|
Home > |
|---|
Initialize the HSM ( K6 key card) in the SafeNet HSM Server. Initialization assigns an HSM label, creates or associates Security Officer (SO) or HSM Admin authentication for the HSM, creates or associates a Cloning Domain (with authentication) for the HSM, and applies other settings that make the HSM available for use.
CAUTION: Initializing the HSM erases all existing data on the key card, including all HSM Partitions and their data. HSM Partitions then must be recreated with the partition create command. Because this is a destructive command, the user is asked to “proceed” unless the -force switch is provided at the command line.
CAUTION: Invoking the hsm init command results in the HSM Admin being logged out, and all partitions being deactivated. These preparatory actions take place before the warning prompt appears, with its request for you to type "Proceed" or "Quit". That is, if you invoke hsm init and then type quit at the prompt, initialization does not take place (meaning that you do not lose existing token/HSM contents), but any current login or activation state is closed, whether you abort the command or not.
For more information, see Initialization Overview for PED-authenticated HSMsin the Administration Guide.
hsm init -label <hsm_label> [-domain <hsm_domain>] [-password <hsm_admin_password>] [-defaultdomain] [-authtimeconfig] [-force]
|
Parameter |
Shortcut |
Description |
|---|---|---|
| -authtimeconfig | -a |
Specifies that the SO role must be logged in to configure the time. |
| -defaultdomain | -de | This option is deprecated. The current and future HSM versions do not allow you to omit providing a domain, unless you include this "-defaultdomain" option, which is an insecure choice and generally not recommended. It is retained for benefit of existing customers who have previously set the default domain, and are constrained to continue with it until they create new objects on an HSM with a proper domain. The "-defaultdomain" option applies to Password-authenticated HSMs only. For PED-authenticated HSMs the PED always prompts for a physical PED Key and either reuses the value on the key that you insert, or generates a new value and imprints it on the PED Key. |
| -domain | -do |
Specifies the string to be used as key cloning domain for the HSM. If no value is given for a SafeNet HSM with Password Authentication, you are prompted interactively. The HSM must support cloning, or this value is ignored. This parameter is considered mandatory in password-authenticated HSMs (except if the discouraged and deprecated -defaultdomain is specified). The -domain parameter is ignored in PED-authenticated HSMs. |
| -force | -f |
Force the action without prompting. |
| -label | -l |
Specifies the label to assign to the HSM. The label has a maximum length of 32 characters. Any data input over 32 characters is truncated. |
| -password | -p |
Specifies the password to be used as login credential by the HSM Admin. For PED-authenticated HSMs, the SafeNet PED is used for the HSM Admin PIN/password, and data input for this value is ignored. This parameter is required in password-authenticated HSMs. It is ignored in PED-authenticated HSMs. |
If the HSM has been factory reset, then a complete "hard" initialization is performed when you invoke the hsm init command.
lunash:> hsm init -label myluna
CAUTION: Are you sure you wish to re-initialize this HSM?
All partitions and data will be erased.
Type 'proceed' to initialize the HSM, or 'quit' to quit now.
> proceed
Luna PED operation required to initialize HSM - use Security Officer (blue) PED Key
Luna PED operation required to login as HSM Administrator - use Security Officer (blue) PED Key
Luna PED operation required to generate cloning domain - use Domain (red) PED Key
'hsm init successful'
Command result : 0 (Success)
lunash:>
If the HSM is NOT in factory reset condition when you invoke the hsm init command, then a "soft" initialization is performed - while the partitions and contents are destroyed, the Security officer/HSM Administrator identity and the Domain are preserved. The SO must be logged into the HSM to run HSM init when the HSM is not in factory reset condition.
lunash:> hsm init -label myluna CAUTION: Are you sure you wish to re-initialize this HSM? All partitions and data will be erased. Type 'proceed' to initialize the HSM, or 'quit' to quit now. > proceed Luna PED operation required to initialize HSM - use Security Officer (blue) PED Key 'hsm -init successful' Command result : 0 (Success)
lunash:> hsm init -label “new hsm” -sopw somepin -domain newdomain
CAUTION: Are you sure you wish to re-initialize this HSM?
All partitions and data will be erased.
Type 'proceed' to initialize the HSM, or 'quit' to quit now.
> proceed
'hsm init successful'