Monday, August 17, 2015

Safenet Hardware Security Module configuration for the first time.

Safenet HSM comes with a lot of documentation .. which is good .. the sad part is  I found it a little too verbose.
if you want to read it all here is the link
http://cloudhsm-safenet-docs-5.3.s3-website-us-east-1.amazonaws.com/007-011136-006_lunasa_5-3_webhelp_rev-c/startpage.htm

If you juts got the hardware and want to know how to configure it quickly here are the steps
  1. connect to the serail console 
  2. login with default appliance credentials if you are logging in for the first time (admin , PASSWORD)
  3. Change Password:as soon as you do that you will be asked to change the password ( atleast 3 characters from the these categories letters, numbers, special characters)
  4. using h or ? you can get a list of commands
  5. You can change/recover passwords (Note is this "appliance admin password" write it down carefully)
  6. Sett time zone Next check date, time, zone :-
    lunash:>status date
    lunash:>status time
    lunash:>status zone
  7. if its incorrect set it up correctly using :-
    lunash:>sysconf timezone set America/Chicago
    *** note above 7 steps will be done the first time HSM is powered on****
  8. configure network (hostname, domain, interfaces)
    lunash:> network hostname yourhostname 
    lunash:> network domain yourdomain
    lunash:>net interface  -device eth0 -ip 1.1.1.1  -netmask 255.255.255.255 -gateway   1.2.2.3.
  9. verify network  configuration (Note: make sure links are up..else go check on the eth port connections, ping ips to verify )
    lunash:>net show
    net-show

      [yourHSM] lunash:>net show                        


       Hostname:          "yourhostname"
       Domain:            "yourdomain"

       IP Address (eth0): 1.1.1.1
       HW Address (eth0): 00:00:00
       Mask (eth0):       255.255.255.255
       Gateway (eth0):    1.2.2.3

       Name Servers:      10.0.80.11        10.0.80.12    
       Search Domain(s):  softlayer.local 

    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    1.1.1.1        0.0.0.0         255.255.255.255          U     0      0        0 eth0
    1.0.0.0        1.2.2.3          255.0.0.0                  UG    0      0        0 eth0

    Link status
      eth0: Configured   
            Link detected: yes

      eth1: Not configured
  10. Generate certificate: Certificate can be generated following ways (use the ip if you do not have DNS configured)
    lunash:>sysconf regenCert
    lunash:>sysconf regenCert 11.1.1.1
  11. lunash:>ntls bind eth0



Now if you want you can go further and start playing with it.

  1. Initialize HSM :
    lunash:>hsm init -label myhsm -domain thisiscliningdomain -password *** -force
  2. Create Partition:
    lunash:>hsm login
    lunash:>partition create -partition myPartition1
     

No comments:

Post a Comment