IBM Seed value used during the instance creation is lost : Recovery procedure - United States seed lost; idsgendirksf; Encryption Seed Value; key stash file TECHNOTE (TROUBLESHOOTING)

THIS DOCUMENT APPLIES ONLY TO THE FOLLOWING LANGUAGE VERSION(S):
 English 

PROBLEM(ABSTRACT)
 Generating key stash file if the seed value which was used at the time of instance creation has been lost then there is no way to recover this seed value. 

RESOLVING THE PROBLEM
 

There is NO way to recover the seed value used during the instance creation if it has been lost. The only workaround is to create a new instance with a new encryption seed value and then use the db2ldif and ldif2db utilities to export and import data respectively. These utilities can be supplied with the new encryption seed and the salt value of the new instance. Thus the data would be preserved(alongwith the passwords) on this new instance.

Here are the steps to follow:

1. Set up a new instance says "newinst".

$> idsicrt -I newinst -e thisismyencryptionseed -l (/home/newinst) -n

$> idscfgdb -I newinst -w ldap -a newinst -t newinst -l (/home/newinst) -n

$> idscfgsuf -s "o=ibm,c=us" -I newinst -n

$> idsdnpw -u cn=root -p root -I newinst -n

2. Note the encryption seed - "thisismyencryptionseed". Let us call this new_encryptionseed

3. Once this new instance is setup note down the salt value generated by the new server instance by searching for "cn=crypto,cn=localhost".

$> ldapsearch -D <administrator DN> -w <administrator password> -b "cn=crypto,cn=localhost" -s base objectclass=* ibm-slapdCryptoSalt

Let us call this value: new_saltvalue

4. Lets assume that the instance name with the forgotten encryption seed is "oldinst"

5. Use the db2ldif utility on the instance with the forgotten encryptionseed, oldinst with the following options -

$> db2ldif -o outputfile -I oldinst -k new_encryptionseed -t new_saltvalue

6. Once this step is successfully completed the entire data from "oldinst" would be dumped in outputfile.

7. Use the utilities like ldif2db to re-load all the data into the new server instance.







HISTORICAL NUMBER
What happens if I lost my seed and salt value? In ISDS, what happens if I lost my seed and salt value?



This dW Answers question is about an IBM document with the Title:
Open Mic Webcast: Configuring SDS 8.0.1 Virtual Appliance with a remote DB2 database - Tuesday, 17 Jan 2017 [presentation slides are attached; includes link to replay]
There is NO way to recover the seed value used during the instance creation if it has been lost. The only workaround is to create a new instance with a new encryption seed value and then use the db2ldif and ldif2db utilities to export and import data respectively. These utilities can be supplied with the new encryption seed and the salt value of the new instance. Thus the data would be preserved(alongwith the passwords) on this new instance.