vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The password is case-sensitive. To recover the data, you must provide the encryption password that was entered when the files were backed up. You can also enter a password hint. When you want to restore data, you can view the password hint to remind you of the encryption password for this job.

If you forget the encryption password, you lose access to the data. You cannot retrieve the password from the system.







 Downloading the user guide 

Connect to the IBM Cloud® network with [IBM Cloud® VPN](https://www.ibm.com/cloud/vpn-access) so that you can download the user guides from the [Downloadable IBM Cloud Backup for Classic Documentation](http://downloads.service.softlayer.com/evault/Documentation/).
authenticationAlgorithm - The authentication algorithm. One of: disabled, sha256, sha384, sha512.

pfs - Perfect Forward Secrecy. One of: disabled, group_14, group_15, group_16, group_17, group_18, group_19, group_20, group_21, group_22, group_23, group_24, group_31.

encryptionAlgorithm - The encryption algorithm. One of: aes128, aes128gcm16, aes192, aes192gcm16, aes256, aes256gcm16.

The AuthenticationAlgorithm must be disabled if and only if EncryptionAlgorithm is aes128gcm16, aes192gcm16, or aes256gcm16.

authenticationAlgorithm := "sha256"
encryptionAlgorithm := "aes128"
pfs := "group_14"
3. Perform an update to replace the IPsec policy with secure ciphers in your SDK.

options := &vpcv1.UpdateIpsecPolicyOptions {
ID: &ipsecPolicyID,
AuthenticationAlgorithm: &authenticationAlgorithm,
EncryptionAlgorithm: &encryptionAlgorithm,
Pfs: &pfs,
}
ipsecPolicy, response, err := vpcService.UpdateIpsecPolicy(options)



For more information on SDK Go or other languages, see the [VPC SDK reference](https://cloud.ibm.com/apidocs/vpc/latest?code=goupdate-ipsec-policy).





 Upgrading a VPN from a custom IKE policy with Terraform 

To upgrade the IKE policy by using Terraform, following these steps:



1. Run the terraform show command to find and get the name of the IKE policy that contains weak ciphers to be used in your Terraform.

terraform show
2.
The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--locks ([SecretLockPrototype]](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-lock-prototype-example-schema))
: The locks data to be attached to a secret version. Required.

The maximum length is 1000 items. The minimum length is 0 items.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --locks=@path/to/file.json.

--mode (string)
: Set the lock mode. Allowable values: remove_previous, and remove_previous_and_delete. Use remove_previous to create a lock that clears existing locks with matching names. Use remove_previous_and_delete to also delete data from the previous version.

Allowable values are: remove_previous, remove_previous_and_delete.





 Example 

ibmcloud secrets-manager secret-version-locks-bulk-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --id=eb4cf24d-9cae-424b-945e-159788a5f535 --locks='[{"name": "lock-example-1", "description": "lock for consumer 1", "attributes": {"anyKey": "anyValue"}}]' --mode=remove_previous





 Example output 

Example of response body to create secret locks

{
The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--locks ([SecretLockPrototype]](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-lock-prototype-example-schema))
: The locks data to be attached to a secret version. Required.

The maximum length is 1000 items. The minimum length is 0 items.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --locks=@path/to/file.json.

--mode (string)
: Set the lock mode. Allowable values: remove_previous, and remove_previous_and_delete. Use remove_previous to create a lock that clears existing locks with matching names. Use remove_previous_and_delete to also delete data from the previous version.

Allowable values are: remove_previous, remove_previous_and_delete.





 Example 

ibmcloud secrets-manager secret-version-locks-bulk-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --id=eb4cf24d-9cae-424b-945e-159788a5f535 --locks='[{"name": "lock-example-1", "description": "lock for consumer 1", "attributes": {"anyKey": "anyValue"}}]' --mode=remove_previous





 Example output 

Example of response body to create secret locks

{
Authentication Password A password for the user - might be shown as $PASSWORD 
 Authentication Method How authentication takes place; "direct" authentication is handled by the driver. 
 Hosts 0... A hostname and port to connect to 
 Composed 0... A URI combining Scheme, Authentication, Host, and Path 
 Certificate Name The allocated name for the self-signed certificate for database deployment 
 Certificate Base64 A base64 encoded version of the certificate. 





