Configuring a Remote Backup Server

The Remote Backup Service (RBS) is an optional Luna client component that allows you to connect one or more backup HSMs to a remote Luna HSM Client workstation to back up slots on any local Luna HSM Client workstations that are registered with the RBS server. RBS is useful in deployments where backups are stored in a separate location from the Luna Network HSM 7, to protect against catastrophic loss (fire, flood, etc).

RBS is a utility, included with the Luna HSM Client software, that runs on a workstation hosting one or more Backup HSMs. When RBS is configured and running, other clients or HSMs registered to it can see its Backup HSM(s) as slots in LunaCM.

Installing and Configuring the Remote Backup Service

RBS is installed using the Luna HSM Client installer. You must create a certificate for the RBS workstation and register it on all clients/appliances that will use the remote Backup HSMs. These instructions will allow you to install and configure RBS.

Prerequisites

>Install the following Luna HSM Client components on any Luna Network HSM 7 client workstation that hosts slots for the partitions you want to backup using RBS (see Luna HSM Client Software Installation):

•Network

•Remote PED: if you are backing up multifactor quorum-authenticated partitions.

>Connect the backup HSM(s) directly to the Luna HSM Client workstation that will host RBS using the included USB cable.

NOTE   On most workstations, the USB 3.0 connection provides adequate power to the backup HSM and it will begin the boot sequence. If you are using a low-power workstation, such as a netbook, the USB connection may not provide adequate power, in which case you will also need to connect the external power supply. It is recommended that you use the power supply for all backup HSMs connected to the RBS host workstation. If you are connecting multiple backup HSMs, you can use an external USB 3.0 hub if required.

>Initialize the backup HSMs if necessary.

>HSM policy 16: Allow network replication must be set to 1 (ON) on the HSMs that hosts the user partitions to be backed up.

To install and configure RBS

1.On the workstation hosting the Backup HSM(s), install the Backup component of the Luna HSM Client (see Luna HSM Client Software Installation). If this workstation will also host a Remote PED, install the Remote PED component as well (Windows only).

2.Navigate to the Luna HSM Client home directory (/usr/safenet/lunaclient/rbs/bin on Linux/Unix) and generate a certificate for the RBS host.

> rbs --genkey

You are prompted to enter and confirm an RBS password. The certificate is generated in:

•Linux/UNIX: <LunaClient_install_directory>/rbs/server/server.pem

•Windows: <LunaClient_install_directory>\cert\server\server.pem

3.Specify the Backup HSM(s) that RBS will make available to clients.

> rbs --config

RBS displays a list of Backup HSMs currently connected to the workstation. Select the ones you want to provide remote backup services. When you have specified your selection, enter X to exit the configuration tool.

4.Launch the RBS daemon (Linux/UNIX) or console application (Windows).

•Linux/UNIX: # rbs --daemon

•Windows: Double-click the rbs application. A console window will remain open.

You are prompted to enter the RBS password.

5.Securely transfer the RBS host certificate (server.pem) to your Luna HSM Client workstation using pscp or scp.

6.On the client workstation, register the RBS host certificate to the server list.

> vtl addServer -n <Backup_host_IP> -c server.pem

7.[Optional] Launch LunaCM on the client to confirm that the Backup HSM appears as an available slot.

NOTE   If you encounter issues, try changing the RBS and PEDclient ports from their default values. Check that your firewall is not blocking ports used by the service.

You can now use the Backup HSM(s) as though they were connected to the client workstation locally, using Remote PED.