Changing the Properties for a Specific VM

When you add a VM to a Cloud VM Set, the VM inherits the settings for most of its property settings from the global defaults specified for the associated Cloud VM Set. (The only exception is the Description, which is set when you register the VM with KeyControl.) You can override the global defaults for individual VMs as required. For details about setting the global defaults, see Creating a Cloud VM Set.

Log into the KeyControl webGUI using an account with Cloud Admin privileges.
In the top menu bar, click Cloud.
Select the VM whose properties you want to set and click the Expand button (>) at the end of the row.

On the Details tab, specify the options you want to use.

Option	Description
Description	A user-defined string identifying this VM.
Certificate Valid Until	The date on which the certificate for this VM will expire. To have KeyControl automatically renew the certificate, set the Certificate Auto Renewal Period option, described below.
Heartbeat	The length of time between the heartbeats each VM in the set sends to KeyControl to verify that the connection between them is functioning normally. You can specify seconds, minutes, hours, or days. The default is 5 minutes. This value should be set to a minimum of 10 seconds. If changes have been made to the VMs through the KeyControl webGUI, those changes are communicated to the VMs during the heartbeat. That means if the heartbeat is set to 5 minutes, then it can take up to 5 minutes for any changes made in the KeyControl webGUI to be applied to the VMs in the set. If a VM cannot reach KeyControl during the heartbeat, the VM continues to run but any changes made in KeyControl are not picked up by the VM until the next successful heartbeat. KeyControl sets the status of the VM to Unreachable, but it takes no further action unless the heartbeat continues to fail after the Grace Period has expired.
Grace Period	The length of time that can pass without a successful heartbeat. The default is 1 day. You can specify the grace period in seconds, minutes, hours, or days. If a VM remains unresponsive past the grace period, access to the data on the VM will be unavailable until the VM is re-authenticated with KeyControl.
OS	The operating system running on the VM.
HyTrust Policy Agent Version	The version of the HyTrust DataControl Policy Agent running on the VM.
Rekey Interval	If you specify any value other than 0 (zero) for this option, KeyControl periodically creates a rekey task for every encrypted disk in the VM. You can select any number of days, weeks, months, or years and KeyControl will automatically rekey the encrypted disks on that schedule. To disable Auto Rekey, enter 0 in this field. By default, Auto Rekey is disabled. Note: For Linux VMs, Auto Rekey only works if the online encryption driver has been configured and is active on the Linux VM.
Certificate Auto Renewal Period	If you want KeyControl to automatically renew the certificate for a VM in this Cloud VM Set, enter an integer greater than zero in this field. KeyControl will renew the certificate that many days before the old one expires. For example, if you enter a value of 5 in this field and a VM certificate is set to expire on June 12, 2019, KeyControl will renew the license on June 7, 2019. The default is 10 days. To change the renewal period, click the existing value and enter a new value in the text field, then select days/weeks/months/years from the drop-down list. When you are finished, click Save. If you want to disable certificate auto-renewal, enter 0 (zero) in this field.
Mapping	The KeyControl Mapping associated with this VM, if any. For details, see Creating a KeyControl Mapping.
Single Encryption Key State	Whether the Single Encryption Key (SEK) option is enabled or disabled for the Cloud VM Set with which this VM is registered. For details, see Data Deduplication with Cloud VM Sets.
Auto Encryption	If this option is enabled, whenever KeyControl detects a new Windows drive or Linux device has been added to this VM, KeyControl immediately checks the Auto Encryption Policy. If the new drive or device is covered by the policy, KeyControl automatically tells the Policy Agent to encrypt that drive or device. To enable this option, click Disabled, select Enabled from the drop-down list, then click Save. When you do so, the webGUI displays the Encryption Policy fields: Auto Encryption Policy Type. This can be: Exclude—The Windows drives and Linux devices listed in the Auto Encryption Policy Path(s) field will not be automatically encrypted, although they can be encrypted manually at any time. This is the default. Include—The Windows drives and Linux devices listed in the Auto Encryption Policy Path(s) field will be automatically encrypted. All other drives or devices on the the VM must be encrypted manually. Encrypt All Devices—All Windows drives and Linux devices will be automatically encrypted. Auto Encryption Policy Path(s)—If the policy type is Include or Exclude, enter a path that should be included or excluded. To add additional paths, click the + (Plus sign) in this field. You can enter either a Windows drive a Linux device name. For example, any of the following would be valid path names: `C:`, `C:\data`, or `sdb1`. Important: Each path must be on its own line. For more information, see Automatic Data Encryption.
Decryption Allowed	If this option is set to Yes, the drives and devices in this VM can be decrypted. If it is set to No, any decryption request will fail.
Policy Agent Uninstallation Allowed	If this option is set to Yes, the Policy Agent can be uninstalled on this VM. If it is set to No, the Policy Agent cannot be uninstalled.

