These instructions assume that you have already acquired the LunaClient software, either on CD/DVD or in the form of a downloaded .tar archive.
Applicability to specific versions of HP-UX is summarized in the Customer Release Notes for the current release.
Before installing a Luna® system, you should confirm that the product you have received is in factory condition and has not been tampered with in transit. Refer to the Content Sheet included with your product shipment. If you have any questions about the condition of the product that you have received, please contact SafeNet Support (800)545 6608 or support@safenet-inc.com immediately
Each computer that connects to the Luna HSM appliance as a Client must have the
cryptoki library, the vtl client shell and other utilities and supporting
files installed.
Each computer that contains, or is connected to a Luna G5 or a Luna PCI-E HSM must have the cryptoki library and other utilities and supporting files installed.
This example shows all the LunaClient products and components. Some items are not supported on all operating systems and therefore do not appear as you proceed through the installation script.
Do NOT install LunaClient software
on the same system as legacy Luna CA3, Luna CA4, Luna PCM, or Luna PCI software.
The software is intended for modern/current Luna HSMs, Luna SA, Luna PCI-E, Luna G5, Luna (Remote) Backup HSM.
Before starting the installation, ensure that you have satisfied the following prerequisites:
Check the Luna HSM Customer Release Notes for any installation-related issues or instructions before you begin the following software installation process.
You must be logged in as root when you run the installation script.
Install Luna Client software on HP-UX as follows.
By default, the Client programs are installed in the “/opt/safenet/lunaclient” directory.
As a general rule, do not modify the Chrystoki.conf/crystoki.ini
file, unless directed to do so by SafeNet Customer Support.
If you do modify the file, never insert TAB characters - use individual
space characters.
Avoid modifying the PED timeout settings. These are now hardcoded in the appliance,
but the numbers in the Chrystoki.conf file must match.
Crypto Command Center depends on lunacm. If Crypto Command Center is installed on the client, you must uninstall Crypto Command Center before you can uninstall the Luna client, otherwise a dependency error is displayed and the Luna client is not successfully uninstalled. See the Crypto Command Center un-installation instructions.
During the installation, the script provides the opportunity to install Luna Java components. If you select Java components, the Luna Java files are installed below/opt/safenet/lunaclient/jsp/. In order to use Java, you must have separately installed Java (JDK or run-time environment from the vendor of your choice) onto your system.
Copy the Luna Java library and jar files from their default location under /opt/safenet/lunaclient/jsp/lib to the Java environment directory; example
/opt/jre/lib/ext
The exact directory might differ depending on where you obtained your Java system, the version, and any choices that you made while installing and configuring it.
For additional Java-related information, See "Java".
You would choose static registration of providers if you want all applications to default to our (SafeNet) provider.
Once your client has externally logged in using salogin (see "Login from a Client to your Luna HSM (optional)" ) in the Reference section of this document) or your own HSM-aware utility, any application would be able to use Luna product without being designed to login to the HSM Partition.
Edit the java.security file located in the \jre\lib\security directory of your Java SDK/JRE 1.6.x or 1.7.x installation to read as follows:
security.provider.1=sun.security.provider.Sun
security.provider.2=com.sun.net.ssl.internal.ssl.Provider
security.provider.3=com.safenetinc.luna.provider.LunaProvider
security.provider.4=com.sun.rsajca.Provider
security.provider.5=com.sun.crypto.provider.SunJCE
security.provider.6=sun.security.jgss.SunProvider
You can set our provider in first position for efficiency if Luna HSM operations are your primary mode. However, if your application needs to perform operations not supported by the LunaProvider (secure random generation or random publickey verification, for example) then it would receive error messages from the HSM and would need to handle those gracefully before resorting to providers further down the list. We have found that having our provider in third position works well for most applications.
The modifications in the "java.security" file are global, and they might result in the breaking of another application that uses the default KeyPairGenerator without logging into the Luna SA first. This consideration might argue for using dynamic registration, instead.
For your situation, you may prefer to employ dynamic registration of Providers, in order to avoid possible negative impacts on other applications running on the same machine. As well, the use of dynamic registration allows you to keep installation as straightforward as possible for your customers.
We formally test Luna HSMs and our Java provider with SUN JDK for all platforms except AIX, and with IBM JDK for the AIX platform. We have not had problems with OpenJDK, although it has not been part of our formal test suite. The Luna JCE provider is compliant with the JCE specification, and should work with any JVM that implements the Java language specification.
Occasional problems have been encountered with respect to IBM JSSE.
GNU JDK shipped with most Linux systems has historically been incomplete and not suitable.
To uninstall the JSP component or the SDK component, you must uninstall LunaClient completely, then re-run the installation script without selecting the unwanted component(s).
sh uninstall.sh
Do not interrupt the installation script in progress, and ensure that your host computer is served by an uninterruptible power supply (UPS). If you press [Ctrl] [C], or otherwise interrupt the installation (OS problem, power outage, other), some components will not be installed. It is not possible to resume an interrupted install process. The result of an interruption depends on where, in the process, the interruption occurred (what remained to install before the process was stopped).
As long as the cryptoki RPM package is installed, any subsequent installation attempt results in refusal with the message "A version of Luna Client is already installed."
If components are missing or are not working properly after an interrupted installation, or if you wish to install any additional components at a later date (following an interrupted installation, as described), you would need to uninstall everything first. If ‘sh uninstall.sh’ is unable to do it, then you must uninstall all packages manually.
Because interruption of the install.sh script is not recommended, and mitigation is possible, this is considered a low-likelihood corner case, fully addressed by these comments.
When you have installed the software onto a Client, the next task is to configure the Luna appliance and HSM.
For Luna SA, go to "Recommended Network Characteristics" .