The SAFENET-HSM-MIB defines HSM status information and HSM Partition information that can be viewed via SNMP.
To access tables, use a command like:
snmptable -a SHA -A snmppass -u snmpuser -x AES -X snmppass -l authPriv -v 3 172.20.11.59 SAFENET-HSM-MIB::hsmTable
The information is defined in tables, as follows:
- This table provides a list of all the HSM information on the managed element.
| Item | Type | Description | Values |
|---|---|---|---|
|
hsmSerialNumber |
DisplayString | serial number of the HSM - used as an index into the tables. | -- from factory |
| hsmFirmwareVersion | DisplayString | version of firmware executing on the HSM | -- as found |
| hsmLabel | DisplayString | label associated with the HSM | provided by SO at init time |
| hsmModel | DisplayString | model identifier for the HSM | -- from factory |
| hsmAuthenticationMethod | INTEGER | authentication mode of the HSM | unknown(1), -- not known
password(2), -- requires passwords pedKeys(3) -- requires PED |
| hsmRpvInitialized | INTEGER | remote ped vector initialized flag of the HSM | notSupported(1), -- rpv not supported
uninitialized(2), -- rpv not initialized initialized(3) -- rpv initialized |
| hsmFipsMode | TruthValue | FIPS 140-2 operation mode enabled flag of the HSM | -- factory set |
| hsmPerformance | INTEGER | performance level of the HSM | |
| hsmStorageTotalBytes | Unsigned32 | total storage capacity in bytes of the HSM | -- factory set |
| hsmStorageAllocatedBytes | Unsigned32 | number of allocated bytes on the HSM | -- calculated |
| hsmStorageAvailableBytes | Unsigned32 | number of available bytes on the HSM | -- calculated |
| hsmMaximumPartitions | Unsigned32 | maximum number of partitions allowed on the HSM | 2, 5, 10, 15, or 20, per license |
| hsmPartitionsCreated | Unsigned32 | number of partitions created on the HSM | -- as found |
| hsmPartitionsFree | Unsigned32 | number of partitions that can still be created on the HSM | -- calculated |
| hsmBackupProtocol | INTEGER | backup protocol used on the HSM | unknown(1),
none(2), cloning(3), keyExport(4) |
| hsmAdminLoginAttempts | Counter32 | number of failed Administrator login attempts left before HSM zeroized | -- as found, calculated |
| hsmAuditRoleInitialized | INTEGER | audit role is initialized flag | notSupported(0),
yes(1), no(2) |
| hsmManuallyZeroized | TruthValue | was HSM manually zeroized flag | -- as found |
| hsmUpTime | Counter64 | up time in seconds since last HSM reset | -- counted |
| hsmBusyTime | Counter64 | busy time in seconds since the last HSM reset | -- calculated |
| hsmCommandCount | Counter64 | HSM commands processed since last HSM reset | -- counted |
- This table provides a list of all the partition information on the managed element.
| Item | Type | Description | Values |
|---|---|---|---|
| hsmPartitionSerialNumber | DisplayString | serial number for the partition | -- generated |
| hsmPartitionLabel | DisplayString | label assigned to the partition | -- provided at partition creation |
| hsmPartitionActivated | TruthValue | partition activation flag | -- set by policy |
| hsmPartitionStorageTotalBytes | Unsigned32 | total storage capacity in bytes of the partition | -- set or calculated at partition creation or re-size |
| hsmPartitionStorageAllocatedBytes | Unsigned32 | number of allocated (in use) bytes on the partition | -- calculated |
| hsmPartitionStorageAvailableBytes | Unsigned32 | number of avalailable (unused) bytes on the partition | -- calculated |
| hsmPartitionObjectCount | Unsigned32 | number of objects in the partition | -- counted |
- This table provides a list of all the license information on the managed element. More than one HSM might be connected to a Host, so they are accessed with two indices; the first index identifies the HSM for which the license entry corresponds (hsmSerialNumber), the second is the index for the corresponding license (hsmLicenseID).
| Item | Type | Description | Values |
|---|---|---|---|
| hsmLicenseID | DisplayString | license identifier | -- set at factory or at capability update |
| hsmLicenseDescription | DisplayString | license description | -- set at factory or at capability update |
- This table provides a list of all the HSM policy information on the managed element.
| Item | Type | Description | Values |
|---|---|---|---|
| hsmPolicyType | INTEGER | type of policy | capability(1),
policy(2) |
| hsmPolicyID | Unsigned32 | policy identifier | numeric value identifies policy and is used as a index into the policy table |
| hsmPolicyDescription | DisplayString | description of the policy | brief text description of what the policy does |
| hsmPolicyValue | DisplayString | current value of the policy | brief text description to show current state/value of policy |
- This table provides a list of all the partition policy information on the managed element.
| Item | Type | Description | Values |
|---|---|---|---|
| hsmPartitionPolicyType | INTEGER | capability or policy | capability(1),
policy(2) |
| hsmPartitionPolicyID | Unsigned32 | policy identifier | numeric value identifies policy and is used as a index into the policy table |
| hsmPartitionPolicyDescription | DisplayString | description of the policy | brief text description of what the policy does |
| hsmPartitionPolicyValue | DisplayString | current value of the policy | brief text description to show current state/value of policy |
- This table provides a list of registered clients.
