LunaCM Command Reference Guide
User Manual:
Open the PDF directly: View PDF 
.
Page Count: 252
| Download | |
| Open PDF In Browser | View PDF |
SafeNet Network HSM 6.2.2 LunaCM Command Reference Guide Document Information Product Version 6.2.2 Document Part Number 007-011136-012 Release Date 01 December 2016 Revision History Revision Date Reason A 01 December 2016 Initial release. Trademarks, Copyrights, and Third-Party Software Copyright 2001-2016 Gemalto. All rights reserved. Gemalto and the Gemalto logo are trademarks and service marks of Gemalto and/or its subsidiaries and are registered in certain countries. All other trademarks and service marks, whether registered or not in specific countries, are the property of their respective owners. Acknowledgements This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org) This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com). This product includes software developed by the University of California, Berkeley and its contributors. This product uses Brian Gladman’s AES implementation. Refer to the End User License Agreement for more information. Disclaimer All information herein is either public information or is the property of and owned solely by Gemalto and/or its subsidiaries who shall have and keep the sole right to file patent applications or any other kind of intellectual property protection in connection with such information. Nothing herein shall be construed as implying or granting to you any rights, by license, grant or otherwise, under any intellectual and/or industrial property rights of or concerning any of Gemalto’s information. This document can be used for informational, non-commercial, internal, and personal use only provided that: • The copyright notice, the confidentiality and proprietary legend and this full warning notice appear in all copies. • This document shall not be posted on any publicly accessible network computer or broadcast in any media, and no modification of any part of this document shall be made. Use for any other purpose is expressly prohibited and may result in severe civil and criminal liabilities. The information contained in this document is provided “AS IS” without any warranty of any kind. Unless otherwise expressly agreed in writing, Gemalto makes no warranty as to the value or accuracy of information contained herein. SafeNet Network HSM LunaCM Command Reference Guide Rellease 6.2.2 007-011136-012 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 2 The document could include technical inaccuracies or typographical errors. Changes are periodically added to the information herein. Furthermore, Gemalto reserves the right to make any change or improvement in the specifications data, information, and the like described herein, at any time. Gemalto hereby disclaims all warranties and conditions with regard to the information contained herein, including all implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Gemalto be liable, whether in contract, tort or otherwise, for any indirect, special or consequential damages or any damages whatsoever including but not limited to damages resulting from loss of use, data, profits, revenues, or customers, arising out of or in connection with the use or performance of information contained in this document. Gemalto does not and shall not warrant that this product will be resistant to all possible attacks and shall not incur, and disclaims, any liability in this respect. Even if each product is compliant with current security standards in force on the date of their design, security mechanisms' resistance necessarily evolves according to the state of the art in security and notably under the emergence of new attacks. Under no circumstances, shall Gemalto be held liable for any third party actions and in particular in case of any successful attack against systems or equipment incorporating Gemalto products. Gemalto disclaims any liability with respect to security for direct, indirect, incidental or consequential damages that result from any use of its products. It is further stressed that independent testing and verification by the person using the product is particularly encouraged, especially in any application in which defective, incorrect or insecure functioning could result in damage to persons or property, denial of service, or loss of privacy. Acknowledgements This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org) This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com). This product includes software developed by the University of California, Berkeley and its contributors. This product uses Brian Gladman’s AES implementation. Refer to the End User License Agreement for more information. Regulatory Compliance This product complies with the following regulatory regulations. To ensure compliancy, ensure that you install the products as specified in the installation instructions and use only SafeNet-supplied or approved accessories. USA, FCC This device complies with Part 15 of the FCC rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) This device must accept any interference received, including interference that may cause undesired operation. This equipment has been tested and found to comply with the limits for a “Class B” digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: • Reorient or relocate the receiving antenna SafeNet Network HSM LunaCM Command Reference Guide Rellease 6.2.2 007-011136-012 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 3 • Increase the separation between the equipment and receiver • Connect the equipment into an outlet on a circuit different from that to which the receiver is connected • Consult the dealer or an experienced radio/TV technician for help • Changes or modifications not expressly approved by SafeNet could void the user’s authority to operate the equipment. Canada This class B digital apparatus meets all requirements of the Canadian interference- causing equipment regulations. Europe This product is in conformity with the protection requirements of EC Council Directive 2004/108/EC. Conformity is declared to the following applicable standards for electro-magnetic compatibility immunity and susceptibility; CISPR22 and IEC801. This product satisfies the CLASS B limits of EN 55022. SafeNet Network HSM LunaCM Command Reference Guide Rellease 6.2.2 007-011136-012 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 4 CONTENTS PREFACE About the LunaCM Command Reference Guide Customer Release Notes Gemalto Rebranding Audience Document Conventions Notes Cautions Warnings Command Syntax and Typeface Conventions Support Contacts 1 Using LunaCM Accessing LunaCM LunaCM Features Case Insensitivity Quotation Marks Operation 2 LunaCM commands appid appid close appid info appid open appid set audit audit changepw audit config audit export audit import audit init audit login audit logmsg audit logout audit status audit time audit verify clientconfig