Administration & Maintenance - Backup & Restore
The source options, in restoring to a partition are:
The physical arrangements of hardware for restoring a partition locally are:
To restore one HSM Partition, you must have:
The Backup HSM or Token and the HSM with the target Partition must share the same
cloning domain.
If you have (say) Private Key Cloning switched off for the current Partition, then the Backup operation proceeds, but skips over any private keys, and clones only the permitted objects onto the Backup token. Similarly, if you restore from a token that includes private keys, but the target Partition has Private Key Cloning disallowed, then all other objects are recovered to the Partition, but the private keys are skipped during the operation.
The partition restore command on Luna SA assumes a locally-connected backup device. Lunash:> partition commands cannot be used to restore to a backup device connected to another computer - see next example.
Note that in the command above, you could have used -add instead of -replace.
lunash:> partition restore -partition myRoom -password 9YWt6L56FXqGC6sL -replace
In that example, either the Password came from the Luna PED of a Luna SA with Trusted Path Authentication, or it was a Password Authenticated Partition Password created by someone very enthusiastic about passwords.
On restore, you may add to existing HSM Partition contents or replace them. Adding might result in unwanted behaviors, such as having two keys with the same label, if one existed in the HSM Partition and one on the backup token. The two would be assigned different handles, however.
LunaClient must be loaded on the workstation that you use for this restore operation, including the Luna SA option so that the vtl utility is available. As well, you should install the Remote PED option, and have a Luna PED (Remote) connected to the workstation, to authenticate to the distant Luna SA partition.
vtl createcert, to create a client certificate. The Luna SA should already have a server certificate.lunacm:> session, choose an HSM
Partition, and type:The partition backup restore command in this instance sees a locally-connected backup device as one slot, and sees the distant Luna SA HSM's partition as another "local" slot, because of the NTLS link between the client workstation and the partition.
Note that in the command above, you could have used -add instead of -replace.
On restore, you may add to existing HSM Partition contents or replace them. Adding might result in unwanted behaviors, such as having two keys with the same label, if one existed in the HSM Partition and one on the backup token. The two would be assigned different handles, however.
For each additional restore to a partition on that distant Luna SA, you have already exchanged the certificates, but you must register each partition and your client workstation with each other, before each partition can appear as a slot in lunacm.