Entrust NShield 5c Manual de usuario

nShield® 5c

Installation Guide

13.3

04 May 2023

Contents

1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4

1.1. About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4

1.2. Handling an nShield nShield 5c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê5

1.3. Environmental requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

1.4. Physical location considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7

2. Recycling and disposal information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8

3. Before you install the software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê9

3.1. Preparatory tasks before installing software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê9

3.2. Firewall settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê12

4. Installing the software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

4.1. Installing the Security World Software on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

4.2. Installing the Security World Software on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê15

5. Before installing an HSM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

5.1. Carefully unpack the HSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

5.2. Check that all parts on the packing list are present . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

5.3. Check the physical security of the HSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

6. Installing an HSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê18

6.1. Connecting Ethernet, console and power cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê18

6.2. Connecting the Serial Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê20

6.3. Connecting the optional USB keyboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê21

6.4. Checking the installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê21

7. Front panel controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê22

8. Top-level menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê23

9. Basic HSM, RFS and client configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê25

9.1. About nShield nShield 5c and client configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê25

9.2. Basic nShield nShield 5c and RFS configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê26

9.3. Basic configuration of the client to use the nShield nShield 5c . . . . . . . . . . . . . . . Ê49

9.4. Basic configuration of an nShield nShield 5c to use a client . . . . . . . . . . . . . . . . . . Ê52

9.5. Restarting the hardserver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê56

9.6. Zero touch configuration of an nShield nShield 5c . . . . . . . . . . . . . . . . . . . . . . . . . . Ê56

9.7. Checking the installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê59

9.8. Using a Security World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê59

10. Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê60

10.1. Checking operational status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê60

10.2. Module overheating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê65

10.3. Log messages for the module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê65

10.4. Utility error messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê67

11. HSM maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê68

nShield® 5c Installation Guide 2 of 77

11.1. Flash testing the module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê68

12. Approved accessories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê69

Appendix A: Uninstalling existing software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê70

A.1. Uninstalling the Security World Software on Windows . . . . . . . . . . . . . . . . . . . . . . . Ê71

A.2. Uninstalling the Security World Software on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . Ê71

Appendix B: Software packages on the Security World software installation media . . . . Ê73

B.1. Security World installation media. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê73

B.2. Components required for particular functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê74

B.3. nCipherKM JCA/JCE cryptographic service provider . . . . . . . . . . . . . . . . . . . . . . . . Ê75

B.4. SNMP monitoring agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê76

Appendix C: Valid IPv6 Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê77

nShield® 5c Installation Guide 3 of 77

1. Introduction

The Entrust nShield nShield 5c is a Hardware Security Module (HSM) that provides

secure cryptographic processing within a tamper-resistant casing. Each nShield nShield

5c is configured to communicate with one or more client computers over an Ethernet

network. A client is a computer using the nShield nShield 5c for cryptography. You can

also configure clients to use other nShield HSMs on the network, as well as locally

installed HSMs.

1.1. About this guide

This guide includes:

•Installing the Security World Software. See Installing the software.

•Physically installing an nShield nShield 5c. See Installing an HSM.

•Configuring an nShield nShield 5c and client. See Basic HSM, RFS and client

configuration.

•The nShield nShield 5c front panel controls. See Front panel controls.

•The top-level menu of an nShield nShield 5c. See Top-level menu.

•Troubleshooting information. See Troubleshooting.

•nShield nShield 5c maintenance. See HSM maintenance.

•Accessories. See Approved accessories.

•Instructions to uninstall existing software. See Uninstalling existing software.

•Software components and bundles. See Software packages on the Security World

software installation media.

See the nShield nShield 5c User Guide for more about, for example:

•Creating and managing a Security World

•Creating and using keys

•Card sets

•The advanced features of an nShield nShield 5c.

For information on integrating Entrust nShield products with third-party enterprise

applications, see https://www.entrust.com/digital-security/hsm.

1.1.1. Model numbers

Model numbering conventions are used to distinguish different nShield hardware security

devices.

nShield® 5c Installation Guide 4 of 77

Model number Used for

NH2096-B nShield nShield 5c Base

NH2096-M nShield nShield 5c Medium

NH2096-H nShield nShield 5c High

1.1.2. Power and safety requirements

The module draws up to 220 watts:

•Voltage: 100 VAC -240 VAC

•Current: 2.0 A - 1.0 A

•Frequency: 50 Hz - 60 Hz.

The module PSUs are compatible with international mains voltage

supplies.

1.1.3. Terminology

The nShield nShield 5c is referred to as the nShield nShield 5c, the Hardware Security

Module, or the HSM.

1.2. Handling an nShield nShield 5c

An nShield nShield 5c contains solid-state devices that can withstand normal handling.

However, do not drop the module or expose it to excessive vibration.

If you are installing the module in a 19” rack, make sure that you follow the nShield

nShield 5c Slide Rails Instructions provided with the rails. In particular, be careful of sharp

edges.

Only experienced personnel should handle or install an nShield nShield 5c. Always

consult your company health and safety policy before attempting to lift and carry the

module. Two competent persons are required if it is necessary to lift the module to a

level above head height (for example, during installation in a rack or when placing the

module on a high shelf).

1.2.1. Weight and Dimensions

Weight:ÊÊ11.5kg

nShield® 5c Installation Guide 5 of 77

Dimensions:Ê43.4mm x 430mm x 690mm

The module is compatible with 1U 19” rack systems.