clientconfig deleteServer clientconfig deploy clientconfig listservers clientconfig restart clientconfig verify file display SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 007-011136-012Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 10 10 10 11 11 11 11 12 12 12 14 14 15 15 16 16 17 21 22 23 24 25 26 28 29 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 5 hagroup hagroup addmember hagroup addstandby hagroup creategroup hagroup deletegroup hagroup halog hagroup haonly hagroup listgroups Example for HA Group hagroup recover hagroup recoverymode hagroup removemember hagroup removestandby hagroup retry hagroup interval hagroup synchronize hsm hsm changehsmpolicy hsm changepw hsm changesopolicy hsm clear hsm clone hsm contents hsm factoryreset hsm init hsm login hsm logout hsm migratepedkey hsm monitor hsm recoveryinit hsm recoverylogin hsm reset hsm restart hsm restoreuser hsm restoresim2 hsm rollbackfw hsm setlagacydomain hsm showinfo hsm showmechanism Example of Information about One Mechanism hsm showpolicies hsm smkclone hsm updatecap hsm updatefw partition partition activate Partition Policy settings needed partition archive partition archive backup SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 47 49 50 51 52 53 54 55 55 57 58 59 60 61 62 63 64 67 68 69 70 71 72 73 74 77 79 80 81 83 84 85 86 87 88 89 91 92 94 95 96 101 102 103 104 110 110 112 114 6 Example Backup an Object to an SFF eToken Example: Backup All Objects to an SFF eToken partition archive contents Example: Objects found partition archive delete Example: Delete all Objects from an SFF eToken Example: Attempt to Delete Objects from an Empty SFF eToken partition archive list partition archive restore Example: Restore One or All Objects from an SFF eToken Example: Restore All objects from an SFF eToken Example: Restore Objects from an SFF eToken, where some already exist on target partition changepolicy partition changepw partition clear partition clone partition contents partition create partition createchallenge partition createuser partition deactivate partition delete partition init partition login partition logout partition recoveryinit partition recoverylogin partition resetpw partition resize partition restoresim2 partition restoresim3 partition setlegacydomain partition showinfo partition showmechanism partition policyTemplateChange partition policyTemplatecreate partition policyTemplateDelete partition policyTemplateList partition policytemplateload partition policyTemplateSave partition policyTemplateShow partition showpolicies partition smkclone ped ped connect ped disconnect ped get ped set ped show SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 115 116 117 118 119 120 120 121 122 123 123 123 125 126 128 129 130 131 138 139 140 140 142 143 144 145 146 147 147 151 152 153 154 156 158 160 162 164 165 166 167 169 171 172 173 175 176 177 179 7 ped vector remotebackup start role role changepw role createChallenge role deactivate role init role list role login role logout role recoveryinit role recoverylogin role resetpw role setdomain role show slot slot configset slot configshow slot list slot partitionlist slot set srk srk disable srk enable srk generate srk recover srk show srk transport stc stc disable stc enable stc identitycreate stc identitydelete stc identityexport stc identityshow stc partitionderegister stc partitionregister stc status stc tokeninit stc tokenlist stcconfig stcconfig activationtimeoutset stcconfig activationtimeoutshow stcconfig cipherdisable stcconfig cipherenable stcconfig ciphershow stcconfig clientderegister stcconfig clientlist stcconfig clientregister SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 180 181 182 183 186 187 188 190 192 195 196 197 198 199 201 202 203 205 206 208 209 210 211 212 213 214 215 216 217 219 220 221 222 223 224 225 226 227 228 229 230 232 233 234 236 238 239 240 241 8 stcconfig hmacdisable stcconfig hmacenable stcconfig hmacshow stcconfig partitionidexport stcconfig partitionidshow stcconfig rekeythresholdset stcconfig rekeythresholdshow stcconfig replaywindowset stcconfig replaywindowshow SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 242 244 246 247 248 249 250 251 252 9 PREFACE About the LunaCM Command Reference Guide This document describes how to do something (insert a brief description). It contains the following chapters: • "Using LunaCM" on page 14 • "LunaCM commands" on page 17 This preface also includes the following information about this document: • "Customer Release Notes" below • "Gemalto Rebranding" below • "Audience" on the next page • "Document Conventions" on the next page • "Support Contacts" on page 12 For information regarding the document status and revision history, see "Document Information" on page 2 Customer Release Notes The customer release notes (CRN) provide important information about this release that is not included in the customer documentation. It is strongly recommended that you read the CRN to fully understand the capabilities, limitations, and known issues for this release. You can view or download the latest version of the CRN for this release at the following location: • http://www.securedbysafenet.com/releasenotes/luna/crn_luna_hsm_6-2-2.pdf Gemalto Rebranding In early 2015, Gemalto completed its acquisition of SafeNet, Inc. As part of the process of rationalizing the product portfolios between the two organizations, the Luna name has been removed from the SafeNet HSM product line, with the SafeNet name being retained. As a result, the product names for SafeNet HSMs have changed as follows: Old product name New product name Luna SA HSM SafeNet Network HSM Luna PCI-E HSM SafeNet PCIe HSM Luna G5 HSM SafeNet USB HSM Luna PED SafeNet PED SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 007-011136-012Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 10 PREFACE About the LunaCM Command Reference Guide Old product name New product name Luna Client SafeNet HSM Client Luna Dock SafeNet Dock Luna Backup HSM SafeNet Backup HSM Luna CSP SafeNet CSP Luna JSP SafeNet JSP Luna KSP SafeNet KSP Note: These branding changes apply to the documentation only. The SafeNet HSM software and utilities continue to use the old names. Audience This document is intended for personnel responsible for maintaining your organization's security infrastructure. This includes SafeNet HSM users and security officers, key manager administrators, and network administrators. All products manufactured and distributed by Gemalto are designed to be installed, operated, and maintained by personnel who have the knowledge, training, and qualifications required to safely perform the tasks assigned to them. The information, processes, and procedures contained in this document are intended for use by trained and qualified personnel only. It is assumed that the users of this document are proficient with security concepts. Document Conventions This document uses standard conventions for describing the user interface and for alerting you to important information. Notes Notes are used to alert you to important or helpful information. They use the following format: Note: Take note. Contains important or helpful information. Cautions Cautions are used to alert you to important information that may help prevent unexpected results or data loss. They use the following format: CAUTION: Exercise caution. Contains important information that may help prevent unexpected results or data loss. