In this configuration, the Luna Backup HSM is connected to a remote client workstation that communicates with the client via the Remote Backup Service (RBS). It is useful in deployments where backups are stored in a separate location from the Luna Network HSM 7, to protect against catastrophic loss (fire, flood, etc).
RBS is a utility, included with the Luna HSM Client software, that runs on a workstation hosting one or more Backup HSMs. When RBS is configured and running, other clients or HSMs registered to it can see its Backup HSM(s) as slots in LunaCM. RBS is compatible with both Luna Backup HSM G5 and Luna Backup HSM 7.
Installing and Configuring the Remote Backup Service
RBS is installed using the Luna HSM Client installer. You must create a certificate for the RBS workstation and register it on all clients/appliances that will use the remote Backup HSMs. These instructions will allow you to install and configure RBS.
Prerequisites
>On any Luna Network HSM 7 client workstation, install the following Luna HSM Client components (see Luna HSM Client Software Installation):
•Network
•Remote PED: if you are backing up multifactor quorum-authenticated partitions
NOTE The Luna HSM Client version installed on the RBS workstation must be the same version installed on the client workstation(s). Ensure that you use a client version that is compatible with your Luna Backup HSM G5 firmware.
>Install the Luna Backup HSM G5(s) at the workstation that will host RBS (see Installing the Luna Backup HSM G5).
>[PED Authentication] Initialize the remote PED vector for each Backup HSM. You will need the orange PED key for backup/restore operations (see Initializing the Luna Backup HSM G5 Remote PED Vector).
To install and configure Remote Backup Server
1.On the workstation hosting the Backup HSM(s), install the Backup component of the Luna HSM Client (see Luna HSM Client Software Installation). If this workstation will also host a Remote PED, install the Remote PED component as well.
2.Navigate to the Luna HSM Client home directory (/usr/safenet/lunaclient/rbs/bin on Linux/Unix) and generate a certificate for the RBS host.
> rbs --genkey
You are prompted to enter and confirm an RBS password. The certificate is generated in:
•Linux/UNIX: <LunaClient_install_directory>/rbs/server/server.pem
•Windows: <LunaClient_install_directory>\cert\server\server.pem
3.Specify the Backup HSM(s) that RBS will make available to clients.
> rbs --config
RBS displays a list of Backup HSMs currently connected to the workstation. Select the ones you want to provide remote backup services. When you have specified your selection, enter X to exit the configuration tool.
4.Launch the RBS daemon (Linux
•Linux
•Windows: Double-click the rbs application. A console window will remain open.
You are prompted to enter the RBS password.
5.Securely transfer the RBS host certificate (server.pem) to your Luna HSM Client workstation using pscp or scp.
6.On the client workstation, register the RBS host certificate to the server list.
> vtl addServer -n <Backup_host_IP> -c server.pem
7.[Optional] Launch LunaCM on the client to confirm that the Backup HSM appears as an available slot.
NOTE If you encounter issues, try changing the RBS and PEDclient ports from their default values. Check that your firewall is not blocking ports used by the service.
You can now use the Backup HSM(s) as though they were connected to the client workstation locally, using Remote PED. See Backup/Restore Using Client-Connected Luna Backup HSM G5 for procedures.
