Luna Appliance Software 7.7.1
Luna Appliance Software 7.7.1 was released in April 2021.
>Download Luna Appliance Software 7.7.1 (includes firmware update to Luna HSM Firmware 7.7.1)
This version also includes Luna Backup HSM 7 Firmware 7.7.1 ready to install (see Updating the Appliance-Connected Luna Backup HSM 7 Firmware).
New Features and Enhancements
Luna Appliance Software 7.7.1 includes the following new features and enhancements:
Network HSM admin can initialize partitions using LunaSH
Luna Shell (LunaSH) on the Luna Network HSM 7 appliance now includes partition init and partition init co commands to initialize a new partition with a Partition Security Officer (PO) identity and a partition Crypto Officer (CO). This addresses situations where the HSM administrator is also the partition owner, and it is convenient to hand off a ready-configured partition for client-side use in LunaCM and applications.
Allowlisting of permitted IP addresses for SSH access to the Luna Network HSM 7 appliance
Configure and manage SSH access control at the Luna Network HSM 7 appliance, by creating an allowlist of IP addresses that are permitted to connect to a specified appliance userid via SSH. The sysconf ssh client commands are optional, and can be used to apply an additional layer in your network security.
REST API 10 supports use of third-party certificates
REST API 10.0.0 for Luna Network HSM 7 now allows you to use client certificates signed by a trusted Certificate Authority (CA), which can be a commercial third-party CA or your organization's own signing station. See REST API References.
REST API provides additional capabilities previously available only in LunaSH
REST API 10.0.0 for Luna Network HSM 7 adds equivalents for the LunaSH token backup commands, sysconf config commands, and any status commands and ntls commands not previously included.
SSH inactivity timeout
SSH sessions timeout after 30 minutes of inactivity.
SHA1 ciphers are disabled for SSH
For security reasons, the Luna Network HSM 7 appliance no longer allows a calling system to negotiate down to SHA1 ciphers when setting up SSH sessions.
Mandatory password while creating a LunaSH user
Creation of a user in LunaSH now requires setting an initial password that meets Linux password standards, rather than setting a known disposable value.
Valid Update Paths
You can update the Luna Network HSM 7 appliance software to version 7.7.1 from the following previous versions:
>7.0.0, 7.1.0, 7.2.0, 7.2.2, 7.3.0, 7.3.1, 7.3.3, 7.3.4, 7.4.0, 7.4.1, 7.4.2, 7.7.0
Advisory Notes
This section highlights important issues you should be aware of before deploying appliance software 7.7.1.
Change in Network Routing Default Requires Precaution Before Update
A change to network routing when updating to Luna Appliance Software 7.7.0 or newer, from any prior 7.x version, can cause your appliance to become unreachable via network connection. Older appliance versions permitted the existence of multiple default routes. Beginning with Luna Appliance Software 7.7.0, only one instance of the default route can exist.
Options for a successful update with minimal disruption are:
>Remove all but one instance of the ‘default route’, using the network route delete command, before upgrading from any appliance software version older than Luna Appliance Software 7.7.0.
>Connect locally via serial cable to perform the update, so your access to the network appliance is not lost when network connection becomes temporarily unavailable (pending proper network configuration).
Note also that if you re-image, going back to a version older than Luna Appliance Software 7.7.0, the routing table goes back to the old format and you must apply one of the above precautions again, to update.
If the above precautions are not taken and the appliance becomes unreachable, complete the following steps to restore connection to the appliance:
1.Connect locally via serial cable.
2.Delete all network interfaces. See network interface delete.
3.Configure a network interface to use a default route by doing one of the following:
•Configure the network interface to use a static IP configuration while specifying the -gateway option. See network interface static.
•Configure the network interface to use DHCP. See network interface dhcp.
After you complete the above steps, network connectivity to the appliance is restored and any remaining interfaces that are configured do not have a default route set.
Luna Network HSM 7 Reboot Patch is a Prerequisite For Older Appliances
The Luna Network HSM 7 Reboot Patch is a prerequisite for updating to Luna Appliance Software 7.7.0 and newer. Appliances currently shipped from the factory have this patch already installed, but if you have an older appliance, you must first install the patch or the appliance software update will not proceed.
If you already installed the patch to enable an earlier update (7.7.0 or newer), you do not need to install it again.
sysconf snmp trap set command now defaults to "inform"
Previously, sysconf snmp trap set -traptype command would default to "trap". This has changed with Luna Appliance Software 7.7.0; which adds the option "inform", the new default. If you had any scripts that relied on the default setting, they should now be adjusted to explicitly set the -traptype.