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 11 PREFACE About the LunaCM Command Reference Guide Warnings Warnings are used to alert you to the potential for catastrophic data loss or personal injury. They use the following format: WARNING! Be extremely careful and obey all safety and security measures. In this situation you might do something that could result in catastrophic data loss or personal injury. Command Syntax and Typeface Conventions Format Convention bold The bold attribute is used to indicate the following: • Command-line commands and options (Type dir /p.) • Button names (Click Save As.) • Check box and radio button names (Select the Print Duplex check box.) • Dialog box titles (On the Protect Document dialog box, click Yes.) • Field names (User Name: Enter the name of the user.) • Menu names (On the File menu, click Save.) (Click Menu > Go To > Folders.) • User input (In the Date box, type April 1.) italics In type, the italic attribute is used for emphasis or to indicate a related document. (See the Installation Guide for more information.)In command descriptions, angle brackets represent variables. You must substitute a value for command line arguments that are enclosed in angle brackets. [optional] [ ] Represent optional keywords or in a command line description. Optionally enter the keyword or that is enclosed in square brackets, if it is necessary or desirable to complete the task. {a|b|c} {|| } Represent required alternate keywords or in a command line description. You must choose one command line argument enclosed within the braces. Choices are separated by vertical (OR) bars. [a|b|c] [|| ] Represent optional alternate keywords or variables in a command line description. Choose one command line argument enclosed within the braces, if desired. Choices are separated by vertical (OR) bars. Support Contacts Contact method Address Contact Gemalto 4690 Millennium Drive Belcamp, Maryland 21017 USA SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 12 PREFACE Contact method Phone About the LunaCM Command Reference Guide Contact Global +1 410-931-7520 Australia 1800.020.183 China (86) 10 8851 9191 France 0825 341000 Germany 01803 7246269 India 000.800.100.4290 Netherlands 0800.022.2996 New Zealand 0800.440.359 Portugal 800.1302.029 Singapore 800.863.499 Spain 900.938.717 Sweden 020.791.028 Switzerland 0800.564.849 United Kingdom 0800.056.3158 United States (800) 545-6608 Web www.safenet-inc.com Support and Downloads www.safenet-inc.com/support Provides access to the Gemalto Knowledge Base and quick downloads for various products. Technical Support Customer Portal https://serviceportal.safenet-inc.com Existing customers with a Technical Support Customer Portal account can log in to manage incidents, get the latest software upgrades, and access the Gemalto Knowledge Base. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 13 1 Using LunaCM This chapter describes how to access and use the LunaCM utility. It contains the following topics: • "Accessing LunaCM" below • "LunaCM Features" on the next page Accessing LunaCM The LunaCM utility (lunacm) is the client-side administrative command interface for SafeNet HSMs. From a client/host computer, LunaCM can interact with, and perform operations on any, or all, of the following: • internally installed SafeNet PCIe HSM 6.x HSMs (K6 HSM card) • locally USB-connected SafeNet USB HSMs • remotely located SafeNet Network HSM application partitions, made available by a NTLS or STC network link between the distant HSM appliance and partition(s) and the local client computer. To access LunaCM 1. Open a Command Prompt or console window. 2. Go to the SafeNet HSM Client software directory and start the LunaCM utility: Windows C:\> cd c:\Program Files\SafeNet\LunaClient C:\Program Files\SafeNet\LunaClient\> lunacm Linux/AIX > cd /usr/safenet/lunaclient/bin > ./lunacm Solaris/HP-UX > cd /opt/safenet/lunaclient/bin > ./lunacm Some preliminary status information is displayed, followed by the lunacm:> command-line prompt. 3. You can now issue any lunacm utility command to manage your SafeNet HSM. For a summary, type "help" and press [Enter]. Note: For SafeNet PCIe HSM and SafeNet USB HSM, LunaCM is used to administer both the HSM as HSM SO, and the application partition, as HSM SO for HSMs with firmware older than 6.22.0, or as Partition SO for HSMs with firmware 6.22.0 and newer. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 007-011136-012Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 14 1 Using LunaCM Note: For SafeNet Network HSM, LunaCM is used to manage application partitions (assuming an NTLS or STC link between your SafeNet HSM Client computer and the SafeNet Network HSM appliance). LunaCM is not used to perform HSM-wide administration by the HSM SO on SafeNet Network HSM - for that you must log into a LunaSH (lunash) session via SSH. LunaCM depends on the availability of HSM partitions in order to be useful. If no application partition has been created, then only the local HSM SO (administrative) partition is available, against which to run commands. If the Chrystoki.conf / Crystoki.ini configuration file [Presentation] setting "ShowAdminTokens=" is set to no, then the HSM administrative partition/slot is also unavailable, and LunaCM is not usable. If you know you have a working SafeNet PCIe HSM or SafeNet USB HSM attached to your Client computer and LunaCM shows no usable commands, then verify in your Chrystoki.conf or Crystoki.ini file that "ShowAdminTokens" is not set to "no". LunaCM Features • Command history is supported, using up/down arrows, [Home], [End], [Page Up], [Page Down]. • Non-ambiguous command shortnames are supported. You must type the exact shortname that is listed in the syntax help, or else type the full command with no abbreviations. Additionally, for syntax help, the alias “?” is available. • Commands and options are case-insensitive. • Limited scripting is possible However, handling of return codes is not fully supported at this time. The utility is not a full-featured shell, so features like command-completion or parsing of partial commands are not supported. Case Insensitivity Commands and options entered by the user are not sensitive to case. If a user accidentally leaves the Caps-Lock key on, or by habit capitalizes some commands or options, they should not have to re-enter or edit the command line. Command parameters, however, are passed to command executables with the same case as entered on the command line. Command executables must deal with case issues as appropriate for the command. For example, you can type: lunacm:> partition login -password mYpa55word! or lunacm:> partition LOGIN -PASSWorD mYpa55word! and successfully login to your Partition. Note that the command and sub-commands can be any combination of uppercase and lowercase letters. The command parser interprets it correctly. However, the password string itself is passed on to the access-control handler, which is very particular about lettercase. Therefore, an item like a password must be typed letter-perfect with the appropriate case applied. Note: The above example is for Password Authenticated SafeNet HSMs. For Trusted Path Authenticated HSM, do not type the password - you are directed to the SafeNet PED, which prompts for the required PED Key. