DOC: PKI-bundle is not explained with a current step-by-step procedure

http://172.20.18.90/LunaSA/6.0/#sa_appliance_admin/pki_bundle.htm

DOC: PKI bundle, we only support PED auth SA with PED G5

Changed two pages to remove all mention of "password":
http://172.20.18.90/LunaSA/6.0/#lunash/commands/token/token_pki.htm

http://172.20.18.90/LunaSA/6.0/#lunash/commands/token/token_pki_update_login.htm

DOC - salogin missing remote ped information (-r)

added line for "-r" parameter to table at
http://172.20.18.90/LunaSA/6.0/#Utilities/salogin/integrating_the_hsm_with_your_applications.htm

LHSM-14625

Note:  Formerly, when a capability had been applied, it no longer appeared in the list.
This changed with release 6.0 and firmware 6.22.0, to accommodate firmware rollback, which can remove any capabilities that were not applied in earlier firmware, or that are not supported by earlier firmware.

After rollback or update, the system retains the full list that you had purchased, allowing you to re-install where appropriate.

DOC: G5 PKI Bundles 6.2.3 does not work on SA6 through remote PED

(Changed/added some text snippets. related to LHSM-14534)

Doc : Ha sync command causes lunacm to crash in HA only mode

This was not originally a doc issue. The doc requirement is due to a side effect, described in this note that was added to the "hagroup haonly" topic and the "slot list" topic.
" NOTE: This command acts on your applications, either allowing (default) or disallowing (hagroup haonly -enable) the application to see individual HSM partition slots or just the HA group virtual slot, respectively. The command has no effect on administrative tools like lunacm, where a "slot list" returns all slots, both actual and virtual. "

http://172.20.18.90/LunaSA/6.0/#lunacm/commands/hagroup/hagroup_haonly.htm

DOC: Connecting to PED G5 attached to PW SA (PKI bundle)

(Changed/added some text snippets. related to LHSM-14560)

DOC: sysconf config factoryreset breaks ntls/stc service to not start

Originally a dev issue that turned into a DOC issue.

DOC: add "hsm zeroize" command and revise "hsm factoryreset" command

Tester wanted greater clarity around behaviour of the two commands against old f/w and 6.22.0 f/w.

Misleading msg on sysconf hwregencert for ntls keys in hardware

See my comment in the Jira issue. No separate DOC issue at this time (2015/01/28)

"hsm zeroize" warning is the same as "hsm factoryreset" warning on 6.22.0

Created a new section "Security Effects of Administrative Actions" and a page "Summary of Outcomes of Security-affecting Actions", containing the table from Wayne's table document (minus the final row and the comment saying to not include the final row...)

ShowAdminTokens set to 0 still showing admin token

Tester was misled by cut-and-paste text in http://172.20.18.90/LunaSA/6.0/#administration/slot_numbering.htm
Corrected text in docs according to comment by Eddie M.

DOC: documentation is missing description of how authentication passwords are protected

fixed on http://172.20.18.90/LunaSA/6.0/#overview/security_features/hsm_general_authentication_model.htm

Config file setting OneBaseSlotId= should be in [Presentation] section

The DOC component of this was to change from [Misc] to [Presentation] in
http://172.20.18.90/LunaSA/6.0/#administration/slot_numbering.htm

DOC: Lunacm "hsm information monitor" cmd missing from customer docs

(It was actually called "hsm monitor" in lunacm - "hsm information..." is the lunash version. The command page, which has always existed, was not picked up when LunaCM Command Reference Guide was created. Now corrected and available in the docs output. )

DOC: CLONE - Changes to RSA Key Generation Mechanisms

Create a new topic in the SDK > Mechanisms section, to account for the action of the new setting "RSAKeyGenMechRemap=" in the [Misc] section of the chrystoki.conf/crystoki.ini file, to address changes in which key-gen mechanisms are valid for FIPS. (FIPS 186-3/4)

Luna PCI 5.5: PED Admin login does warn of remaining login attempts anymore

This was fixed in dev, and they wanted mention in the docs.

Also, the role command and output are new for f/w 6.22.0 and PPSO.
An example of bad-login response was added at the bottom of LunaCM "role login" command page.

Document procedure for applying an advanced config upgrade

This was opened by mistake, as the required text already existed. It is recorded here because it took time, effort, and e-mails to verify and communicate the situation.

DOC: "sysconf ssh publickey" sub-commands are deprecated from lush

Commented in the issue that the commands were removed, not deprecated.

