nShield Connect v12.80 User Guide (Linux)

Introduction

Read this guide if …​

Read this guide if you need to configure or manage:

  • An Entrust nShield Connect (Linux platforms only) Hardware Security Module (HSM).

  • An associated Security World. nShield hardware security modules use the Security World paradigm to provide a secure environment for all your HSM and key management operations.

The Connect is connected to a network by an Ethernet connection. Each HSM is configured to communicate with one or more client computers on the network. You can also configure clients to make use of any other network-connected HSMs on the network, as well as locally connected HSMs.

All nShield HSMs support standard cryptography frameworks and integrate with many standards based products.

This guide assumes that:

  • You are familiar with the basic concepts of cryptography and Public Key Infrastructure (PKI)

  • You have read the Installation Guide.

  • You have installed your Connect.

Throughout this guide, the term Installation Guide refers to the particular Installation Guide for your product.

Terminology

The Connect is referred to as the Connect, the hardware security module, or the HSM.

Model numbers

Model numbering conventions are used to distinguish different nShield hardware security devices.

Model number Used for

NH2047

Connect 6000

NH2040

Connect 1500

NH2033

Connect 500

NH2068

Connect 6000+

NH2061

Connect 1500+

NH2054

Connect 500+

NH2075-B

Connect XC Base

NH2075-M

Connect XC Medium

NH2075-H

Connect XC High

NH2082

Connect XC SCAP

NH2089-B

Connect XC Base - Serial Console

NH2089-M

Connect XC Mid - Serial Console

NH2089-H

Connect XC High - Serial Console

NH3003-B

Connect CLX Base - Serial Console

NH3003-M

Connect CLX Mid - Serial Console

NH3003-H

Connect CLX High - Serial Console

Security World Software

The Security World for nShield is a collection of programs and utilities, including the hardserver, supplied by Entrust to install and maintain your nShield security system.

Entrust provides the firmware that runs on the nShield Connect, and software to run on each client computer. The Connect is supplied with the latest version of the HSM firmware installed. For more information about:

Software architecture

The software, firmware and utilities have version numbers and there is also a version number for the World which refers to the World data that is stored in encrypted form on the client computer, typically in the directory /opt/nfast/kmdata/local/world or RFS. This data includes information concerning the World itself and also concerning each key that was created within that World. The World version created is determined by the version numbers of the software and firmware used when it was first created, see Creating and managing a Security World.

The latest World version is version 3. You can query the version of the World loaded on your system by using the command kmfile-dump.

Hardserver

The hardserver software controls communication between the internal security module and applications on the network.

Separate instances of the hardserver run on the unit and each client that is configured to work with the unit. There is a secure channel, known as the impath, between the two software instances, which forms a single secure entity for transferring data between the unit and the clients. See also Compatibility issues.

The unit’s hardserver is configured using the front panel on the unit, or by means of uploaded configuration data. Configuration data is stored on the unit and in files in a specially configured file system on each client computer. For more information about using:

Remote file system (RFS)

Each unit uses a remote file system (RFS). You can configure the RFS on any computer, but it is normally located on the first client that is configured. The RFS contains:

  • The master configuration information for the unit

  • The Security World files

  • The key data.

Do not copy the master configuration to file systems on other clients. You can copy Security World files and key data to other clients to allow you to manage the unit from more than one client. To make it available to the unit, copy to the RFS the data for Security Worlds, cards or keys that you create on a client that does not contain the RFS.

Security World Software

The Security World Software is a collection of programs and utilities that you install on the client and use to maintain the nShield security system. The Security World Software includes the following:

  • The appropriate installer for the client platform

  • The client hardserver

  • A set of utilities for configuring the Connect

  • A set of utilities and the KeySafe application for performing key management tasks on nShield HSMs.

The Connect is referenced and used by a utility or application in the same way as a local (PCI-connected) nShield HSM.

Default directories

The default locations for Security World Software and program data directories on English-language systems are summarized in the following table:

Directory name Default path

nShield Installation

/opt/nfast/

Key Management Data

/opt/nfast/kmdata/

Dynamic Feature Certificates

/opt/nfast/femcerts/

Static Feature Certificates

/opt/nfast/kmdata/hsm-ESN/features

Log Files

/opt/nfast/log

User Log Files

/home/<user>/nshieldlogs
Dynamic feature certificates must be stored in the directory stated above. The directory shown for static feature certificates is an example location. You can store those certificates in any directory and provide the appropriate path when using the Feature Enable Tool. However, you must not store static feature certificates in the dynamic features certificates directory.

The instructions in this guide refer to the locations of the software installation and program data directories by their names (for example, Key Management Data) or absolute paths (for example, /opt/nfast/kmdata).

If the software has been installed into a non-default location, you must create a symbolic link from /opt/nfast/ to the directory where the software is actually installed. For more information about creating symbolic links, see your operating system’s documentation.

Utility help options

Unless noted, all the executable utilities provided in the bin subdirectory of your nShield installation have the following standard help options:

  • -h|--help displays help for the utility

  • -v|--version displays the version number of the utility

  • -u|--usage displays a brief usage summary for the utility.

Further information

This guide forms one part of the information and support provided by Entrust.

If you have installed the Java Developer component, the Java Generic Stub classes, nCipherKM JCA/JCE provider classes, and Java Key Management classes are supplied with HTML documentation in standard Javadoc format, which is installed in the appropriate nfast/java directory when you install these classes.

Release notes containing the latest information about your product are available in the release directory of your installation media.

We strongly recommend familiarizing yourself with the information provided in the release notes before using any hardware and software related to your product.

Security advisories

If Entrust becomes aware of a security issue affecting nShield HSMs, Entrust will publish a security advisory to customers. The security advisory will describe the issue and provide recommended actions. In some circumstances the advisory may recommend you upgrade the nShield firmware and or nShield Connect image file. In this situation you will need to re-present a quorum of administrator smart cards to the HSM to reload a Security World. As such, deployment and maintenance of your HSMs should consider the procedures and actions required to upgrade devices in the field.

The Remote Administration feature supports remote firmware upgrade of nShield Solo, nShield Solo XC, nShield Connect and remote ACS card presentation.

We recommend that you monitor the Announcements & Security Notices section on Entrust nShield Support, https://nshieldsupport.entrust.com, where any announcement of nShield Security Advisories will be made.

Recycling and disposal information

For recycling and disposal guidance, see the nShield product’s Warnings and Cautions documentation.