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 15 1 Using LunaCM Quotation Marks It might happen that a command parameter consists of two or more parts, separated by spaces. This can be misconstrued by the command parser as two (or more) additional parameters. To ensure that a multi-part parameter is parsed as a single entity, enclose it in quotation marks " ". Operation LunaCM's cache can become unsynchronized if you access an HSM in more than one application session and make administrative changes. For example, you might attempt a role login against a connected SafeNet Network HSM application partition, in a lunacm instance that had been open for a while, and you (or someone else) had just made a partition policy change in lunash, such as changing max bad login attempts from default 10 down to (say) 3. The policy change comes into effect immediately, though any other open sessions might be unaware of the change. A failed attempt in the open lunacm instance might state that you still had nine unsuccessful attempts remaining, when in fact you had only two, because the lunacm instance was not up-to-date with the change made via lunash. Relaunching lunacm, or using "clientconfig restart" updates the cache and fixes the mismatch. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 16 2 LunaCM commands This chapter describes the commands available in LunaCM. The commands are described in alphabetical order and provide: • a brief description of the command function • the command syntax and parameter descriptions • usage examples Lunacm opens with a slot list, showing brief descriptions of the HSM administrative or application partitions that are visible to the library, in the order that they are detected. Those include: • SafeNet Network HSM application partitions (if any), network-connected to the host computer via NTLS or STC channels, • SafeNet PCIe HSMs (if any) installed within the host computer, • SafeNet USB HSMs (if any) connected via USB to the host computer. By default, Lunacm shows the lowest-numbered slot first. Local HSMs (SafeNet PCIe HSM or SafeNet USB HSM) might have an HSM administrative slot (for the HSM SO) or an application partition slot, or both, so lunacm leaves gaps in the slot numbering to allow for the possible slots on a given HSM. Where did my command go? The question mark (or any incorrect command) shows the lunacm commands available to be used in the current slot. The availability of lunacm commands changes according to four possible scenarios: • the current slot is the HSM administrative partition for an HSM with firmware version 6.22.0 or newer • the current slot is an application partition that has its own SO (a PPSO partition), on an HSM with firmware version 6.22.0 or newer • the current slot is a separate-but-not-independent application partition that is administered by the HSM SO, and does not have its own separate SO (a legacy-style partition) on an HSM with firmware version 6.22.0 or newer • the current slot is the HSM administrative partition and application partition for an HSM with firmware older than version 6.22.0 (a true legacy partition). No single partition type has access to all the possible commands within lunacm. Note: Persistence of login state For HSMs with firmware 6.22.0 or newer, login state of a slot is preserved until explicitly ended (such as with "logout" or "deactivate" or closing the application). Therefore, login state persists when you switch slots in lunacm. That is, if you were logged into the partition in slot 1, then set current slot to slot 2, then came back to slot 1, the login state for the partition in slot 1 would still be in force, with no need to reinstate it. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 007-011136-012Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 17 2 LunaCM commands For HSMs with older firmware, changing to a different slot terminates the login state in the original slot, as was always the case. Lunacm command list on HSM admin partition, f/w 6.22.0 (These are the commands that you see if the current-slot partition is the initialized HSM's administrative partition, while the HSM is at firmware version 6.22.0 or newer. Some of these commands act on the current-slot partition; some have a -slot option to direct their action to another partition/slot.) Select a link to display the command syntax or to help you to navigate to the sub-command you need: appid audit file clientconfig hagroup hsm partition ped remoteBackup role slot srk stc stcconfig Parameter Shortcut Description appid a > Manage Application Ids. See "appid" on page 21 . audit au Audit commands. See "audit" on page 26 clientconfig ccfg Client configuration. See "clientconfig" on page 40 . file f File commands. See "file display" on page 46 . hagroup ha High Availability Group commands. See "hagroup" on page 47 . hsm hs HSM commands. See "hsm" on page 64 . partition par Partition commands. See "partition" on page 104 . ped p Remote PED commands. See "ped" on page 172 . remoteBackup rb Manage Remote Backup server. See "remotebackup start" on page 181 . role ro Role management commands. See "role" on page 182 . slot s Slot management commands. See "slot" on page 202 . srk r Secure Recovery commands. See "srk" on page 210 . SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 18 2 LunaCM commands Parameter Shortcut Description stc stc Secure Trusted Channel commands. See "stc" on page 217 . stcconfig stcc Secure Trusted Channel configuration commands. See "stcconfig" on page 230 . Lunacm command list on application partition, f/w 6.22.0 (These are the commands that you see if the current-slot partition is the initialized HSM's administrative partition, while the HSM is at firmware version 6.22.0 or newer. Some of these commands act on the current-slot partition; some have a -slot option to direct their action to another partition/slot.) Select a link to display the command syntax or to help you to navigate to the sub-command you need: appid file clientconfig hagroup partition ped remoteBackup role