How to set up the nShield Connect 
How to switch between using the nShield Connect or the internal Gateway database as the keystore. 

The Gateway appliance must not have an internal HSM. You cannot connect an nShield Connect appliance to a Gateway appliance that already uses an internal HSM.
The
ssg-nshieldpci
RPM must be installed.
To verify, run the following command:
# rpm -qa | grep ssg-nshieldpci
The version of the nShield RPM is returned if the RPM is installed correctly.
The
layer7
and
gateway
users are in the nfast group.
To verify, run the following command:
# egrep -i "^nfast" /etc/group
Look for the response:
nfast:x:502:gateway,layer7
If either the
gateway
 or
layer7
user is missing from the group, run the appropriate command below to add the missing user:
# usermod -g layer7 -G 'layer7,nfast' layer7
# usermod -g gateway -G 'gateway,pkcs11,nfast' gateway
Three nShield Administrator cards must be available. 
The nShield Connect appliance is running.

Clear the database of any existing Security World and keystore data:

# /opt/SecureSpan/Appliance/libexec/ssgconfig_launch -keystoreProperty clear 4 worldb64
# /opt/SecureSpan/Appliance/libexec/ssgconfig_launch -keystoreProperty clear 4 databytes

Delete any existing files from the following directory:

# rm -f /opt/nfast/kmdata/local/*

Select
Security World mgmt
.
Select
Module initialization
.
Select
Create Security World
.

the module configuration
feature-enabling certificates
the encrypted Security World and key data for Security Worlds created on the module

On the Gateway to be used as the RFS machine, retrieve the ESN and keyhash of the nShield Connect:

# /opt/nfast/bin/anonkneti 
<nShield_Connect_IP>

Copy the result to the clipboard. The result is in the format: "<ESN> <KNETI HASH>"

Where:

<ESN>
is the Electronic Serial Number
<KNETI HASH>
is the nShield Integrity Key Hash

Create the directory structure on the RFS machine. Paste the copied result as part of the arguments; for example:

# /opt/nfast/bin/rfs-setup --force 
<nShield_Connect_IP>
<ESN> <KNETI HASH>

Edit the Gateway IP firewall to allow incoming RFS connections: 

Open the file 

/etc/sysconfig/iptables

 in a text editor.

Add a rule above the line “ADD CUSTOM ALLOW RULES HERE”.

For example, to allow inbound RFS connections on the default port of 9004 on the appliance's private-side network interface, add a rule similar to the following:

# Allow inbound nShield Connect RFS connections on private interface
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 9004 -j ACCEPT
#
# ADD CUSTOM ALLOW RULES HERE
#

Save and close the 

iptables

 file.

Restart the iptables service:

# service iptables restart &

An alternative to modifying the firewall is to disable the Gateway firewall temporarily:

     # service ssg stop

     # service iptables stop

The firewall re-enables automatically the next time the Gateway appliance is restarted.

IMPORTANT:

Consult with your system administrator before disabling the Gateway firewall. 

Configure the nShield Connect appliance to use the RFS server that was just set up:

On the nShield Connect display screen, use the navigation button to select the following options:
System
System Configuration
Remote file system
Enter the IP address of the RFS machine. Leave the port number as 9004.

Configure auto push which allows the nShield Connect configuration to be performed remotely from the RFS:

On the nShield Connect display screen, use the navigation button to select the following options:
System
System Configuration
Config File options
Allow auto push
Select
ON
.

Configure the log file storage.

On the nShield Connect display screen, use the navigation button to select the following options:
System
System Configuration
Log config
Select a storage option:
Append:
 Stores the files on the nShield Connect and RFS server.
Log: 
Stores the files on the nShield Connect only.

On the RFS machine, verify that the 

/opt/nfast/kmdata/local 

directory contains the world, module, and key files.

Change the ownership of the files so that the Gateway can access them:

# chown gateway.nfast key_jcecsp*

The Gateway acts solely as a client, in which case you rely on another Gateway to be the RFS server.
Additional configuration is required to set up synchronization with the RFS server.
The Gateway acts as a client and also as the RFS server. 

On the nShield Connect front panel use the navigation button to select:

System
System configuration
Client config
New client

Enter the IP address of the remote client.

See Troubleshooting if this step fails.

Optional.

If you want a privileged connection to the client, select client privileged on any port.

On the client machine, retrieve the ESN and keyhash of the nShield Connect:

# /opt/nfast/bin/anonkneti <
nShield_Connect_IP>

On the client machine, configure the use of nShield Connect:

# /opt/nfast/bin/nethsmenroll --force <
nShield_Connect_IP>
Remote module returned ESN: 
<ESN>
                    HKNETI: 
<KNETI HASH>
Is the above correct? (yes/no): yes
OK configuring hardserver's nethsm imports

Configure TCP sockets on the client for Java applications (for example, KeySafe):

# /opt/nfast/bin/config-serverstartup --enable-tcp --enable-privileged-tcp

Change the ownership and permission of

/opt/nfast/kmdata/config/config

:

chmod 664 /opt/nfast/kmdata/config/config
chown nfast:nfast /opt/nfast/kmdata/config/config

Restart the hardserver:

# /opt/nfast/sbin/init.d-ncipher restart

Verify that the nfast client on the Gateway is configured correctly to use a security world with nShield Connect:

# service ssg restart
# /opt/nfast/bin/enquiry
# /opt/nfast/bin/nfkminfo

For the

enquiry 

command, look for these lines:

Module #1: 
[...] 
mode operational 

For the

nfkminfo 

command, look for these lines:

World 
[...] 
state [...] Usable [...] 
[...] Module #1 
State [...] Usable 

On the RFS machine, allow access from cooperating clients:

# /opt/nfast/bin/rfs-setup --gang-client --write-noauth 
<client_IP>

On the client machine, set up synchronization with the RFS machine:

# /opt/nfast/bin/rfs-sync --setup --no-authenticate 
<RFS_IP>

Update the RFS files to the client machine:

# /opt/nfast/bin/rfs-sync --update

Verify that the 

/opt/nfast/kmdata/local 

directory contains the world, module, and key files.

You may delete the existing key files. New key files are generated automatically after you set up the manually-configured security world from the Gateway main menu.

Verify that the

/kmdata/config/config

owner and permission settings are the same as set in the initial Configure Gateway as a Client section.

Change the file ownership so that the API Gateway can access the files:

# chown gateway.nfast key_jcecsp*

# /opt/nfast/bin/rfs-setup --force <nShield_Connect_IP><ESN> <KNETI HASH>

/opt/nfast/sbin/init.d-ncipher restart