Installing or Updating the Cluster Package
Use these instructions to install or update the cluster secure package. You must use LunaSH to perform the updates.
CAUTION! TECHNICAL PREVIEW -- EVALUATION ENVIRONMENT ONLY
Clusters and keyrings are presented as a technical preview, to give customers the opportunity to validate our new HSM management features, designed to reduce operation cost and maximize the return on investment of a fleet of HSMs. This release does not provide a migration path from standard Luna partitions or Luna Cloud HSM services to keyrings. This preview is currently available on password-authenticated Luna Network HSMs only.
DO NOT INSTALL THE CLUSTER PACKAGE ON A LUNA NETWORK HSM IN PRODUCTION
When the cluster package is installed, access to any existing partitions on the HSM is disabled, and this can only be reversed by re-imaging the Luna Network HSM appliance (see Re-Imaging the Appliance to Baseline Software/Firmware Versions). Re-imaging is a destructive action; all roles, partitions, and keys are destroyed. The Luna Network HSM must be completely reconfigured; all partitions must be recreated and their contents restored from backup. In particular, do not attempt to configure clustering on a Luna Network HSM that already has V1 partitions created; either delete these partitions or re-image the appliance before configuring a cluster.
Prerequisites
>The Luna Network HSM must be configured and accessible over the network.
>The Luna Network HSM must be initialized (see Initializing the HSM).
>You require a client operating system supported by Luna HSM Client 10.5.0 or newer.
>You must have Luna Network HSM Appliance Software 7.8.0 or newer (see Updating the Luna Network HSM Appliance Software) and Luna HSM Firmware 7.8.0 or newer (see Updating the Luna HSM Firmware) installed.
To install the cluster package on the Luna Network HSM
1.Transfer the secure package update file to the Luna Network HSM using pscp or scp.
pscp <path>/lnh_cluster-1.0.#-###.spkg admin@<appliance_host/IP>:
2.Using a serial or SSH connection, log in to the appliance as admin (see Logging In to LunaSH).
3.Log in as HSM SO (see Logging In as HSM Security Officer).
lunash:> hsm login
4.[Optional] Verify that the secure package file is present on the Luna Network HSM.
lunash:> package listfile
5. [Optional] Verify the package file, specifying the authorization code you received from Thales.
lunash:> package verify <filename>.spkg -authcode <code_string>
6.Install the secure package for the cluster service.
lunash:> package update lnh_cluster-1.0.#-###.spkg -authcode <authcode_string>
7.Run the restart command for the cluster service, as prompted. This step completes the service installation procedure.
lunash:> service restart cluster
The new cluster and keyring commands become available when you open a new LunaSH session.
8.If you plan to use REST API to work with clusters, set up the webserver service so that the appliance can accept calls from your web application.
Refer to Webserver Setup.
After configuring the webserver service, you must synchronize the HSM time with the time on the appliance.
lunash:> hsm time sync
9.Install the Luna HSM Client software on the client machine you will use to configure your application partition(s).
Refer to Luna HSM Client Software Installation.
Troubleshooting
If you encounter any issues, refer to Reading System Logs to check recent activity on the appliance. To report an issue that is not described below, export the appliance syslog to a client workstation and provide it to your Thales representative (refer to Exporting System Logs).