slot stc stcconfig Parameter Shortcut Description appid a > Manage Application Ids. See "appid" on page 1 . file f File commands. See "file display" on page 1 . clientconfig ccfg Client configuration. See "clientconfig" . hagroup ha High Availability Group commands. See "hagroup" on page 1 . partition par Partition commands. See "partition" on page 1. ped p Remote PED commands. See "ped" on page 1 . remoteBackup rb Manage Remote Backup server. See "remotebackup start" on page 1 . role ro Role management commands. See "role" . slot s Slot management commands. See "slot" on page 1 . stc stc Secure Trusted Channel commands. See "stc" on page 217 . SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 19 2 LunaCM commands Parameter Shortcut Description stcconfig stcc Secure Trusted Channel configuration commands. See "stcconfig" on page 230 . SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 20 2 LunaCM commands appid Access the appid-level commands to manage application IDs on the HSM. Syntax appid open close set info Parameter Shortcut Description open o Open a previously set access ID. See "appid open" on page 24 close c Close a previously set access ID. See "appid close" on the next page set s Set an access ID. See "appid set" on page 25 info i Display information for the access IDs. See "appid info" on page 23 Example lunacm:> help appid The following sub commands are available: Command Short Description -----------------------------------open o Open an Application Id for the User close c Close an Application Id for the User set s Set the Application Id info i Display current Application Id information Syntax: appid Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 21 2 LunaCM commands appid close Close an application access ID on the HSM to prevent your applications from using it to access the HSM. Application IDs are assigned as a way of sharing login state among multiple processes. AppIDs require two 4-byte/32-bit unsigned integers, one designated "major" and the other designated "minor". Note: If you are concerned that an unauthorized process might be able to take over a login state, then you can use large, difficult-to-guess numbers for the major and minor appids. If this is not a concern, or for use in a development lab, you can use any arbitrary, conveniently small integers. Syntax appid close -major -minor Parameter Shortcut Description -major -ma The major appid. -minor -mi The minor appid. Example lunacm:> appid close -major 1 -minor 40 Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 22 2 LunaCM commands appid info Display the currently set application IDs. This list includes all set application IDs, regardless of whether they are open or closed. Syntax appid info Example lunacm:>appid info Using user defined Application ID: Application ID Major: 307 Application ID Minor: 207 Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 23 2 LunaCM commands appid open Open an application access ID on the HSM to allow your applications to use it to access the HSM. Application IDs are assigned as a way of sharing login state among multiple processes. AppIDs require two 4-byte/32-bit unsigned integers, one designated "major" and the other designated "minor". Note: If you are concerned that an unauthorized process might be able to take over a login state, then you can use large, difficult-to-guess numbers for the major and minor appids. If this is not a concern, or for use in a development lab, you can use any arbitrary, conveniently small integers. Syntax appid open -major -minor Parameter Shortcut Description -major -ma The major appid. -minor -mi The minor appid. Example lunacm:> appid open -major 1 -minor 40 Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 24 2 LunaCM commands appid set Set an application access ID on the HSM. Application IDs are assigned as a way of sharing login state among multiple processes. AppIDs require two 4-byte/32-bit unsigned integers, one designated "major" and the other designated "minor". After setting an appid, you must open it using appid open to allow your applications to use it to access the HSM. Once you set an appid you can open and close it, as required, to allow or deny application access to the HSM using the appid. Note: If you are concerned that an unauthorized process might be able to take over a login state, then you can use large, difficult-to-guess numbers for the major and minor appids. If this is not a concern, or for use in a development lab, you can use any arbitrary, conveniently small integers. Syntax appid open -major -minor Parameter Shortcut Description -major -ma The major appid. -minor -mi The minor appid. Example lunacm:> appid set -major 1 -minor 40 Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 25 2 LunaCM commands audit Access the audit-level commands. Audit commands control HSM audit logging, and can be used only by the properly authenticated HSM Audit role, once that role has been initialized. The lunacm "hsm" commands available to the "audit" user are restricted to "hsm show", and all "hsm ped" commands, except "hsm ped vector" commands. The "audit" appliance user is allowed to connect and disconnect remote PED connections, adjust timeout, and view connection information, but is not allowed to create (init) or erase a remote PED vector. Note: The list on this page is all the "audit" commands that are available to you when the current slot is an HSM with firmware older than version 6.22.0. Where the HSM in the current slot has firmware version 6.22.0 or newer : - application partition slots do not show the audit commands at all (as those commands are applicable only to an HSM administrative slot) - HSM administrative slots with newer firmware show only some of the "audit" commands; the authentication-related functions are taken over by "role" commands instead. Syntax for firmware older than version 6.22.0 audit changepw config export import init login logmsg logout status time verify Parameter Shortcut Description changepw changepw Change the Audit user password or PED key. [Older firmware only] See "audit changepw" on page 28. config co Configure the audit parameters. See "audit config" on page 29. export e Read the wrapped log secret from the HSM. See "audit export" on page 31. import m Import the wrapped log secret to the HSM. See "audit import" on page 32. init i Initialize the HSM Audit user. [Older firmware only] See "audit init" on page 33. