Entrust NShield Manuel utilisateur

nShield® Connect

Installation Guide

12.80

17 Nov 2021

Contents

1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4

1.1. About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê4

1.2. Additional documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

1.3. Handling an nShield Connect. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê6

1.4. Environmental requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê7

1.5. Physical location considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê8

2. Recycling and disposal information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê9

3. Before you install the software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê10

3.1. Preparatory tasks before installing software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê10

3.2. Firewall settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê12

4. Installing the software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

4.1. Installing the Security World Software on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . Ê14

4.2. Installing the Security World Software on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê15

5. Before installing an nShield Connect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

5.1. Carefully unpack the nShield Connect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

5.2. Check that all parts on the packing list are present . . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

5.3. Check the physical security of the nShield Connect. . . . . . . . . . . . . . . . . . . . . . . . . . Ê17

6. Installing an nShield Connect in a rack, cabinet, or shelf. . . . . . . . . . . . . . . . . . . . . . . . . . . Ê18

6.1. Connecting Ethernet, console and power cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê18

6.2. Connecting the Serial Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê20

6.3. Connecting the optional USB keyboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê21

6.4. Checking the installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê21

7. Front panel controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê22

8. Top-level menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê23

9. Basic nShield Connect, RFS and client configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê25

9.1. About nShield Connect and client configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê25

9.2. Basic nShield Connect and RFS configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê26

9.3. Basic configuration of the client to use the nShield Connect . . . . . . . . . . . . . . . . . Ê46

9.4. Basic configuration of an nShield Connect to use a client. . . . . . . . . . . . . . . . . . . . Ê50

9.5. Restarting the hardserver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê52

9.6. Zero touch configuration of an nShield Connect . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê53

9.7. Checking the installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê54

9.8. Using a Security World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê54

10. Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê55

10.1. Checking operational status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê55

10.2. Module overheating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê60

10.3. Log messages for the module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê60

10.4. Utility error messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê62

nShield® Connect Installation Guide 2 of 73

11. nShield Connect maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê63

11.1. Flash testing the module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê63

12. Approved accessories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê64

Appendix A: Uninstalling existing software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê65

A.1. Uninstalling the Security World Software on Windows. . . . . . . . . . . . . . . . . . . . . . . Ê66

A.2. Uninstalling the Security World Software on Linux. . . . . . . . . . . . . . . . . . . . . . . . . . Ê66

Appendix B: Software packages on the Security World software installation media. . . . Ê68

B.1. Security World installation media. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê68

B.2. Components required for particular functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê69

B.3. nCipherKM JCA/JCE cryptographic service provider . . . . . . . . . . . . . . . . . . . . . . . . Ê70

B.4. SNMP monitoring agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê71

Appendix C: Valid IPv6 Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ê72

nShield® Connect Installation Guide 3 of 73

1. Introduction

The Entrust nShield Connect is a Hardware Security Module (HSM) that provides secure

cryptographic processing within a tamper-resistant casing. Each nShield Connect is

configured to communicate with one or more client computers over an Ethernet

network. A client is a computer using the nShield Connect for cryptography. You can also

configure clients to use other nShield Connects on the network, as well as locally

installed HSMs.

1.1. About this guide

This guide includes:

•Installing the Security World Software. See Installing the software.

•Physically installing an nShield Connect. See Installing an nShield Connect in a rack,

cabinet, or shelf.

•Configuring an nShield Connect and client. See Basic nShield Connect, RFS and

client configuration.

•The nShield Connect front panel controls. See Front panel controls.

•The top-level menu of an nShield Connect. See Top-level menu.

•Troubleshooting information. See Troubleshooting.

•nShield Connect maintenance. See nShield Connect maintenance.

•Accessories. See Approved accessories.

•Instructions to uninstall existing software. See Uninstalling existing software.

•Software components and bundles. See Software packages on the Security World

software installation media.

