Using PSESH

This topic describes the PSESH command line tool, PSESH users, PSESH features, how to access PSESH, and how to recover access to PSESHwhen locked out of the admin account. Refer to the following sections:

• PSESH overview

• PSESH users

• PSESH features

• Accessing PSESH

• Admin account lockout and recovery

PSESH overview

The PSESH shell command line tool provides access to the ProtectServer 3 External or ProtectServer 3+ External HSM shell for performing basic appliance configuration tasks such as network configuration and appliance software package updates and management.

PSESH commands are not case sensitive.

Access PSESH by SSH or the local console. For more information, refer to Accessing PSESH.

PSESH users

The following users can access PSESH:

admin

The admin user is responsible for managing the appliance and can do the following:

• Run PSESH commands used to perform package upgrades/installations, troubleshooting, viewing log files, and extracting log files.

• Run all of the PSESH commands available to the pseoperator.

• Reset the password for the audit and pseoperator users.

audit

The audit user is responsible for managing logging on the appliance and can run PSESH commands used to manage audit logging configuration, log rotation scheduling, and settings for the audit user role.

pseoperator

The pseoperator user is responsible for configuring the appliance for client access and can do the following:

• Run PSESH commands used to configure the appliance network parameters such as IP addresses, iptables, and routes.

• Run PSESH commands used to configure appliance settings such as the date/time and SNMP configuration.

PSESH features

PSESH provides the following features:

Command history

You can scroll through the commands you have entered on the PSESH command line using the up/down arrows keys.

Console history

You can scroll up to see the console history with Shift + Page Up.

Command shortcuts

You must enter sufficient letters of a command or sub-command to make the input unique in the current syntax. For example, you could invoke system syntax help with help, hel, he, but not just h (because there is also an hsm command and typing just "h" is not sufficient to indicate whether you want help or hsm).

Command completion

You can use the Tab key to automatically complete partially typed commands. This allows you to enter only enough characters to uniquely identify the command, and then press Tab to automatically fill in the rest of the characters for the command.

Command syntax help

To display help information for a command, enter help <command_name> or ? <command_name>

Accessing PSESH

You can access PSESH by connecting a keyboard and monitor to the appliance, using a serial connection, or using an SSH client (such as puTTY in Windows or the ssh command in Linux) after the network settings have been configured.

To access PSESH

1. Connect to the appliance (monitor and keyboard, serial connection, or SSH).

   When a successful connection is made, a terminal window opens and the prompt login as: appears.

   You can log on as admin, pseoperator, or audit (see PSESH Users for details on these roles).

2. You are prompted for the password. If this is the first time you have signed in as this user, the default password is password. You will be prompted to enter a new password.

   Once you have logged on, the system presents the psesh:> prompt, includes the host name you assigned to the appliance:

   [myPSE] psesh:>
   

   Note

   After three failed SSH login attempts, the account will be locked out for 10 minutes.

Admin account lockout and recovery

As a security measure, the admin account is locked out after 10 consecutive failed login attempts using the console (serial port or keyboard and monitor). Further login attempts will produce a message like the following:

Your admin account is locked due to 11 failed logins.
You will need to tamper the HSM and reboot the system to reset the admin password.

You can recover the admin account by logging on to PSESH as pseoperator or by using the recover account if you cannot access PSESH as pseoperator.

Recovering the admin account as pseoperator

You can recover the admin account by logging on to PSESH as pseoperator. Follow this method if the pseoperator PSESH role is still accessible.

To recover the admin account as pseoperator

1. Log on to PSESH as pseoperator and run the following commands:

   1. sysconf appliance factory to reset all appliance account passwords, SNMP, and network configuration to factory settings.

   2. sysconf appliance reboot to restart the appliance.

      After a successful restart, the following message is displayed, followed by the login prompt:

      Protect Server External 3
      
      Warning: This is a password recovery process.
              The HSM is tampered and rebooted after max password retry failures.
              The admin password is reset to factory default now.
              You are required to change the password at the first login.
      
      myPSE login:
      

2. Connect to the appliance with a serial cable.

3. Log onto the unlocked admin account using the default password ("password"). You are prompted to set a new password for the admin account.

4. Set a new admin password.

Recovering the admin account by using the recover account

You can recover the admin account as by using the recover account.

The recover account is a limited-purpose account that has the permanent (fixed) password "recover". The recover account's only purpose is to reset the password of the admin user if the admin password is lost or forgotten and you cannot access PSESH as pseoperator.

To recover the admin account by using the recover account

1. Connect a terminal to the serial port on the ProtectServer 3 Network HSM. For more information about the location of the serial port on your ProtectServer 3 Network HSM, refer to the following topics:

   • ProtectServer 3 External - Front panel view.

   • ProtectServer 3+ External - ProtectServer 3+ External rear panel.

2. Log on to PSESH as recover, using the fixed password "recover".

3. Reset the admin password by running the following command:

   user reset admin