hsm factoryreset

Set the HSM back to its factory default settings, deleting the HSM SO, all users, and all objects. This command can be run only via a local serial connection; it is not accepted via SSH.

CAUTION!   This command deletes all objects and users on the HSM, leaving it in a zeroized state.

This command does not require HSM login. The assumption is that your organization's physical security protocols prevent unauthorized physical access to the HSM. If those protocols failed, an unauthorized person would have no access to the HSM contents, and would be limited to temporary denial of service by destruction of HSM contents.

Because this is a destructive command, you are asked whether to “proceed” unless the -force switch is provided at the command line. See Comparison of Destruction/Denial Actions to view a table that compares and contrasts various "deny access" events or actions that are sometimes confused.

This command:

>Erases the currently-initialized Auditor role

>Resets HSM policies

>Erases the RPV (Remote PED Vector or orange PED key authentication data)

The RPV data is required for Remote PED operations to function, including remote HSM initialization, if needed, so RPV must be reinstated after hsm factoryreset if you want to do any remote administration of the HSM.

NOTE   If the operation erases the RPV as described above, and you previously established a remote PED connection (using hsm ped connect), you must tear down the remote PED connection (using hsm ped disconnect) before you reinitialize the RPV and establish a new remote PED connection. The hsm factoryReset command operates on the internal HSM only, and not on software processes responsible for the remote PED connection.

Related commands

This command affects only the HSM, and not the settings for other components of the appliance. The command sysconf config factoryreset affects appliance settings external to the HSM. To bring your entire SafeNet Luna Network HSM as close as possible to original configuration, as shipped from the factory, run both commands.

If you wish to zeroize (remove all partitions, roles except Auditor, and contents) while preserving HSM policies and the RPV - that is, zeroize before shipping the HSM off to be remotely configured - use the command hsm zeroize instead.

User Privileges

Users with the following privileges can perform this command:

>Admin

Syntax

hsm factoryreset [-force]

Argument(s)	Shortcut	Description
-force	-f	Force the action without prompting.

Example

Non-local (network connection) attempt:

lunash:>hsm factoryreset


Error:  'hsm factoryReset' can only be run from the local 
        console. Login as 'admin' using the serial port on 
        the Luna SA before running this command.


Command Result : 65535 (Luna Shell execution)

Local attempt:

lunash:>hsm factoryreset

CAUTION:  Are you sure you wish to reset this HSM to factory
          default settings? All partitions and data will be erased.
          Partition policies will be reverted to factory settings.
          HSM level policies will be reverted to factory settings.
          If you want to erase partitions and data only, use zeroize.
          Remote PED vector will be erased.
          Type 'proceed' to return the HSM to factory default, or
          'quit' to quit now.
          > proceed

'hsm factoryReset' successful.

Please wait while the HSM is reset to complete the process.
The remote PED vector (RPV) has been erased on HSM.

Command Result : 0 (success)