See the nShield Connect User Guide for more about, for example:

•Creating and managing a Security World

•Creating and using keys

•Card sets

•The advanced features of an nShield Connect

For information on integrating Entrust nShield products with third-party enterprise

applications, see https://www.entrust.com/digital-security/hsm.

1.1.1. Model numbers

Model numbering conventions are used to distinguish different nShield hardware security

devices.

nShield® Connect Installation Guide 4 of 73

Model number Used for

NH2047 Connect 6000

NH2040 Connect 1500

NH2033 Connect 500

NH2068 Connect 6000+

NH2061 Connect 1500+

NH2054 Connect 500+

NH2075-B Connect XC Base

NH2075-M Connect XC Medium

NH2075-H Connect XC High

NH2082 Connect XC SCAP

NH2089-B Connect XC Base - Serial Console

NH2089-M Connect XC Mid - Serial Console

NH2089-H Connect XC High - Serial Console

NH3003-B Connect CLX Base - Serial Console

NH3003-M Connect CLX Mid - Serial Console

NH3003-H Connect CLX High - Serial Console

nC3nnnE-nnn, nC4nnnE-nnn nShield Solo PCIe

1.1.2. Power and safety requirements

The module draws up to 220 watts:

•Voltage: 100 VAC -240 VAC

•Current: 2.0 A - 1.0 A

•Frequency: 50 Hz - 60 Hz.

The module PSUs are compatible with international mains voltage

supplies.

nShield® Connect Installation Guide 5 of 73

1.2. Additional documentation

You can find additional documentation in the documentation directory of the installation

media for your product. For information about enabling additional features (such as

client licenses), see the User Guide. We strongly recommend that you read the release

notes before you use the module. These notes contain the latest information about your

product and are available online through Entrust nShield support

https://nshieldsupport.entrust.com.

Read this guide in conjunction with the nShield product’s Warnings and Cautions

documentation (available in multiple languages).

1.2.1. Terminology

The nShield Connect is referred to as the nShield Connect, the hardware security module,

or the HSM.

1.3. Handling an nShield Connect

An nShield Connect contains solid-state devices that can withstand normal handling.

However, do not drop the module or expose it to excessive vibration.

If you are installing the module in a 19” rack, make sure that you follow the nShield

Connect Slide Rails Instructions provided with the rails. In particular, be careful of sharp

edges.

Only experienced personnel should handle or install an nShield Connect. Always consult

your company health and safety policy before attempting to lift and carry the module.

Two competent persons are required if it is necessary to lift the module to a level above

head height (for example, during installation in a rack or when placing the module on a

high shelf).

1.3.1. Weight and Dimensions

Weight:ÊÊ11.5kg

Dimensions:Ê43.4mm x 430mm x 690mm

The module is compatible with 1U 19” rack systems.

Measurements given are height x width x length/depth. If the inner slide rails are

attached, the width of the unpackaged module is 448mm.

nShield® Connect Installation Guide 6 of 73

1.4. Environmental requirements

To ensure good air flow through and around the module after installation, do not

obstruct either the fans and vents at the rear or the vent at the front. Ensure that there is

an air gap around the module, and that the rack itself is located in a position with good

air flow.

1.4.1. Temperature and humidity recommendations

We recommend that your module operates within the following environmental

conditions.

Environmental conditions Operating range

(Min.ÊÊ|ÊÊMax.)

Comments

Operating temperature 5 °C 35 °C -

Storage temperature -20 °C 70 °C -

Operating humidity 10 % 85 % Relative. Non-condensing at

35 °C.

Storage humidity 0 % 95 % Relative. Non-condensing at

35 °C.

Altitude -100 m 2000 m Above Mean Sea Level

(AMSL)

1.4.2. Cooling requirements

Adequate cooling of your module is essential for trouble-free operation and a long

operational life. During operation, you can use the supplied stattree utility to check the

actual and maximum temperature of the module. You are advised to do this directly after

installing the unit in its normal working environment. Monitor the temperature of the unit

over its first few days of operation.