On the Reauthentication Settings tab, you can change any of the following options by clicking the entry in the field, setting the new value, and then clicking Save. You must click Save after each change or your changes will be lost when you select a different field.

Option	Description
Reauthentication on IP Change	Whether the VM must be re-authenticated when the VM's IP address changes. The default is No. If your system configuration uses DHCP or multiple NICs, do not set this option to Yes. If you do so, the VM may go into a reboot loop if the boot partition is encrypted and any encrypted drives may be detached.
Reauthentication on H/W Signature Change	Whether the VM must be re-authenticated if its MAC address or UUID changes. The options are: Yes — If either the MAC address or the UUID changes, the VM requires reauthentication. This is the default. We recommend that you do not change this option. Permissive — Both the MAC address and the UUID must change before the VM requires reauthentication. No — KeyControl does not require reauthentication if VM's MAC address or UUID changes. We strongly recommend that you do not select this option. If you do, a cloned or misconfigured VM could gain access to the keys associated with the original VM. If you do select this option, you must confirm the selection before you can proceed. If KeyControl detects multiple VMs with the same MAC address and UUID combination when hardware validation is off, KeyControl generates an alert every 8 hours until the cloned VMs stop heartbeating or hardware authentication is set to Yes or Permissive. In addition, KeyControl generates an alert when client operations, such as key access or device registration, occur on the cloned VMs. Note: If this VM is a Master vSphere VDI VM, this option should always be Yes. If it is set to No, KeyControl may not be able to tell the Master VM from its clones. For details, see Combining VMware vSphere VDI with DataControl.
Reauthentication on Reboot	Whether the VM must be re-authenticated every time it reboots. The default is No. Setting this value to Yes is similar to requiring a boot-time password before the VM can come up completely.

Option

Description

Reauthentication on IP Change

Whether the VM must be re-authenticated when the VM's IP address changes. The default is No.

If your system configuration uses DHCP or multiple NICs, do not set this option to Yes. If you do so, the VM may go into a reboot loop if the boot partition is encrypted and any encrypted drives may be detached.

Reauthentication on H/W Signature Change

Whether the VM must be re-authenticated if its MAC address or UUID changes.

The options are:

Yes — If either the MAC address or the UUID changes, the VM requires reauthentication. This is the default. We recommend that you do not change this option.
Permissive — Both the MAC address and the UUID must change before the VM requires reauthentication.
No — KeyControl does not require reauthentication if VM's MAC address or UUID changes. We strongly recommend that you do not select this option. If you do, a cloned or misconfigured VM could gain access to the keys associated with the original VM.

If you do select this option, you must confirm the selection before you can proceed. If KeyControl detects multiple VMs with the same MAC address and UUID combination when hardware validation is off, KeyControl generates an alert every 8 hours until the cloned VMs stop heartbeating or hardware authentication is set to Yes or Permissive. In addition, KeyControl generates an alert when client operations, such as key access or device registration, occur on the cloned VMs.

Note: If this VM is a Master vSphere VDI VM, this option should always be Yes. If it is set to No, KeyControl may not be able to tell the Master VM from its clones. For details, see Combining VMware vSphere VDI with DataControl.

Reauthentication on Reboot

Whether the VM must be re-authenticated every time it reboots. The default is No.

Setting this value to Yes is similar to requiring a boot-time password before the VM can come up completely.