Added this NOTE to the sysconf_ssh_publickey.htm page:
NOTE: The former commands to manage SSH publickeys have been removed
sysconf ssh publickey add   
sysconf ssh publickey list  
sysconf ssh publickey delete  
sysconf ssh publickey clear

Those functions are now covered by equivalent commands:
my public-key add   (See "my public-key add")   
my public-key clear  (See "my public-key clear")   
my public-key delete   (See "my public-key delete")   
my public-key list  (See "my public-key list")   

Added this NOTE to the my_public-key pages:
NOTE: The my public-key commands manage the existence of the public keys for use by ssh sessions, but the commands to enable and disable their use on Luna SA are still at:   
"sysconf ssh publickey enable"   
and   
"sysconf ssh publickey disable"  

DOC: Replace old ped-message graphics with refined versions
Create a template document describing how to create edit the new ped-message graphics in case edits/additions are required in future.

Closed

DOC: add "how to switch off SFF Backup"

Added the following text to http://172.20.18.90/LunaSA/6.0/#administration/backup/sff/small_form_backup_about.htm
To Switch Off Small Form-Factor Backup

If you have concerns about the physical security of your HSMs, and wish to ensure that sensitive application partition contents cannot be backed-up onto a very portable, concealable SFF token, then simply do not purchase or apply a Small Form-Factor capability update for that HSM.

If the SFF Capability Update has been installed, and for any reason you wish to disable the ability to backup HSM content, or application partition objects, to a Small Form-Factor device, simply disable HSM Policy 38.

On Luna SA, run command

lunash:>hsm changepolicy -policy 38 -value 0

On Luna PCI-E or Luna G5, run command

lunacm:>hsm changehsmpolicy -policy 38 -value 0

The change is HSM-wide and is destructive, meaning that HSM contents and partitions are lost. Re-initialization is required, and lost objects must be re-created or must be restored from a Luna Backup HSM or by synchronization in an HA group.

DOC: Add default retries and interval to HA-related docs

NOTE: added a snippet to the lunacm hagroup retry commands and the HA section of SDK

DOC: change all references to HSO back to SO

Early in the project, it was projected that we would call the owner of per-partition-SO partitions the Token Security Officer, or TSO. Since the term SO was in use all over, it was decided to call the HSM SO the HSO, to differentiate the two, where necessary. Later, after hundreds of instances were changed in the docs, it was decided to go with "Application Partition Security Officer" and "HSM Administrator / SO". After a couple of runs of Find and Replace, no further instances of "HSO" or "TSO" are reported.

DOC: htl config instructions for UNIX not mentioned

Issue was raised by Kevin and fixed in the initial scope.
Joe then rearranged content between Configuration and Administration documents and generally improved the presentation.

DOC: Update Luna HSM docs topic "user_accounts_and_privileges.htm"

http://172.20.18.90/LunaSA/6.0/#overview/security_features/user_accounts_and_privileges.htm

DOC: Presentation setting of ShowAdminSlots = no renders PCI/G5 unusable

The fix was to add the following command:

Note: NO COMMANDS - LunaCM depends on the availability of HSM partitions, in order to be useful. If no application partition has been created, then only the HSM SO (administrative) partition is available, against which to run commands.

If the Chrystoki.conf / Crystoki.ini configuration file [Presentation] setting "ShowAdminSlots=" is set to no, then the HSM administrative partition/slot is also unavailable, and LunaCM is not usable. If you know you have a working Luna PCI-E or Luna G5 HSM attached to your LunaClient computer and LunaCM shows no usable commands, then verify in your Chrystoki.conf or Crystoki.ini file that "ShowAdminTokens" is not set to "no".

to   http://172.20.18.90/LunaSA/6.0/#lunacm/using/accessing.htm   

Role login for users with spaces only accepts double quotes

This issue was later closed, but the following text was added to http://172.20.18.90/LunaSA/6.0/#lunacm/using/lunacm_features.htm anyway:

Quotation Marks

It might happen that a command parameter consists of two or more parts, separated by spaces. This can be misconstrued by the command parser as two (or more) additional parameters. To ensure that a multi-part parameter is parsed as a single entity, enclose it in quotation marks " ".

Lush command "par show" displays different S/N after F/W upgraded to 6.22.0

(Update: this was later fixed, so existing serial numbers are preserved through upgrade, to avoid breaking HA. A page "Serial Number Handling" was added to the docs to explain the situation.)

DOC - 5.3 Client: all tools not work in the case of 32bits lib used on windows 64bits OS

(Added examples of tools/commands that would change the crystoki.ini file or the contents of the cert folders in the 64-bit Windows LunaClient install, that would need to be replicated to the customer's 32-bit area that they were using with 32-bit library for their 32-bit apps on 64-bit Windows. )