| Item | Type | Description | Values |
|---|---|---|---|
| hsmClientName | DisplayString | name of the client | name provided on client cert |
| hsmClientAddress | DisplayString | address of the client | IP address of the client |
| hsmClientRequiresHTL | TruthValue | flag specifying if HTL required for the client | flag set at HSM host side to control client access |
| hsmClientOTTExpiry | INTEGER | OTT expiry time (-1 if not provisioned) | expiry time, in seconds, for HTL OneTimeToken (range is 0-3600); -1 indicates not provisioned, 0 means never expires |
- This table provides a list of assigned partitions for a given client.
| Item | Type | Description | Values |
|---|---|---|---|
| hsmClientHsmSerialNumber | DisplayString | index into the HSM table | -- |
| hsmClientPartitionSerialNumber DisplayString | DisplayString | index into the Partition Table | -- |
For comparison, the following shows lunacm or lunash command outputs that provide HSM information equivalent to the SNMP information depicted in the tables above (from the HSM MIB).
At the HSM level the information in the outputs of "hsm show" and "hsm showp" and "hsm di" includes the following :
Description Value =========== ===== Enable PIN-based authentication Allowed Enable PED-based authentication Disallowed Performance level 15 Enable domestic mechanisms & key sizes Allowed Enable masking Disallowed Enable cloning Allowed Enable special cloning certificate Disallowed Enable full (non-backup) functionality Allowed Enable non-FIPS algorithms Allowed Enable SO reset of partition PIN Allowed Enable network replication Allowed Enable Korean Algorithms Allowed FIPS evaluated Disallowed Manufacturing Token Disallowed Enable Remote Authentication Allowed Enable forcing user PIN change Allowed Enable portable masking key Allowed Enable partition groups Disallowed Enable remote PED usage Disallowed Enable External Storage of MTK Split Disallowed HSM non-volatile storage space 2097152 Enable HA mode CGX Disallowed Enable Acceleration Allowed Enable unmasking Allowed Enable FW5 compatibility mode Disallowed Unsupported Disallowed Unsupported Disallowed Enable ECIES support Disallowed The following policies are set due to current configuration of this HSM and cannot be altered directly by the user. Description Value =========== ===== PIN-based authentication True The following policies describe the current configuration of this HSM and may by changed by the HSM Administrator. Changing policies marked "destructive" will zeroize (erase completely) the entire HSM. Description Value Code Destructive =========== ===== ==== =========== Allow cloning On 7 Yes Allow non-FIPS algorithms On 12 Yes SO can reset partition PIN On 15 Yes Allow network replication On 16 No Allow Remote Authentication On 20 Yes Force user PIN change after set/reset Off 21 No Allow offboard storage On 22 Yes Allow Acceleration On 29 Yes Allow unmasking On 30 Yes
At the HSM Partition level the information in the outputs of"partition show" and "partition showp" includes the following :
lunash:> partition showPolicies -partition mypartition
Partition Name: mypartition
Partition Num: 65038002
The following capabilities describe this partition and can never be changed. Description Value =========== ===== Enable private key cloning Allowed Enable private key wrapping Disallowed Enable private key unwrapping Allowed Enable private key masking Disallowed Enable secret key cloning Allowed Enable secret key wrapping Allowed Enable secret key unwrapping Allowed Enable secret key masking Disallowed Enable multipurpose keys Allowed Enable changing key attributes Allowed Enable PED use without challenge Allowed Allow failed challenge responses Allowed Enable operation without RSA blinding Allowed Enable signing with non-local keys Allowed Enable raw RSA operations Allowed Max failed user logins allowed 10 Enable high availability recovery Allowed Enable activation Allowed Enable auto-activation Allowed Minimum pin length (inverted: 255 - min) 248 Maximum pin length 255 Enable Key Management Functions Allowed Enable RSA signing without confirmation Allowed Enable Remote Authentication Allowed Enable private key unmasking Allowed Enable secret key unmasking Allowed Enable RSA PKCS mechanism Allowed Enable CBC-PAD (un)wrap keys of any size Allowed The following policies are set due to current configuration of this partition and may not be altered directly by the user. Description Value =========== ===== Challenge for authentication not needed False The following policies describe the current configuration of this partition and may be changed by the HSM Administrator. Description Value Code =========== ===== ==== Allow private key cloning On 0 Allow private key unwrapping On 2 Allow secret key cloning On 4 Allow secret key wrapping On 5 Allow secret key unwrapping On 6 Allow multipurpose keys On 10 Allow changing key attributes On 11 Ignore failed challenge responses On 15 Operate without RSA blinding On 16 Allow signing with non-local keys On 17 Allow raw RSA operations On 18 Max failed user logins allowed 10 20 Allow high availability recovery On 21 Allow activation Off 22 Allow auto-activation Off 23 Minimum pin length (inverted: 255 - min) 248 25 Maximum pin length 255 26 Allow Key Management Functions On 28 Perform RSA signing without confirmation On 29 Allow Remote Authentication On 30 Allow private key unmasking On 31 Allow secret key unmasking On 32 Allow RSA PKCS mechanism On 33 Allow CBC-PAD (un)wrap keys of any size On 34
Command Result : 0 (Success)
[myluna] lunash:>