Auto-Load Configuration of CodeSafe 5 Applications via the nShield 5c

Edit the nShield 5c config.new file’s [codesafe] section on the RFS to have the following contents (replace seemachine.cs5 with the actual filename - this will be pulled from the RFS volume for custom-seemachines so just the filename and not the path must be used here):

The seejobs_transport=plain option may be used to allow plaintext communication internally inside the appliance, between the 5c (Connect) hardserver and the CodeSafe 5 application running on the HSM inside the appliance. This improves SEEJobs latency and throughput and may be appropriate if plaintext internal communication is acceptable for your security model. Remote communication for SEEJobs is secured via nCipher Secure Transport/Impath regardless of this setting, so communication is always secured on the external network.

If SEEJobs are not being used, the seejobs_port option can be set to 0. The worldid_pubname option may still be specified, but may not be relevant unless the SEE World ID is needed for ticketing objects. Non-SEEJobs TCP protocols that are allowed in the CodeSafe 5 application’s firewall rules will be exposed on the 5c’s external network interface in this case.

For more information on the [codesafe] section, see CodeSafe 5 configuration section.

Permit the nShield 5c to have a configuration file pushed from a remote machine. By default, the configuration file can be pushed from the RFS machine, provided it is authenticated.

To allow another remote machine to push configuration, use the 5c’s Client config push menu from its front panel UI (menu 1-1-6-2).

Configure the nShield 5c to append its logs (hardserver and system logs) to the RFS once per minute in order to get timely feedback on CodeSafe 5 configuration operations. Alternatively, you can configure a remote UDP syslog server to receive streamed logs, or you can obtain the most recent logs that have not yet been pushed to the RFS on demand from a privileged client by using the following commands (replace -m1 with the module number of the 5c):

Push the configuration to the nShield 5c using the cfg-pushnethsm utility.

On Linux:

On Windows:

The CodeSafe application is automatically transferred from the RFS to the nShield 5c appliance storage within a few seconds. This will not immediately apply the configuration to the HSM itself or stop any currently running CodeSafe 5 application, but will allow the new configuration to be applied on the next reboot or clear of the module, at which point the new CodeSafe 5 application will be loaded and started automatically.