Enabling or Disabling STC on the HSM

The STC functionality is enabled or disabled by setting HSM policy 39: Allow Secure Trusted Channel (see HSM Capabilities and Policies). The following instructions are for the HSM SO.

NOTE   Enabling HSM policy 39: Allow Secure Trusted Channel allows the appliance to use STC or NTLS links between the appliance and its registered partitions. It does not enable STC on the link between the appliance and the HSM (the STC admin channel). If you want to use STC end-to-end (client to HSM) then you must also enable the STC admin channel. See Establishing and Configuring the STC Admin Channel on a SafeNet Luna Network HSM Appliance for more information.

Enabling STC on the HSM

You can enable STC on the HSM by turning on HSM policy 39: Allow Secure Trusted Channel. Enabling HSM policy 39 allows you to use STC or NTLS to provide the network link between an application partition and a client application. To use STC on a partition, you must also enable STC on the partition by turning on partition policy 37: Force Secure Trusted Channel. See Enabling or Disabling STC on a Partition.

NOTE   If you do not plan to use STC in your appliance configuration, do not enable HSM policy 39.

NOTE   STC links are not supported over an IPv6 network. You must use NTLS to make partition-client connections via IPv6.

When you enable HSM policy 39: Allow Secure Trusted Channel, the following LunaSH STC commands are blocked, to protect the integrity of any existing STC links:

>hsm stc identity create

>hsm stc identity initialize

>hsm stc identity delete

>hsm stc identity partition deregister

NOTE   HSM zeroization disables partition policy 39: Allow Secure Trusted Channel. After zeroization, you will need to re-establish your STC links, as described in Restoring STC After HSM Zeroization and in Creating an STC Link Between a Client and a Partition in the Configuration Guide.

To enable STC on the HSM

1.Login as HSM SO.

lunash:>hsm login

2.Turn on HSM policy 39: Allow Secure Trusted Channel, which enables STC on the HSM. Enabling the policy is non-destructive.

lunash:>hsm changepolicy -policy 39 -value 1

3.Verify that the policy is enabled:

lunash:>hsm showpolicies

For example:

lunash:>hsm showpolicies

.

Description                       Value       Code      Destructive

.

Allow MofN                        On          37        No

Allow Secure Trusted Channel      On          39        No

Allow partition re-initialize     Off         42        No

Command Result : 0 (Success)

4.(Optional) Enable the STC admin channel, as described in Establishing and Configuring the STC Admin Channel on a SafeNet Luna Network HSM Appliance.

Disabling STC on the HSM

You can disable STC on the HSM by turning off HSM policy 39: Allow Secure Trusted Channel. Disabling this policy is destructive. It zeroizes the HSM and turns off the ability to use STC to provide the network link between an application partition and a client application, so that only NTLS links are permitted.

To disable STC on the HSM:

1.Login as HSM SO.

lunash:>hsm login

2.Turn off HSM policy 39: Allow Secure Trusted Channel, which disables STC on the HSM and zeroizes the HSM.

lunash:>hsm changepolicy -policy 39 -value 0

You are prompted to confirm the action.

3.Verify that the policy is disabled:

lunash:>hsm showpolicies

lunash:>hsm showpolicies

.

Description                       Value       Code      Destructive

.

Allow MofN                        On          37        No

Allow Secure Trusted Channel      Off         39        No

Allow partition re-initialize     Off         42        No

Command Result : 0 (Success)