* 0... indicates that there might be one or more of these entries in an array.







 Connecting with a Driver 

etcd drivers are often able to make a connection to your deployment when given the URI-formatted connection string found in the "composed" field of the connection information. For example,

https://ibm_cloud_59699685_b95e_4afe_9d39_7464c228563c:$PASSWORD@ca537b4d-dcf2-467f-bd98-97535f11445b.8f7bfd8f3faa4218aec56e069eb46187.databases.appdomain.cloud:32218

The table covers a few of the etcd drivers in various languages.



Table 2. Common etcd drivers

 Language Driver Documentation 

 Node etcd3 [Link](https://microsoft.github.io/etcd3/classes/etcd3.html) 
 Java jetcd [Link](https://github.com/etcd-io/jetcd) 
 Java etcd-java [Link](https://github.com/IBM/etcd-java) 
 Go etcd/client [Link](https://github.com/etcd-io/etcd/tree/master/client) 
 Python python-etcd [Link](https://python-etcd.readthedocs.io/en/latest/) 







 Connecting without a Driver 

For languages that do not have gRPC support etcd v3 provides a JSON gRPC gateway that converts HTTP/JSON requests into gRPC messages.
The authenticated keystore password must be identical to the Normal user's tokenspaceIDPassword.
tokenspaceIDPassword: Authenticated keystore password; must be 6-8 characters in length.

logging:
 Set the logging level.
 The supported levels, in an increasing order of verboseness: 'panic', 'fatal', 'error', 'warning'/'warn', 'info', 'debug', 'trace'. The Default value is 'warning'.
loglevel: "<logging_level>"
logpath: "<log_file_path>" The full path of your logging file.

Show more

If authenticated keystores are used, the sessionauth configuration option must be enabled for both keystores and the text passwords that are 6-8 characters in length must be identical for both keystores in the tokenspaceIDPassword field.

Replace the variables in the example according to the following table:



Table 1. Describes the variables needed to create the PKCS #11 configuration file

 Variable Description 

 EP11_endpoint_URL The Hyper Protect Crypto Services Enterprise PKCS #11 (EP11) API endpoint. You can get it through Overview > Connect > EP11 endpoint URL in the IBM Cloud console, or you can dynamically [retrieve the endpoint URL](https://cloud.ibm.com/apidocs/hs-cryptogetinstance) with the API. Depending on whether you are using a public or [private network](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connection), use the public or private EP11 endpoint URL. 
 EP11_endpoint_port_number The port number of the EP11 API endpoint. It is located after the colon in the endpoint URL. 
 enable_mtls Valid values are true or false to indicate whether you want to enable mutual TLS to add a second layer of authentication for PKCS #11 API access for Hyper Protect Crypto Services Standard Plan. By default, set it false as EP11 requires server-only authentication.
* Security group name
* Hostname
* Profile
* Image
* Minimal recommended disk sizes
* SAP HANA main password - This password must be 8 - 14 characters, upper and lowercase letters, a number, and a special character.
* SAP main password - This password must be 10 - 14 characters, upper and lowercase letters, a number, and a special character that is not an exclamation point.
* Click Save changes.



For a more detailed description of each of the parameters, check the GitHub repo [JAVA readme](https://github.com/IBM-Cloud/sap-netweaver-java-hana/blob/main/schematics/README.md) or [ABAP readme](https://github.com/IBM-Cloud/sap-netweaver-abap-hana/blob/main/schematics/README.md) file, chapter “Input parameter file”. Also, make sure to mark the parameters that contain sensitive information like passwords, API, and ssh private keys as "sensitive". These parameters are marked as “sensitive” in the readme file, under “Input parameter file”.
7. On the workspace Settings page, click Generate plan. Wait for the plan to complete.
8. Click View log to review the log files of your Terraform execution plan.
9. Apply your Terraform template by clicking Apply plan.
10. Review the log file to ensure that no errors occurred during the provisioning, modification, or deletion process.







