NAME

hcs3 - Encrypted files on Amazon S3 using HyTrust DataControl

SYNOPSIS

hcs3 OPTIONS

DESCRIPTION

The hcs3 command manages encrypted files on Amazon S3 using HyTrust DataControl.

OPTIONS

The options are as follows:

status

Display information about stores, buckets, and properties.

setstore aws_access_key_id aws_secret_access_key

Cache the AWS access key and secret key in a local configuration file. The policy agent keeps the credentials in an encrypted configuration file.

To clear the previously set values, run setstore with empty strings, like

hcs3 setstore "" ""

Alternatively, you can use environment variables to pass AWS credentials to hcs3 commands. The following variables are required -

AWS_ACCESS_KEY_ID - AWS access key. AWS_SECRET_ACCESS_KEY - AWS secret key.

Access and secret key variables override credentials stored in credential and config files.

useraccess <-d | -e no_of_days>

By default, the hcs3 command can only be used by the root user or Administrator (Windows).

Enable access for non-root (non-Administrator) users. You can enable access for a specific number of days (-e). If you specify zero days, access is enabled forever until you revoke it with the "-d" option.

The root user can disable the non-root access using the -d option.

create bucketname

This command creates an AWS S3 bucket. It also creates a default key to encrypt files uploaded to this bucket. 

delete bucketname

This command removes the specified S3 bucket. It also removes the default encryption key for this bucket. 

set property=value

Only one property is supported at present. You can set "tmp" to the full path of any directory the user can access. This directory temporarily holds files as they are encrypted or decrypted in transit.

To clear the previously set property, run set with empty strings, like

hcs3 set tmp=

list bucketname

This command displays all the buckets accessible with the current AWS credentials. If you specify a bucket name, it displays the list of files in that bucket.

add -k keyid -s bucketname filename

Add a file "filename" to an AWS S3 bucket. The file is encrypted with the bucket's default key. "filename" can be a relative or absolute pathname. The filename specified here is used as the file identifier in the AWS bucket.

If -k keyid is specified, this key encrypts the file instead of the default key.

If -s is specified, the command shows upload statistics as it copies the file to AWS.

rm bucketname filename

This command removes the specified file from the bucket identified by "bucketname".

get -s bucketname filename ofilename

This command retrieves the specified file from the AWS bucket. The decrypted file is copied to the location specified by "filename"

If "filename" is specified, then the decrypted file is copied to this path.

If -s is specified, then the command shows download statistics as the file is copied from AWS.

version

Display the version of the DataControl agent software.

-h | -?

This command displays all the options available through the hcs3 command.

FILES

The default location of the HyTrust DataControl configuration files.

The HyTrust DataControl log file; hcs3 logs errors here. If errors are detected, you will be requested to provide this file to HyTrust support staff.

The HyTrust DataControl hcs3 log file. When hcs3 runs as a non-root user, it logs errors here. If errors are detected, you will be requested to provide this file to HyTrust support staff. This file is created in the HOME directory of the user.

BUGS

See the HyTrust Release Notes for information about bugs and caveats in the software.

AUTHOR

HyTrust Inc.

SEE ALSO

hcl(1)