Entrust NShield Edge Manual de usuario

nShield® Edge

Installation Guide

12.80

17 Nov 2021

Contents

1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4

1.1. About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4

1.2. Additional documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4

2. Safety and security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

2.1. FIPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

3. Regulatory notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7

3.1. FCCÊclass AÊnotice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7

3.2. Canadian certification - CAN ICES-3 (A)/NMB-3(A) . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7

3.3. Recycling and disposal information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7

4. Before you install the software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8

4.1. Preparatory tasks before installing software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8

4.2. Firewall settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê10

5. Installing the software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê11

5.1. Installing the Security World Software on Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . Ê11

5.2. Installing the Security World Software on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê12

6. Setting up the nShield Edge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

6.1. Power saving options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

6.2. Connecting an nShield Edge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

6.3. Enabling optional features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê15

6.4. Disconnecting and reconnecting the nShield Edge . . . . . . . . . . . . . . . . . . . . . . . . . . Ê15

6.5. Checking the installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê16

6.6. Using a Security World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê16

7. Using the nShield Edge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

7.1. Mode LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

7.2. Changing the mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê18

7.3. Status LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê18

8. Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê19

8.1. None of the LEDs are lit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê19

8.2. The Mode LED is amber or red . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê19

8.3. The Status LED is flashing irregularly and the nShield Edge is unresponsive

for more than a few minutes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê19

8.4. The Security World Software does not detect the connected nShield Edge . . . . Ê19

8.5. Upgrading the firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê19

9. nShield Edge Windows compatibility issues and considerations . . . . . . . . . . . . . . . . . . . Ê20

9.1. nShield Edge very slow in VMware virtual machine . . . . . . . . . . . . . . . . . . . . . . . . . . Ê20

10. Dimensions and operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê21

10.1. Physical location considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê21

Appendix A: Uninstalling existing software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê22

nShield® Edge Installation Guide 2 of 29

A.1. Uninstalling the Security World Software on Windows . . . . . . . . . . . . . . . . . . . . . . . Ê23

A.2. Uninstalling the Security World Software on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . Ê23

Appendix B: Software packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê25

B.1. Security World installation media. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê25

B.2. Components required for particular functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê26

B.3. nCipherKM JCA/JCE cryptographic service provider . . . . . . . . . . . . . . . . . . . . . . . . Ê27

B.4. SNMP monitoring agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê27

nShield® Edge Installation Guide 3 of 29

1. Introduction

The Entrust nShield Edge is a portable Hardware Security Module (HSM) for use in root

Certification Authorities (CAs) and Registration Authorities (RAs), code signing, and

remote HSM operations. The nShield Edge combines a full-featured HSM with a smart

card reader, which you can use to securely store and access your organization’s

highvalue occasional-use keys, such as certificate signing keys.

The nShield Edge has been designed and tested for deployments where one HSM is used

with one computer or Windows Virtual Machine (VM). Multiple-unit deployments, where

multiple nShield Edge HSMs are connected to the same computer or VM, are not

supported.

We do not recommend using the nShield Edge alongside other Entrust nShield HSMs on

the same computer or VM.

1.1. About this guide

This guide includes:

•Installing the Security World Software. See Installing the software.

•Steps to set up an nShield Edge. See Setting up the nShield Edge.

•How to use an nShield Edge. See Using the nShield Edge.

•Troubleshooting information. See Troubleshooting.

•nShield Edge compatibility considerations. See nShield Edge Windows compatibility

issues and considerations.

•Instructions to uninstall existing software. See Uninstalling existing software.

•Software components and bundles. See Software packages.

The Security World Software is supplied on the accompanying Security World for nShield

installation media.

1.2. Additional documentation

You can find additional documentation in the documentation directory of the installation

media, including the nShield Edge and nShield Solo User Guide, which describes how to

use the Security World Software. We strongly recommend that you read the release

notes in the release directory of your installation disc before you use the nShield Edge.