Measurements given are height x width x length/depth. If the inner slide rails are

attached, the width of the unpackaged module is 448mm.

1.3. Environmental requirements

To ensure good air flow through and around the module after installation, do not

obstruct either the fans and vents at the rear or the vent at the front. Ensure that there is

an air gap around the module, and that the rack itself is located in a position with good

air flow.

1.3.1. Temperature and humidity recommendations

Entrust recommends that your module operates within the following environmental

conditions.

Environmental conditions Operating range

(Min.ÊÊ|ÊÊMax.)

Comments

Operating temperature 5 °C 35 °C -

Storage temperature -20 °C 70 °C -

Operating humidity 10 % 85 % Relative. Non-condensing at

35 °C.

Storage humidity 0 % 95 % Relative. Non-condensing at

35 °C.

Altitude -100 m 2000 m Above Mean Sea Level

(AMSL)

1.3.2. Cooling requirements

Adequate cooling of your module is essential for trouble-free operation and a long

operational life. During operation, you can use the supplied stattree utility to check the

actual and maximum temperature of the module. You are advised to do this directly after

installing the unit in its normal working environment. Monitor the temperature of the unit

over its first few days of operation.

In the unlikely event that the internal encryption module overheats, the module shuts

nShield® 5c Installation Guide 6 of 77

down (see Module Overheating). If the whole nShield nShield 5c overheats, the orange

warning LED on the front panel illuminates (see Orange warning LED) and a critical error

message is shown on the display.

1.4. Physical location considerations

Entrust nShield HSMs are certified to NIST FIPS 140 Level 2 and 3. In addition to the

intrinsic protection provided by an nShield HSM, customers must exercise due diligence

to ensure that the environment within which the nShield HSMs are deployed is

configured properly and is regularly examined as part of a comprehensive risk mitigation

program to assess both logical and physical threats. Applications running in the

environment shall be authenticated to ensure their legitimacy and to thwart possible

proliferation of malware that could infiltrate these as they access the HSMs’

cryptographic services. The deployed environment must adopt 'defense in depth'

measures and carefully consider the physical location to prevent detection of

electromagnetic emanations that might otherwise inadvertently disclose cryptographic

material.

nShield® 5c Installation Guide 7 of 77

2. Recycling and disposal information

For recycling and disposal guidance, see the nShield product’s Warnings and Cautions

documentation.

nShield® 5c Installation Guide 8 of 77

3. Before you install the software

Before you install the software, you should:

•If required, install an optional nToken in the client computer, see nToken Installation

Guide for more information about the installation steps.

•Uninstall any older versions of Security World Software. See Uninstalling existing

software.

•If the nShield Remote Administration Client is installed on the machine, remove it.

You will also have to re-install it after you installed the new Security World software

version. See the nShield Remote Administration User Guide.

•Complete any other necessary preparatory tasks, as described in Preparatory tasks

before installing software.

3.1. Preparatory tasks before installing software

Perform any of the necessary preparatory tasks described in this section before installing

the Security World Software on the client computer.

3.1.1. Windows

Adjust your computer’s power saving setting to prevent sleep mode.

3.1.1.1. Install Microsoft security updates

Make sure that you have installed the latest Microsoft security updates. Information

about Microsoft security updates is available from http://www.microsoft.com/security/.

3.1.2. Linux

3.1.2.1. Install operating environment patches

Make sure that you have installed:

•kernel packages like gcc, kernel-headers, kernel-devel

•the latest recommended patches for your environment in general

See the documentation supplied with your operating environment for information.

3.1.2.2. Users and groups

The installer automatically creates the following group and users if they do not exist. If

nShield® 5c Installation Guide 9 of 77

you wish to create them manually, you should do so before running the installer.

Create the following, as required:

•The nfast user in the nfast group, using /opt/nfast as the home directory.

•If you are installing snmp, the ncsnmpd user in the ncsnmpd group, using /opt/nfast as

the home directory.

•If you are installing the Remote Administration Service, the raserv user in the raserv

group, using /opt/nfast as the home directory.

3.1.3. All environments

3.1.3.1. Install Java with any necessary patches

The following versions of Java have been tested to work with, and are supported by, your

nShield Security World Software:

•Java7 (or Java 1.7x)

•Java8 (or Java 1.8x)

•Java11.

Entrust recommends that you ensure Java is installed before you install the Security

World Software. The Java executable must be on your system path.

If you can do so, please use the latest Java version currently supported by Entrust that is

compatible with your requirements. Java versions before those shown are no longer

supported. If you are maintaining older Java versions for legacy reasons, and need

compatibility with current nShield software, please contact Entrust nShield Support,

https://nshieldsupport.entrust.com.

To install Java you may need installation packages specific to your operating system,

which may depend on other pre-installed packages to be able to work.

Suggested links from which you may download Java software as appropriate for your

operating system:

•http://www.oracle.com/technetwork/java/index.html

•http://www.oracle.com/technetwork/java/all-142825.html

You must have Java installed to use KeySafe.

3.1.3.2. Identify software components to be installed

Entrust supply standard component bundles that contain many of the necessary

nShield® 5c Installation Guide 10 of 77

Tabla de contenidos

Otros manuales de Hardware de red de Entrust

Entrust

Entrust Sigma DS4 Manual de usuario

Entrust

Entrust nShield Solo Manual de usuario

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario

Entrust nShield 5c Manual de usuario

Manuales populares de Hardware de red de otras marcas