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 26 2 LunaCM commands Parameter Shortcut Description login logi Login to the HSM as the Audit user. [Older firmware only] See "audit login" on page 34. logmsg logm Write a message to the HSM's log. See "audit logmsg" on page 35. logout logo Logout from the HSM as the Audit user. [Older firmware only] See "audit logout" on page 36. status s Show the status of the logging subsystem. See "audit status" on page 37. time t Synchronize the HSM time to the host, or get the HSM time. See "audit time" on page 38. verify v Verify a block of log messages. See "audit verify" on page 39. Syntax for firmware version 6.22.0 or newer audit config export import logmsg status time verify Parameter Shortcut Description config co Configure the audit parameters. See "audit config" on page 29. export e Read the wrapped log secret from the HSM. See "audit export" on page 31. import m Import the wrapped log secret to the HSM. See "audit import" on page 32. logmsg logm Write a message to the HSM's log. See "audit logmsg" on page 35. status s Show the status of the logging subsystem. See "audit status" on page 37. time t Synchronize the HSM time to the host, or get the HSM time. See "audit time" on page 38. verify v Verify a block of log messages. See "audit verify" on page 39. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 27 2 LunaCM commands audit changepw Change the password or PED Key contents for the HSM Audit role. Both the old and the new PED Key are required for SafeNet HSM with PED Authentication. In the case of multiple HSMs in the host computer, the command works on the current slot. Note: This command applies to slots with HSMs having older firmware only. If the HSM in the current slot has firmware 6.22.0 or newer, then this command is replaced by "role changepw" on page 183. Syntax audit changepw Example lunacm:>audit changePw Please enter the old password: > ******* Please enter the new password: > ******** Please re-enter the new password: > ******** Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 28 2 LunaCM commands audit config Set the audit logging configuration parameters. This command allows you to configure the following: • which events are captured in the log. • the log rotation interval. Syntax audit config -parameter -value -serial Parameter Shortcut Description evmask e The value you want to configure for the specified parameter. Valid values for the event parameter Enter a comma-separated list of events to log. In addition to specifying an event category, you must also specify the conditions under which those events are to be logged - either 'f' for failures, or 's' for successes, or both. Any or all of the following may be specified: • [f]ailure: log command failures • [s]uccess: log command successes • [a]ccess: log access attempts (logins) • [m]anage: log HSM management (init/reset/etc) • [k]eymanage: key management events (key create/delete) • [u]sage: key usage (enc/dec/sig/ver) • fi[r]st: first key usage only (enc/dec/sig/ver) • e[x]ternal: log messages from CA_LogExternal • lo[g]manage: log events relating to log configuration • a[l]l: log everything (user will be warned) • [n]one: turn logging off Note: When specifying an event class to log, you must specify whether successful or failed events are to be logged. For example, to log all key management events you would use the command "audit config e t,s,f". get g get (show) the current configuration interval i Valid values for the rotation interval parameter Enter one of the following options for the log rotation interval: • hourly [@min] • daily [@hour:min] • weekly [@day:hour:min] • monthly [@date:hour:min] • never path p path on the HOST to which logs will be written size s size limit of a log, to trigger rotation Valid values for the size parameter SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 29 2 Parameter Shortcut LunaCM commands Description Enter one of the following options for the log rotation interval: • s : an integer string followed by 'k' for KB (default) or 'm' for MB (so 's 8192' or 's 8192k' or 's 8m' all specify rotation when log size reaches 8MB) • n: never rotate based on size Example audit config e s audit config e f audit config e u,f,s audit config n audit audit audit audit config config config config p i s s /usr/lunapci/log daily@12:05 4096 n audit all command successes audit all command failures audit all key usage requests, both success and failure log nothing set path rotate logs daily at 12:05 rotate logs when 4MB is exceeded never rotate based on size lunacm:> audit config e l,f,s You have chosen to log all successful key usage events. This can result in an extremely high volume of log messages, which will significantly degrade the overall performance of the HSM. Are you sure you wish to continue? Type 'proceed' to continue, or 'quit' to quit now -> proceed Command Result : No Error lunacm:> audit config get Current Logging Configuration ----------------------------event mask : Log everything rotation interval : daily@0:00 rotation size (KB): never rotate path to log : Command Result : No Error lunacm:> Note: In the above example of output from 'audit config get', the configuration rotates the logs daily; the "never rotate" merely says "do not rotate due to size". So, from that specified configuration, you get one log each day, regardless of how big it might become. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 30 2 LunaCM commands audit export Export the audit logging secret to the user local directory for import to another HSM. The audit Export command reads the log secret from the HSM, wrapped with the KCV which was used when the audit container was initialized. The blob of data is then stored in a file on the HOST. The audit officer then imports this wrapped secret into another HSM in the same domain, where it is unwrapped. This allows one HSM to verify logs that have been generated on another. Syntax audit export [[file [ ] [overwrite]] [list] Parameter Shortcut Description file f Enter this parameter followed by an optional filename for the file to receive wrapped log secret. If a file name is not specified, the file will be given a default name with the following structure: LogSecret_YYMMDDhhmmss_N.bin where YYMMDD = year/month/date hhmmss = hours/mins/secs N = HSM serial number This file will be written to the subdirectory which was set by a previous 'audit config p [path]' command. If this path does not exist, or the configuration was not set for any reason, an error will be returned. If name was specified, it is examined to see if it contains subdirectories. If it does, then the path is treated as a fully qualified path name. If not the file is stored in the default log path. overwrite o Overwrite the file if it already exists. list l List the files which reside in the log path. Example lunacm:>audit export file 2013-04-01nextlog.bin overwrite Now that you have exported your log secret, if you wish to verify your logs on another HSM see the 'audit import' command. SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 31 2 LunaCM commands audit import Import an audit log secret that was exported using the audit export command. The Import command reads a wrapped log secret from a file, and sends it to the HSM where it will be unwrapped using that HSM's KCV If the second HSM is in the same domain, it can then be used to verify logs that were generated on the first one. Syntax