These notes contain the latest information about your product.

nShield® Edge Installation Guide 4 of 29

1.2.1. Terminology

The nShield Edge is referred to as the nShield Edge, the hardware security module, or the

HSM.

nShield® Edge Installation Guide 5 of 29

2. Safety and security



There are no user-serviceable parts inside the nShield Edge. Any

attempt to dismantle the nShield Edge results in any remaining

warranty cover, the maintenance and support agreement, or both being

rendered void.

To help maintain security:

•Always inspect the USB cable and the nShield Edge before use, specifically the

Entrust logo hologram in the tamper window shown below. (The nShield Edge

Developer Edition does not have a hologram and tamper window.) If there are any

signs of tampering, do not use the cable and the nShield Edge.

•Where possible, use the lock slot of the nShield Edge to secure it to a desk with a

compatible lock (not supplied).

•Never store or carry smart cards with the nShield Edge.

•Protect your pass phrase in line with your organization’s security policy.

2.1. FIPS

There are a number of nShield Edge variants, some certified to different FIPS 140-2

levels. The FIPS rating is indicated on the label on the nShield Edge.

nShield® Edge Installation Guide 6 of 29

3. Regulatory notices

3.1. FCCÊclass AÊnotice

The nShield Solo and nShield Solo XC HSMs comply with Part 15 of the FCC rules.

Operation is subject to the following two conditions:

1. The device may not cause harmful interference, and

2. The device must accept any interference received, including interference that may

cause undesired operation.

This equipment has been tested and found to comply with the limits for a Class A digital

device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide

reasonable protection against harmful interference when the equipment is operated in a

commercial environment. This equipment generates, uses, and can radiate radio

frequency energy and, if not installed and used in accordance with the instruction

manual, may cause harmful interference to radio communications. Operation of this

equipment in a residential area is likely to cause harmful interference in which case the

user will be required to correct the interference at his own expense.

3.2. Canadian certification - CAN ICES-3 (A)/NMB-3(A)

3.3. Recycling and disposal information

For recycling and disposal guidance, see the nShield product’s Warnings and Cautions

documentation.

nShield® Edge Installation Guide 7 of 29

4. Before you install the software

Do not connect the nShield Edge to your computer before installing the Security World

Software.

Uninstall any older versions of Security World Software. See Uninstalling existing

software.

4.1. Preparatory tasks before installing software

Perform any of the necessary preparatory tasks described in this section before installing

the Security World Software.

4.1.1. Windows

Adjust your computers power saving setting to prevent sleep mode.

4.1.1.1. Install Microsoft security updates

Make sure that you have installed the latest Microsoft security updates. Information

about Microsoft security updates is available from http://www.microsoft.com/security/.

4.1.2. Linux

4.1.2.1. Install operating environment patches

Make sure that you have installed the latest recommended patches. See the

documentation supplied with your operating environment for information.

4.1.2.2. Users and Groups

The installer automatically creates the following group and users if they do not exist. If

you wish to create them manually, you should do so before running the installer.

Create the following, as required:

•The nfast user in the nfast group, using /opt/nfast as the home directory.

•If you are installing snmp, the ncsnmpd user in the ncsnmpd group, using /opt/nfast as

the home directory.

•If you are installing the Remote Administration Service, the raserv user in the raserv

group, using /opt/nfast as the home directory.

nShield® Edge Installation Guide 8 of 29

4.1.3. All environments

4.1.3.1. Install Java with any necessary patches

The following versions of Java have been tested to work with, and are supported by, your

nShield Security World Software:

•Java7 (or Java 1.7x)

•Java8 (or Java 1.8x).

•Java11

We recommend that you ensure Java is installed before you install the Security World

Software. The Java executable must be on your system path.

If you can do so, please use the latest Java version currently supported by _brand} that

is compatible with your requirements. Java versions before those shown are no longer

supported. If you are maintaining older Java versions for legacy reasons, and need

compatibility with current nShield software, please contact Entrust nShield Support,

https://nshieldsupport.entrust.com.