 Deploying SAP NetWeaver 7.x and SAP HANA by using Terraform 

Use these steps to configure the IBM Cloud Provider plug-in and use Terraform to create VPC resources for SAP. The scripts can take 2 hours to complete.



1. Log in to the Bastion Deployment Server by using ssh.
2. Clone the terraform and ansible folders and README files.
workload: hyper-protect-basic.js7TGt77EQ5bgTIKk5C0pViFTRHqWtn..............

The prefix hyper-protect-basic is mandatory.







 Creating encrypted env section of a contract 

Complete the following steps on an Ubuntu system, to encrypt the env section used in a contract:



1. Create the [env section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_env) of the contract and add the contents in the env.yaml file.
2. Export the complete path of the env.yaml file and ibm-hyper-protect-container-runtime-1-0-s390x-11-encrypt.crt:

ENV="<PATH to env.yaml>"
CONTRACT_KEY="<PATH to ibm-hyper-protect-container-runtime-1-0-s390x-11-encrypt.crt>"
3. Use the following command to create a random password:

PASSWORD="$(openssl rand 32 | base64 -w0)"
4. Use the following command to encrypt password with ibm-hyper-protect-container-runtime-1-0-s390x-11-encrypt.crt:

ENCRYPTED_PASSWORD="$(echo -n "$PASSWORD" | base64 -d | openssl rsautl -encrypt -inkey $CONTRACT_KEY -certin | base64 -w0)"
5. Use the following command to encrypt env.yaml with a random password:

ENCRYPTED_ENV="$(echo -n "$PASSWORD" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -pass stdin -in "$ENV" | base64 -w0)"
6.
Allowable values are: username_password, iam_credentials, public_cert, private_cert.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--metadata ([CollectionMetadata](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli-v1cli-collection-metadata-example-schema-v1))
: The metadata that describes the resource array. Required.

--resources ([SecretPolicyRotation]](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli-v1cli-secret-policy-rotation-example-schema-v1))
: A collection of resources. Required.

--policy (string)
: The type of policy that is associated with the specified secret.

Allowable values are: rotation.





 Examples 

ibmcloud secrets-manager policy-update --secret-type=username_password --id=exampleString --metadata='{"collection_type": "application/vnd.ibm.secrets-manager.config+json", "collection_total": 1}' --resources='[{"type": "application/vnd.ibm.secrets-manager.secret.policy+json", "rotation": {"interval": 1, "unit": "day"}}]' --policy=rotation







 ibmcloud secrets-manager policy 

List the rotation policies that are associated with a specified secret.

ibmcloud secrets-manager policy --secret-type SECRET-TYPE --id ID [--policy POLICY]



 Command options 

--secret-type (string)
: The secret type.
The list items must match regular expression /^([0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}|default)$/.





 Examples 

ibmcloud secrets-manager all-secrets --limit=1 --offset=0 --search=exampleString --sort-by=id --groups=exampleString







 ibmcloud secrets-manager secret 

Get a secret and its details by specifying the ID of the secret.

A successful request returns the secret data that is associated with your secret, along with other metadata. To view only the details of a specified secret without retrieving its value, use the Get secret metadata method.

ibmcloud secrets-manager secret --secret-type SECRET-TYPE --id ID



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Examples 

ibmcloud secrets-manager secret --secret-type=arbitrary --id=exampleString







 ibmcloud secrets-manager secret-update 

Invoke an action on a specified secret. This method supports the following actions:



* rotate: Replace the value of a secret.
* restore: Restore a previous version of an iam_credentials secret.
* revoke: Revoke a private certificate.
* delete_credentials: Delete the API key that is associated with an iam_credentials secret.
* validate_dns_challenge: Validate challenges for a public certificate that is ordered with a manual DNS provider.
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--name ([]string)
: Specify the names of the secret locks to be deleted.

