appliance-cli

Enables certain appliance administration or status commands. All operations require a privileged client (by default, that means an elevated command-prompt on Windows or membership of the nfast group on Linux). Operations run against a remote module additionally require that the module has been enrolled as privileged in the local hardserver.

appliance-cli supports remote administration of nShield Connect and nShield 5c devices, in addition to enabling certain administration or status commands to be made available to privileged clients running in guest VMs that have access to nShield SoloXC or nShield 5s local HSMs running on the host machine over nCipher Secure Transport/Impath.

Available commands will depend on your version and HSM type. cs5 is nShield 5c specific, for more information, see Configure the nShield 5c for client authorization.
Appliance command Action

expirehsmlog

Expire signed nShield 5 HSM syslogs

exporthsmlog

Get signed nShield 5 HSM syslogs

gethsmlog

Get nShield 5 HSM syslogs

getsavedhsmlogs

Get signed nShield 5 HSM syslogs saved on the 5c file system

removesavedhsmlogs

Remove signed nShield 5 HSM syslogs saved on the 5c file system

gethsmenvstats

Get nShield 5 HSM general statistics

gethsmstatus

Get nShield 5 HSM status and versions

gethsminfo

Get nShield 5 HSM info

gethsmoption

Get nShield 5 HSM option

sethsmoption

Set nShield 5 HSM option

gethsmcs5stats

Get nShield 5 HSM CodeSafe 5 statistics

sethsmminvsn

Set the minimum VSN for nShield 5 HSM

cs5

Configure CodeSafe5 for nShield 5

gethsmlogkey

Get nShield 5 HSM syslog signing key

getservcfg

Get server config file

getservlog

Get server logs

getrtc

Get the RTC time for nShield 5

setrtc

Set the HSM RTC. Only available for nShield 5c version 13.3 or later. See for more information.

serialctrl

Enable or disable the Connect/5c’s serial CLI

Module selection

-m, --module=MODULE

Specifies the number ID to use.
If you only have one module, MODULE is 1.
If you do not specify a module ID, appliance-cli uses all modules by default.

Help options

-h, --help

Displays help for appliance-cli.

-u, --usage

Displays a brief usage summary for appliance-cli.

-v, --version

Displays the version number of the Security World Software that deploys appliance-cli.

setrtc

You can only change the RTC forward, to a time later than the one currently set. You cannot change it to an earlier time. This is to ensure the validity of certificates associated with the SSH keys used for attestation.

If you need to change the current time to an earlier time, for example if a mistake was made when the initial time was set, you will need to factory state the HSM.