To install Java you may need installation packages specific to your operating system,

which may depend on other pre-installed packages to be able to work.

Suggested links from which you may download Java software as appropriate for your

operating system:

•http://www.oracle.com/technetwork/java/index.html

•http://www.oracle.com/technetwork/java/all-142825.html

You must have Java installed to use KeySafe.

4.1.3.2. Identify software components to be installed

Entrust supply standard component bundles that contain many of the necessary

components for your installation and, in addition, individual components for use with

supported applications. To be sure that all component dependencies are satisfied, you

can install either:

•All the software components supplied

•Only the software components you require

During the installation process, you are asked to choose which bundles and components

to install. Your choice depends on a number of considerations, including:

•The types of application that are to use the module

nShield® Edge Installation Guide 9 of 29

•The amount of disc space available for the installation

•Your company’s policy on installing software. For example, although it may be

simpler to choose all software components, your company may have a policy of not

installing any software that is not required.

You must install the Hardware Support bundle. If the Hardware Support bundle is not

installed, your module cannot function.

The Core Tools bundle contains all the Security World Software command-line utilities,

including generatekey, low-level utilities, and test programs. The Core Tools bundle

includes the Tcl run time component that installs a run-time Tcl installation within the

nCipher directories. This is used by the tools for creating the Security World and by

KeySafe. This does not affect any other installation of Tcl on your computer.

4.2. Firewall settings

When setting up your firewall, you should ensure that the port settings are compatible

with the HSMs and allow access to the system components you are using.

The following table identifies the ports used by the nShield system components. All listed

ports are the default setting. Other ports may be defined during system configuration,

according to the requirements of your organization.

Component Default Port Use

Hardserver 9000 Internal non-privileged connections from Java

applications including KeySafe

Hardserver 9001 Internal privileged connections from Java applications

including KeySafe

Hardserver 9004 Incoming impath connections from other hardservers, for

example from a non-attended host machine to an

attended host machine when using Remote Operator

If you are using an nShield Edge as a Remote Operator slot for an HSM located

elsewhere, you need to open port 9004. You may restrict the IP addresses to those you

expect to use this port. You can also restrict the IP addresses accepted by the hardserver

in the configuration file. See the User Guide for your module and operating system for

more about configuration files.

nShield® Edge Installation Guide 10 of 29

Tabla de contenidos

Otros manuales de Unidad de control de Entrust

Entrust

Entrust nShield Solo Manual de usuario

Entrust

Entrust Sigma DS4 Manual de usuario

Entrust

Entrust nShield 5s Manual de usuario

Entrust

Entrust nShield Manual de usuario

Entrust

Entrust nShield Manual de usuario

Manuales populares de Unidad de control de otras marcas

Festo

Festo Compact Performance CP-FB6-E Manual de lista de piezas

Elo TouchSystems

Elo TouchSystems DMS-SA19P-EXTME Manual de usuario

JS Automation

JS Automation MPC3034A Manual de usuario

JAUDT

JAUDT SW GII 6406 Series Guía rápida

Spektrum

Spektrum Air Module System Manual de usuario

BOC Edwards

BOC Edwards Q Series Manual de usuario

KHADAS

KHADAS BT Magic Manual de usuario

Etherma

Etherma eNEXHO-IL Manual de usuario

PMFoundations

PMFoundations Attenuverter Manual de usuario

GEA

GEA VARIVENT Manual de usuario

Walther Systemtechnik

Walther Systemtechnik VMS-05 Manual de usuario

Altronix

Altronix LINQ8PD Instrucciones de montaje

Eaton

Eaton Powerware Series Manual de usuario

WAGO

WAGO 750-407/040-000 Manual de usuario

Sony

Sony CCU-590 Manual de usuario

Graco

Graco 25D614 Manual de usuario

Task Force Tips

Task Force Tips YE-RF-900 Manual de programación

Shini

Shini SPV-U Series Manual de usuario

Entrust nShield Edge Manual de usuario

Manuales populares de Unidad de control de otras marcas