The list items must match regular expression /^[a-zA-Z]{1}[a-zA-Z0-9-_.]{1,63}$/. The maximum length is 1000 items. The minimum length is 1 item.





 Example 

ibmcloud secrets-manager secret-locks-bulk-delete --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --name=lock-example-1





 Example output 

Example of response body to create secret locks

{
"secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
"secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
"versions" : [ {
"version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"version_alias" : "current",
"locks" : "lock-3", "lock-4" ],
"payload_available" : true
}, {
"version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
"version_alias" : "previous",
"locks" : "lock-example-1", "lock-example-2" ],
"payload_available" : true
} ]
}







 ibmcloud secrets-manager secret-version-locks
The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--locks ([SecretLockPrototype]](https://cloud.ibm.com/docs/cli?topic=cli-secrets-manager-clicli-secret-lock-prototype-example-schema))
: The locks data to be attached to a secret version. Required.

The maximum length is 1000 items. The minimum length is 0 items.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --locks=@path/to/file.json.

--mode (string)
: Set the lock mode. Allowable values: remove_previous, and remove_previous_and_delete. Use remove_previous to create a lock that clears existing locks with matching names. Use remove_previous_and_delete to also delete data from the previous version.

Allowable values are: remove_previous, remove_previous_and_delete.





 Example 

ibmcloud secrets-manager secret-version-locks-bulk-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --id=eb4cf24d-9cae-424b-945e-159788a5f535 --locks='[{"name": "lock-example-1", "description": "lock for consumer 1", "attributes": {"anyKey": "anyValue"}}]' --mode=remove_previous





 Example output 

Example of response body to create secret locks

{
"secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.

Note: To find the version ID of a secret, use the Get secret metadata method and check the response details. Required.

The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|previous)$/.

--locks ([LockSecretBodyLocksItem]](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli-v1cli-lock-secret-body-locks-item-example-schema-v1))
: The lock data to be attached to a secret version.

--mode (string)
: An optional lock mode. At lock creation, you can set one of the following modes to clear any matching locks on a secret version. Note: When you are locking the previous version, the mode parameter is ignored.



* exclusive: Removes any other locks with matching names if they are found in the previous version of the secret.
* exclusive_delete: Same as exclusive, but also permanently deletes the data of the previous secret version if it doesn't have any locks.

Allowable values are: exclusive, exclusive_delete.







 Examples
ibmcloud cdb user-password example-deployment admin <newpassword>





 Setting the admin password via the API 

The Foundation Endpoint that is shown on the Overview panel of your service provides the base URL to access this deployment through the API. Use it with the /deployments/{id}/users/{username} endpoint to set the admin password.

curl -X PATCH 'https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users/admin' -H "Authorization: Bearer $APIKEY" -H "Content-Type: application/json" -d '{"password":"newradminpasswordsupersecure21"}'

For more information, see the [API Reference](https://cloud.ibm.com/apidocs/cloud-databases-apiset-database-level-user-s-password).
For more information about the lockout policy, see [Policy configurations](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_compl_infovc_compl_info-default-policy-config).





 Password policy 



Table 2. Password policy

 Parameter Value 

 Maximum lifetime Password must be changed every 90 days 
 Restrict reuse Users cannot reuse any previous five passwords 
 Maximum length 20 characters 
 Minimum length 15 characters 
 Character requirements <br><br> * At least two alphabetic characters<br> * At least one special character<br> * At least one uppercase character<br> * At least one lowercase character<br> * At least one numeric character<br> * Identical adjacent characters - 3<br><br><br> 



As the customer, you have full access to tailor these settings as needed to apply your enterprise security policies. For changing these policies, see [Managing vCenter single sign-on policies](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-43527B09-63BB-44A6-91D3-E3A470904698.html).







 vSphere ESXi hosts 

Each vSphere ESXi host has its own root account and password. To identify this password, complete the following steps:



1. From the IBM Cloud for VMware Solutions console, click Resources > vCenter Server from the left navigation pane.
2. Locate and click the instance.
3. Click the Infrastructure tab and click the required cluster.