In the unlikely event that the internal encryption module overheats, the module shuts

down (see Module Overheating). If the whole nShield Connect overheats, the orange

warning LED on the front panel illuminates (see Orange warning LED) and a critical error

message is shown on the display.

nShield® Connect Installation Guide 7 of 73

1.5. Physical location considerations

Entrust nShield HSMs are certified to NIST FIPS 140-2 Level 2 and 3. In addition to the

intrinsic protection provided by an nShield HSM, customers must exercise due diligence

to ensure that the environment within which the nShield HSMs are deployed is

configured properly and is regularly examined as part of a comprehensive risk mitigation

program to assess both logical and physical threats. Applications running in the

environment shall be authenticated to ensure their legitimacy and to thwart possible

proliferation of malware that could infiltrate these as they access the HSMs’

cryptographic services. The deployed environment must adopt 'defense in depth'

measures and carefully consider the physical location to prevent detection of

electromagnetic emanations that might otherwise inadvertently disclose cryptographic

material.

nShield® Connect Installation Guide 8 of 73

2. Recycling and disposal information

For recycling and disposal guidance, see the nShield product’s Warnings and Cautions

documentation.

nShield® Connect Installation Guide 9 of 73

3. Before you install the software

Before you install the software, you should:

•If required, install an optional nToken in the client computer, see nToken Installation

Guide for more information about the installation steps.

•Uninstall any older versions of Security World Software. See Uninstalling existing

software.

•Complete any other necessary preparatory tasks, as described in Preparatory tasks

before installing software.

3.1. Preparatory tasks before installing software

Perform any of the necessary preparatory tasks described in this section before installing

the Security World Software on the client computer.

3.1.1. Windows

Adjust your computers power saving setting to prevent sleep mode.

3.1.1.1. Install Microsoft security updates

Make sure that you have installed the latest Microsoft security updates. Information

about Microsoft security updates is available from http://www.microsoft.com/security/.

3.1.2. Linux

3.1.2.1. Install operating environment patches

Make sure that you have installed the latest recommended patches. See the

documentation supplied with your operating environment for information.

3.1.2.2. Users and Groups

The installer automatically creates the following group and users if they do not exist. If

you wish to create them manually, you should do so before running the installer.

Create the following, as required:

•The nfast user in the nfast group, using /opt/nfast as the home directory.

•If you are installing snmp, the ncsnmpd user in the ncsnmpd group, using /opt/nfast as

the home directory.

nShield® Connect Installation Guide 10 of 73

Autres manuels pour nShield

Table des matières

Autres manuels Entrust Unité de contrôle

Entrust

Entrust nShield Manuel utilisateur

Entrust

Entrust nShield Solo Manuel utilisateur

Entrust

Entrust Sigma DS4 Manuel utilisateur

Entrust

Entrust nShield 5s Manuel utilisateur

Entrust

Entrust nShield Edge Manuel utilisateur

Manuels Unité de contrôle populaires d'autres marques

Festo

Festo Compact Performance CP-FB6-E Manuel de la liste des pièces

Elo TouchSystems

Elo TouchSystems DMS-SA19P-EXTME Manuel utilisateur

JS Automation

JS Automation MPC3034A Manuel utilisateur

JAUDT

JAUDT SW GII 6406 Series Guide rapide

Spektrum

Spektrum Air Module System Manuel utilisateur

BOC Edwards

BOC Edwards Q Series Manuel utilisateur

KHADAS

KHADAS BT Magic Manuel utilisateur

Etherma

Etherma eNEXHO-IL Manuel utilisateur

PMFoundations

PMFoundations Attenuverter Manuel utilisateur

GEA

GEA VARIVENT Manuel utilisateur

Walther Systemtechnik

Walther Systemtechnik VMS-05 Manuel utilisateur

Altronix

Altronix LINQ8PD Instructions de montage

Eaton

Eaton Powerware Series Manuel utilisateur

WAGO

WAGO 750-407/040-000 Manuel utilisateur

Sony

Sony CCU-590 Manuel utilisateur

Graco

Graco 25D614 Manuel utilisateur

Task Force Tips

Task Force Tips YE-RF-900 Manuel de programmation

Shini

Shini SPV-U Series Manuel utilisateur