audit import [file ] [list] Parameter Shortcut Description file f Name of file containing the wrapped log secret. If a file name is not specified, the user will be given a list of files in the directory which was set by a previous 'audit config p [path]' If this path does not exist, or the configuration was not set for any reason, an error will be returned. If name was specified, it is examined to see if it contains subdirectories. If it does, then the path is treated as a fully qualified path name. If not the file is retrieved from the default log path. list l Display a list of the files which reside in the log path. Example lunacm:>audit import file 150718.lws Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 32 2 LunaCM commands audit init Initialize the Audit role on the HSM. This command attaches an audit domain and a role password for Passwordauthenticated HSMs, and creates a white Audit PED key for PED-authenticated HSMs. For PED-authenticated HSMs audit init also creates an audit domain, or receives an existing domain, so that selected HSMs are able to validate each others' HSM Audit Log files. Because this command destroys any existing Audit role on the HSM, you are asked to “proceed” unless the -force switch is provided at the command line. Note: This command is used for HSMs with firmware older than version 6.22.0. Expect an entry 'LUNA_CREATE_AUDIT_CONTAINER' in the audit log, when auditing is initialized. For HSMs with firmware 6.22.0 or newer, use "role init" on page 188, and specify the -name Auditor parameter. Syntax audit init [-auth] [-force] Parameter Shortcut Description -auth -a This option starts a login after the initialization completes. -force -f If this option is included in the list, the audit role initialization action is forced without prompting for confirmation. Example lunacm:>audit init The AUDIT role will be initialized. Are you sure you wish to continue? Type proceed to continue, or quit to quit now -> proceed Please enter the domain to use for initializing the Audit role: > myauditdomain Please enter the password: > ******* Please re-enter password to confirm: > ******* Command Result : No Error Note: For PED-authenticated HSMs, after you type "proceed" you are referred to the PED (which must be connected and 'Awaiting command...') which prompts you for domain (red PED Key) and Audit authentication (white PED Key). SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 33 2 LunaCM commands audit login Login to the HSM as the Audit role. Note: This command applies to slots with HSMs having older firmware only. If the HSM in the current slot has firmware 6.22.0 or newer, then this command is replaced by "role login" on page 192 . Syntax audit login [-serial ] [-password ] Parameter Shortcut Description -serial -s HSM Serial Number - identifies which HSM is to accept the login, if you have a multiple SafeNet PCIe HSM modules installed, or a Backup HSM or a SafeNet USB HSM locally connected to your host. -password -p The password of the HSM you are logging into. Used for Password-authenticated HSMs. If you prefer not to write the password, in the clear, on the command line, leave it out and you are prompted for it. Ignored for PED-authenticated HSMs. If the audit log area in the HSM becomes full, the HSM stops accepting most commands, and does not prompt for password when login is requested. In that case, provide the password with the command, and the login is accepted. Audit log full does not affect login for PED-auth HSMs. Example PED-authenticated HSM lunacm:>audit login Luna PED operation required to login as HSM Auditor - use Audit user (white) PED key. 'audit Command Result : No Error [myluna] lunacm:> Password-authenticated HSM [myluna]lunacm:>audit login Please enter the password: > ******** Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 34 2 LunaCM commands audit logmsg Logs a message to the audit log file. The message text must be enclosed in double quotes. If the quotation marks are not provided, the text is interpreted as arguments (to a command that takes no arguments) and is rejected with an error message. Syntax audit logmsg " " Example lunacm:>audit logmsg "Sample log message" Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 35 2 LunaCM commands audit logout Logout the the HSM Audit user. Note: This command applies to slots with HSMs having older firmware only. If the HSM in the current slot has firmware 6.22.0 or newer, then this command is replaced by "role logout" on page 195 . Syntax audit logout Example lunacm:>audit logout 'audit logout' successful. Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 36 2 LunaCM commands audit status Displays the Audit logging info for the indicated HSM. Syntax audit status [-serial ] Parameter Shortcut Description -serial -s Specifies the serial number of the HSM for which you want to display the HSM Audit configuration. This can be the appliance's onboard HSM, or a USB-connected SafeNet USB HSM or SafeNet Backup HSM. Example audit status HSM Logging Status: HSM found logging daemon Logging has been configured HSM is currently storing 0 log records. HSM Audit Role: logged in HSM Time : Mon Dec 17 17:50:35 2012 HOST Time : Mon Dec 17 17:51:07 2012 Current Logging Configuration ----------------------------event mask : Log everything rotation interval : daily Command Result : 0 (Success) SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 37 2 LunaCM commands audit time Synchronize the HSM time to the host time. Use this command to have the HSM adjust its time to match that of the host computer. This is especially useful when the host computer is synchronized by NTP, or by local drift correction. Among other benefits, this ensures that the log times of HSM events coincide with file creation and update events in the host file system. Syntax audit time [sync | get] Parameter Shortcut Description sync -s Synchronize the HSM time to the host time. get -g Display the current HSM time. Example lunacm:> audit time sync SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 38 2 LunaCM commands audit verify Verify the audit log records. This command displays details for the indicated file, or verifies records in the specified range from the named file. Note: If the log file is archived (tar or tgz) it must be untarred/unzipped before audit verify can work on records in that log. You cannot verify a ".tgz" file directly. The audit verify command is not able to verify a log that was in-progress when it was archived. Only logs from the ready_for_archive folder, logs that have been completed and closed, can be verified. This usually means that if you cannot verify the most recent log entry in an archive, then that same entry is probably the first log entry in the next archive, where it was properly closed and can be verified. Syntax audit verify [start ] [end ] file Parameter Shortcut Description start s The index of the first record in file to verify. If