Auto-Load Configuration of CodeSafe 5 Applications via the nShield 5c

Edit the nShield 5c config.new file’s [codesafe] section on the RFS to have the following contents (replace seemachine.cs5 with the actual filename - this will be pulled from the RFS volume for custom-seemachines so just the filename and not the path must be used here):

The seejobs_transport=plain option may be used to allow plaintext communication internally inside the appliance, between the 5c (Connect) hardserver and the CodeSafe 5 application running on the HSM inside the appliance. This improves SEEJobs latency and throughput and may be appropriate if plaintext internal communication is acceptable for your security model. Remote communication for SEEJobs is secured via nCipher Secure Transport/Impath regardless of this setting, so communication is always secured on the external network.

If SEEJobs are not being used, the seejobs_port option can be set to 0. The worldid_pubname option may still be specified, but may not be relevant unless the SEE World ID is needed for ticketing objects. Non-SEEJobs TCP protocols that are allowed in the CodeSafe 5 application’s firewall rules will be exposed on the 5c’s external network interface in this case.

If the CodeSafe 5 image is encrypted, add the encryption_key field and set it to the ident of the seeconf key that protects the image. The key must be module-protected, and must be present in the Security World used by the appliance. For an unencrypted image, omit this field or leave it blank.

For information about creating encrypted images and their seeconf keys, see Encrypt a CodeSafe 5 image.

For more information on the [codesafe] section, see CodeSafe 5 configuration section.

Permit the nShield 5c to have a configuration file pushed from a remote machine. By default, the configuration file can be pushed from the RFS machine, provided it is authenticated.

To allow another remote machine to push configuration, use the 5c’s Client config push menu from its front panel UI (menu 1-1-6-2).

Configure the nShield 5c to append its logs (hardserver and system logs) to the RFS once per minute in order to get timely feedback on CodeSafe 5 configuration operations. Alternatively, you can configure a remote UDP syslog server to receive streamed logs, or you can obtain the most recent logs that have not yet been pushed to the RFS on demand from a privileged client by using the following commands (replace -m1 with the module number of the 5c):

Push the configuration to the nShield 5c using the cfg-pushnethsm utility.

On Linux:

On Windows:

Because the configuration is set with pull_rfs=yes, pushing it makes the nShield 5c to automatically fetch the CodeSafe 5 image, Developer ID certificates, and the encryption key (if configured) from the RFS into the appliance’s storage within a few seconds. If any of these files change on the RFS, push the configuration again with pull_rfs=yes to re-fetch them. This will not immediately apply the configuration to the HSM itself or stop any currently running CodeSafe 5 application, but will allow the new configuration to be applied on the next reboot or clear of the module, at which point the new CodeSafe 5 application will be loaded and started automatically.