The vSphere ESXi hosts also join AD so that each system administrator can log in with their own account.





 Related links 



* [Common services design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-design_commonservice)
Connecting to a strongSwan peer 

You can use IBM Cloud VPN for VPC to securely connect your VPC to an on-premises network through a VPN tunnel. This topic provides guidance about how to configure your strongSwan VPN gateway to connect to VPN for VPC.

These instructions are based on Linux strongSwan U5.3.5/K4.4.0-133-generic.

Read [VPN gateway limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-limitations) before continuing to connect to your on-premises peer.

Go to the /etc directory and create a new custom tunnel configuration file with a name such as ipsec.abc.conf. Edit the /etc/ipsec.conf file to include the new ipsec.abc.conf file by adding the following line:

include /etc/ipsec.abc.conf

When the strongSwan VPN receives a connection request from VPN for VPC, strongSwan uses IPsec Phase 1 parameters to establish a secure connection and authenticate the VPN for VPC gateway. Then, if the security policy permits the connection, the strongSwan VPN establishes the tunnel by using IPsec Phase 2 parameters and applies the IPsec security policy. Key management, authentication, and security services are negotiated dynamically through the IKE protocol.

To support these functions, the following general configuration steps must be performed on the strongSwan VPN:



* Define the Phase 1 parameters that the strongSwan requires to authenticate VPN for VPC and establish a secure connection.
* Define the Phase 2 parameters that the strongSwan requires to create a VPN tunnel with VPN for VPC.





 Connecting an IBM policy-based VPN to a strongSwan peer 

Use the following configuration:



1. Choose IKEv2 in authentication.
2. Enable DH-group 2 in the Phase 1 proposal.
3. Set lifetime = 36000 in the Phase 1 proposal.
4. Disable PFS in the Phase 2 proposal.
5. Set lifetime = 10800 in the Phase 2 proposal.
6.
ibmcloud cdb user-password example-deployment admin <newpassword>





 Setting the Databases for EnterpriseDB admin password through the API 

The Foundation Endpoint that is shown on the Overview pane of your service provides the base URL to access this deployment through the API. Use it with the /deployments/{id}/users/{username} endpoint to set the admin password.

curl -X PATCH https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users/admin' -H "Authorization: Bearer $APIKEY" -H "Content-Type: application/json" -d '{"password":"newrootpasswordsupersecure21"}'

For more information, see the [API Reference](https://cloud.ibm.com/apidocs/cloud-databases-apiset-database-level-user-s-password).
ibmcloud secrets-manager secret-lock --secret-type SECRET-TYPE --id ID [--locks LOCKS] [--mode MODE]



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--locks ([LockSecretBodyLocksItem]](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli-v1cli-lock-secret-body-locks-item-example-schema-v1))
: The lock data to be attached to a secret version.

--mode (string)
: An optional lock mode. At lock creation, you can set one of the following modes to clear any matching locks on a secret version. Note: When you are locking the previous version, the mode parameter is ignored.



* exclusive: Removes any other locks with matching names if they are found in the previous version of the secret.
* exclusive_delete: Same as exclusive, but also permanently deletes the data of the previous secret version if it doesn't have any locks.

Allowable values are: exclusive, exclusive_delete.







 Examples 

ibmcloud secrets-manager secret-lock --secret-type=arbitrary --id=exampleString --locks='[{"name": "lock-1", "description": "lock for consumer-1", "attributes": {"anyKey": "anyValue"}}]' --mode=exclusive







 ibmcloud secrets-manager secret-unlock