this parameter is omitted, the first record in file is assumed. end e The index of the last record in file to verify. If this parameter is omitted, the last record in file is assumed. file f The fully-qualified name of file containing data to verify. This is the only mandatory parameter. details d Show details for file. This includes the first and last timestamps, first and last record sequence numbers, and total number of records in the file. Example lunacm:>audit verify f test.log s 21 e 56 Verified messages 21 to 56 Command Result : No Error SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 39 2 LunaCM commands clientconfig Access the clientconfig-level commands to configure your client. Syntax clientconfig deleteserver deploy listservers restart verify Parameter Shortcut Description deleteserver d Delete SafeNet Network HSM appliance from the list ( "clientconfig deleteServer" on the next page ) deploy dp Create aNetwork Trust Link. ( "clientconfig deploy" on page 42 ) listservers ls List the SafeNet Network HSM appliances that are registered to the client. ( "clientconfig listservers" on page 43 ) restart rest Restart LunaCM. ( "clientconfig restart" on page 44 ) verify ls Verify the SafeNet Network HSM slots / partitions that are visible from the client. ( "clientconfig verify" on page 45 ) SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 40 2 LunaCM commands clientconfig deleteServer Delete an existing SafeNet Network HSM server from the trusted list. Syntax clientconfig deleteServer -server Example lunacm:> ccfg deleteServer -server mysa30 Server deleted mysa30 Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 41 2 LunaCM commands clientconfig deploy Delete an existing SafeNet Network HSM server from the trusted list. Syntax clientconfig deploy -server -client -partition [password ] [-user ] [-regen] [-force] [-verbose] Option Shortcut Parameter Description -server -n SafeNet Network HSM server hostname or IP address (mandatory). -client -c restart Client hostname or IP address (mandatory). -partition -par Partition name to assign to the client (mandatory). -password -pw Appliance admin role user's password. -user -ur Appliance admin role user's name, (default is admin). -regen -rg . Regenerate new and replace existing client's certificate. -force -f . Force the action, no prompts. -verbose -v . Show verbose logs. Example lunacm:> ccfg deploy -server mysa30 Server deleted mysa30 Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 42 2 LunaCM commands clientconfig listservers List the SafeNet Network HSM appliances that are registered to the client. Syntax clientconfig listservers Example lunacm:> clientconfig listservers Server ID 0 1 Server 124.54.98.2 124.54.98.6 Channel STC NTLS HTL Required no yes Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 43 2 LunaCM commands clientconfig restart Restart LunaCM. This command refreshes the LunaCM display to show any changes, such as new STC links. Syntax clientconfig restart Example lunacm:> ccfg rest You are about to restart this application. All current login sessions and remote PED connections will be terminated. Are you sure you wish to continue? Type 'proceed' to continue, or 'quit' to quit now ->proceed ... ... Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 44 2 LunaCM commands clientconfig verify Verify SafeNet Network HSM slots / partitions that are visible. Syntax clientconfig verify Example lunacm:> ccfg verify Command Result : No Error lunacm:> SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 45 2 LunaCM commands file display Display the contents of a backup file. Syntax file display -filename Parameter Shortcut Description -filename -f Specify the name of the backup file to display. Enter this keyword followed by the name of an existing backup file.. Example lunacm:> > file display -filename somepartfile File Name: File Version: SIM Form: Object Count: Source Serial Number: somepartfile 0 CKA_SIM_PORTABLE_NO_AUTHORIZATION 3 321312 (0x4e720) Object: 1 Attribute Count: 23 CKA_CLASS: CKO_SECRET_KEY CKA_TOKEN: True CKA_PRIVATE: True CKA_LABEL: 47 65 6E 65 72 61 74 65 64 20 44 45 53 33 20 4B 65 79 CKA_KEY_TYPE: CKK_DES3 CKA_SENSITIVE: True CKA_ENCRYPT: True CKA_DECRYPT: True CKA_WRAP: True CKA_UNWRAP: True CKA_SIGN: True CKA_VERIFY: True CKA_DERIVE: True CKA_LOCAL: True CKA_MODIFIABLE: True CKA_EXTRACTABLE: True CKA_ALWAYS_SENSITIVE: True CKA_NEVER_EXTRACTABLE: False CKA_CCM_PRIVATE: False CKA_FINGERPRINT_SHA1: E2 EB 1B 86 58 BB 6C EF 07 87 4C 59 D4 06 73 7D 5E 4D 3A 65 SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 46 2 LunaCM commands hagroup Access the hagroup-level commands. The hagroup commands are used to manage and administer HA (high availability) groups of SafeNet HSMs for redundancy and load balancing. Syntax hagroup addmember addstandby creategroup deletegroup halog haonly interval listgroups recover recoveryMode removemember removestandby retry synchronize Parameter Shortcut Description addmember am Add a member to an HA group. See "hagroup addmember" on page 49. addstandby as Add a standby member to an HA group. See "hagroup addstandby" on page 50. creategroup c Create an HA group. See "hagroup creategroup" on page 51. deletegroup d Delete an HA group . See "hagroup deletegroup" on page 52. halog hl Configure the HA log file. See "hagroup halog" on page 53. haonly ho Enable "HA Only" mode. See "hagroup haonly" on page 54. interval i Set the HA recover retry interval. See "hagroup interval" on page 62 listgroups l List the currently-configured HA groups. See "hagroup listgroups" on page 55. recover re Recover a failed HA member. See "hagroup recover" on page 57. recoveryMode m Set HA recovery mode to "active" or "passive". See "hagroup recoverymode " on page 58. removemember rm Remove a member from an HA group. See "hagroup removemember" on page 59. removestandby rs Remove a standby member from an HA group. See "hagroup SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 47 2 Parameter Shortcut LunaCM commands Description removestandby" on page 60. retry rt Set the HA recover retry count. See "hagroup retry" on page 61 synchronize s Synchronize an HA group. See "hagroup synchronize" on page 63 SafeNet Network HSM LunaCM Command Reference Guide Release 6.2.2 Rev. A December 2016 Copyright 2001-2016 Gemalto All rights reserved. 48 2 LunaCM commands hagroup addmember Add a member to an HA group. Use the "-slot" option or the "-serialNumber" option to specify which HSM to add to the group. All password authenticated HA group members must have the same password. All PED authenticated HA group members must have a challenge created, and activation turned on, and all challenges must be the same. If you intend to add a standby member to the group, you must first use this command to add the member to the group, then use the lunacm hagroup addstandby command to convert the member to standby status. Syntax haGroup addMember -serialNumber -l