Install and configure the Entrust nShield HSM

Install the nShield Security World Software

  1. Copy the Security World software to your EC2 instance.

  2. Install the Security World software as described in the nShield Security World Software v13.9.5 Installation Guide.

  3. Add the Security World utilities path to the system path by creating the /etc/profile.d/nfast.sh file.
    This path is typically /opt/nfast/bin.

    $ cat /etc/profile.d/nfast.sh
# Entrust nShield HSM
export PATH=$PATH:/opt/nfast/bin

  4. Add ec2-user to the nfast group:

    $ sudo gpasswd -a ec2-user nfast
Adding user ec2-user to group nfast

  5. Run the enquiry utility to confirm the Security World is operational:

    $ /opt/nfast/bin/enquiry
Server:
 enquiry reply flags  none
 enquiry reply level  Six
 serial number        7852-268D-3BF9 5F08-02E0-D947
 mode                 operational
 version              13.9.5
...

Install the Entrust nShield HSM

Skip this section if you are using nSaaS.

Install the nShield HSM. You can do this locally, remotely, or remotely via the serial console. Condensed instructions are available in Entrust TrustedCare Portal:

For more detailed instructions, see the nShield v13.9.5 Hardware Install and Setup Guides.

Configure the AWS security group and your corporate firewall

  1. Add inbound and outbound Custom TCP security group rules to allow communication with the HSM on port 9004.

    When using multiple remote HSMs, it is possible to configure all HSMs behind a single public IP address, with each HSM listening on a unique port.

    For example:

    ip block diagram

  2. If you are using your own nShield HSM, configure a corresponding firewall exception on your corporate firewall as described in the previous step.

  3. If you use Remote Administration, repeat the previous steps for port 9005, which is required by the Entrust nShield Trusted Verification Device (TVD). Ensure you include the system hosting the TVD in the corresponding firewall and security group rules.

Enroll the Entrust nShield HSM

  1. Inform the HSM of the client’s location.

    In this integration, the client is the AWS EC2 instance. For instructions, see Configuring the nShield HSM to use the client.

    If the deployment is configured for high availability (HA), repeat the client configuration steps for each HSM.

  2. Enroll the AWS EC2 instance as a client of the HSM.

    For instructions, see Configuring client computers to use the nShield HSM.

    If the deployment is configured for high availability (HA), repeat the client configuration steps for each HSM.

  3. Run the enquiry utility to confirm that the HSM is operational:

    $ /opt/nfast/bin/enquiry
Server:
 enquiry reply flags  none
 enquiry reply level  Six
 serial number        7852-268D-3BF9 5F08-02E0-D947
 mode                 operational
 version              13.9.5
 ...
Module #1:
 enquiry reply flags  UnprivOnly
 enquiry reply level  Six
 serial number        7852-268D-3BF9
 mode                 operational
 version              13.8.4
 ...
 module type          nShield 5c
 ...
Module #2:
 enquiry reply flags  UnprivOnly
 enquiry reply level  Six
 serial number        5F08-02E0-D947
 mode                 operational
 version              13.8.3
 ...
 module type          nShield Connect XC
 ...

Create a security world

  1. Create a Security World if one does not already exist, or import an existing Security World.

    Follow your organization’s security policies and procedures when creating a Security World. For more information, see the Entrust documentation Create a new Security World.

    ACS cards cannot be duplicated after the Security World has been created. Consider creating additional ACS cards during setup to protect against card loss, damage, or failure.

  2. Confirm the Security World is Usable with nfkminfo:

    $ /opt/nfast/bin/nfkminfo
World
 generation  2
 state       0x37270008 Initialised Usable ...
 ...
Module #1
 generation 2
 state      0x2 Usable
 ...
Module #2
 generation 2
 state      0x2 Usable
 ...

  3. Based on your configuration, create the /opt/nfast/cknfastrc file containing the nShield PKCS #11 library environment variables.

    For example:

    # Enable Module protection
CKNFAST_FAKE_ACCELERATOR_LOGIN=1

# PKCS #11 log level and file location
CKNFAST_DEBUG=3
CKNFAST_DEBUGFILE=/opt/nfast/log/pkcs11.log

  4. Change ownership of the /opt/nfast/cknfastrc file to nfast:

    $ ls -al /opt/nfast/cknfastrc
-rw-rw-rw-. 1 root root 324 Apr  3 16:12 /opt/nfast/cknfastrc

$ sudo chown nfast:nfast /opt/nfast/cknfastrc

$ ls -al /opt/nfast/cknfastrc
-rw-rw-rw-. 1 nfast nfast 324 Apr  3 16:12 /opt/nfast/cknfastrc

  5. Make the /opt/nfast/log/pkcs11.log file writable:

    $ sudo touch /opt/nfast/log/pkcs11.log

$ sudo chmod 664 /opt/nfast/log/pkcs11.log

  6. Restart the nShield service:

    $ sudo /opt/nfast/sbin/init.d-ncipher restart
...