Server Administration

CCC Administrator users can activate and deactivate the CCC root-of-trust HSM. When the root of trust is disabled, CCC operates in view-only mode. The CCC Administrator is responsible for managing licenses that are required to activate access to the CCC. Acquiring a license allows you to upgrade from a trial version to a full version, renew your license subscription, set the maximum provisioned partitions limit, or access the monitoring feature on HSM devices. The server Administrator can also start or stop the CCC service, outside of CCC, to enable or disable the CCC server. Regular backups are essential to allow you to successfully recover from a disaster. To help troubleshoot operational issues you may encounter, such as failure to connect to devices, or provision services, you can view the logs.

Logging Into the Server

Only users with the admin role can log in to the CCC as an Administrator. By default, the admin role has one user, the admin user. An active license is required for access, so if a license is absent, you are prompted to upload one during CCC activation. To log in to the server as an Administrator:

Root of Trust Activation and Deactivation

You can activate and deactivate the CCC server as required, to limit its ability to log in to the managed devices. For example, you may want to limit periods of activation to specific maintenance windows, to reduce the risk of unauthorized activity in CCC.

Activating the Root of Trust

You need to activate the root of trust on first login to CCC, and to re-activate CCC any time it has been deactivated. You may also need to re-activate the root of trust if its address or credentials are changed.

You must be able to see the root-of-trust HSM as a slot in your Luna client before you can activate it.

To activate the root of trust:

Activating a New Root of Trust

To activate a new root of trust, you need to reauthorize all the devices managed in the CCC. To activate a new root of trust:

Deactivating the Root of Trust

You can deactivate the root of trust to prevent CCC from logging into the managed devices, or to prevent Application Owners from using the CCC Client (ccc_client) to deploy services. To deactivate the root of trust:

Root of Trust Self Activation

CCC can cache your root of trust partition label and password at the time of activation and use them later for reactivation in case of a network disruption. To Enable ROT Self Activation:

Managing Licenses

Access to CCC functionality is regulated by licenses. An active license is required to access the CCC graphical user interface. CCC must be activated to upload a license file. A single license can apply to multiple CCC instances in a high availability configuration.

Once the license expires, you are given a grace period during which you still have access to full CCC functionality. This grace period is to allow some time to order and obtain a new license file. Once the period ends, Administrators cannot import more partitions, create new services, or activate new services, and Application Owners cannot deploy existing services.

Upgrading the license allows you to upgrade from a trial version to a full version, renew your license subscription, or increase the maximum provisioned partitions limit. CCC users have access to the following license types:

The CCC license files are set in the UTC time zone. As a result, the expiry dates on the individual license files may not coincide with your local time zone.

For more information about license types and acquiring your CCC License, contact your Thales sales representative.

Viewing license information

To view license information, click the Administration tab and select Licenses in the navigation frame.

The following information will appear on your screen:

Uploading a License

To upload a license:

Updating a License

To update a license:

Managing CCC Container

The CCC application operates as a container, which means you can use certain commands to perform actions such as starting, stopping, restarting, or checking the status of the container. The specific command you need to use depends on whether you created the container using Podman or Kubernetes.

Podman

Kubernetes/Helm

Backup and Restore

Database and root-of-trust HSM backups are essential to allow you to successfully recover from a disaster.

Regular database backups are required. Refer to PostgreSQL documentation for database backup and restore procedures.

Ensure that you backup the root-of-trust HSM after you first activate CCC. Refer to the Thales Luna HSM documentation for more information.

External Directory Support over LDAP

The key highlights of External Directory Server Support over LDAP feature are as follows:

• As a CCC administrator, you can add any number of directories into the CCC server and then import, provision, and manage users from those directories.

• At the time of user creation, the CCC imports various details associated with the user into the database, such as the First Name, Last Name, User Name, and Email Address.

• The imported user can be assigned either the administrator role or application owner role.

• When a directory user tries to log in to the CCC application, the user authentication request is forwarded to the external directory associated with the user. After receiving a confirmation, the CCC performs user authorization to identify whether the user is an administrator or application owner.

• CCC provides a flexible directory sync service to either manually sync the configured directory for any changes or define a scheduled sync to manage the changes.

• CCC never stores user password details in case of directory users and provides support to Add External Directory over secured as well as unsecured communication channels.

• CCC can work with directory services over LDAP provided by any vendor, including Microsoft Active Directory, Microsoft Azure Directory, and Redhat Directory Service.

• In case a user leaves the organization and the user details are deleted from the directory server, the CCC server will sync the details as per the scheduled sync and update the records. As a CCC administrator, you can also perform manual sync on that directory server. Post sync, if that user tries to log in to the CCC server, the CCC server authentication will fail.

When creating a user in the LDAP/LDAPs directory, ensure that the logon name does not contain spaces. The logon name serves as the username for logging into the CCC, and including spaces may cause authentication issues.

Adding Directories

To add a directory:

Managing Directories

To manage a directory:

podman exec ccc bash -c 'keytool -delete -alias <certificate_alias> -keystore /usr/safenet/ccc/server/standalone/configuration/cacerts.jks -storepass <password>'

kubectl exec  -- bash -c 'keytool -delete -alias <certificate_alias> -keystore /usr/safenet/ccc/server/standalone/configuration/cacerts.jks -storepass <password>'