Configuring a Remote Backup HSM Server

In this configuration, The SafeNet Luna Backup HSM is connected to a remote client workstation that communicates with the SafeNet Luna PCIe HSM host via the Remote Backup Service (RBS). It is useful in deployments where backups are stored in a separate location from the SafeNet Luna PCIe HSM, to protect against catastrophic loss (fire, flood, etc).

RBS is a utility, included with the SafeNet Luna HSM Client software, that runs on a workstation hosting one or more Backup HSMs. When RBS is configured and running, other clients or HSMs registered to it can see its Backup HSM(s) as slots in LunaCM.

Installing/Configuring the Remote Backup Service

RBS is installed using the SafeNet Luna HSM Client installer. You must create a certificate for the RBS workstation and register it on all clients/appliances that will use the remote Backup HSMs. These instructions will allow you to install and configure RBS.

Prerequisites

>On any SafeNet Luna PCIe HSM host workstation, install the following Luna HSM Client components (see SafeNet Luna HSM Client Software Installation):

•Network : The Network component includes utilities that are required for remote backups; install this in addition to the PCIe components.

•Remote PED: if you are backing up PED-authenticated partitions

>Install the SafeNet Luna Backup HSM(s) at the workstation that will host RBS (see Installing the Backup HSM).

>[PED Authentication] Initialize the remote PED vector for each Backup HSM. You will need the orange PED key for backup/restore operations (see Initializing the Backup HSM Remote PED Vector).

To install and configure RBS

1.On the workstation hosting the Backup HSM(s), install the Backup component of the Luna HSM Client (see SafeNet Luna HSM Client Software Installation). If this workstation will also host a Remote PED, install the Remote PED component as well (Windows only).

2.Navigate to the Luna HSM Client home directory (/usr/safenet/lunaclient/rbs/bin on Linux/Unix) and generate a certificate for the RBS host.

> rbs --genkey

You are prompted to enter and confirm an RBS password. The certificate is generated in:

•Linux/UNIX: <LunaClient_install_directory>/rbs/server/server.pem

•Windows: <LunaClient_install_directory>\cert\server\server.pem

3.Specify the Backup HSM(s) that RBS will make available to clients.

> rbs --config

RBS displays a list of Backup HSMs currently connected to the workstation. Select the ones you want to provide remote backup services. When you have specified your selection, enter X to exit the configuration tool.

4.Launch the RBS daemon (Linux/UNIX) or console application (Windows).

•Linux/UNIX: # rbs --daemon

•Windows: Double-click the rbs application. A console window will remain open.

You are prompted to enter the RBS password.

5.Securely transfer the RBS host certificate (server.pem) to your SafeNet Luna PCIe HSM host workstation (SCP and PSCP).

6.On the SafeNet Luna PCIe HSM host workstation, register the RBS host certificate to the server list.

> vtl addServer -n <Backup_host_IP> -c server.pem

7.[Optional] Launch LunaCM on the client to confirm that the Backup HSM appears as an available slot.

NOTE   If you encounter issues, try changing the RBS and PEDclient ports from their default values. Check that your firewall is not blocking ports used by the service.

You can now use the Backup HSM(s) as though they were connected to the SafeNet Luna PCIe HSM host workstation locally, using Remote PED. See Backup/Restore Using a Host-Connected Backup HSM for procedures.