passphrase: ************
   Re-enter new passphrase: ************
   

4. Generate a symmetric key and store it in a PKCS #11 keystore.

   # pktool genkey keystore=pkcs11 keytype=aes keylen=256 label=globalzone-key