Preparations to add functionality modules

To be able to add a Functionality Module (FM) to your HSM, you will need at least one Application Partition initialized and fully operational on your HSM.

You can initialize a new partition either from an SSH connection to your appliance using LunaSH (Luna Shell command line interface) or from a registered client, using LunaCM (LunaCM command line tool).

To initialize through LunaSH

1. Log in to the HSM as SO (Security Officer): lunash:> hsm login

2. Create the partition if it has not already been created: lunash:> partition create -partition <partition name>

3. Initialize the partition by specifying its partition name. You can specify an optional label for the initialized partition; if this is not specified, the label assigned will be the same as the partition name. To initialize the partition using a policy template, specify the template file name. You can specify a Partition SO (PSO) password and/or a domain string with the initialization command, or enter them when prompted.

   lunash:> partition init -partition <name> [-label <label>] [-applytemplate <template_file>] [-password <password>] [-domain <domain_string>]

4. Initialize the Crypto Officer (CO) role, providing the partition name, the PSO credential and the credential for the CO that is being created. The CO will need to log in and change their password before any other action can be permitted.

   lunash:> partition init co -partition <partition name> -psopin <PSO's password> -copin <CO's password>

5. Initialize the Crypto User (CU) role, specifying a CU password. The CU will need to log in and change their password before any other action can be permitted.

   lunash:> partition init cu -partition<partition name> [-copin <crypto officer credential>] [-cupin <crypto user initial credential>]

To initialize through LunaCM

1. Launch LunaCm on the client workstation.

2. Set the active slot to the partition you want to initialize.

   lunacm:> slot set -slot <slot_number>

3. Initialize the partition by specifying an identifying label. To initialize the partition using a policy template, specify the path to the template file. You can specify a Partition Security Officer (SO) password and/or a domain string with the initialization command, or enter them when prompted.

   lunacm:> partition init -label <label> [-applytemplate <template_file>] [-password <password>] [-domain <domain_string>]

4. Log in to the partition as Partition SO. Roles for login can be the following:

   1. Partition SO: specify po for <role>

   2. Crypto Officer: specify co for <role>

   3. Crypto User: specify cu for <role>

   lunacm:> role login -name po

5. Initialize the Crypto Officer (CO) role. The CO will need to log in and change their password before any other action can be permitted.

   lunacm:> role init -name co

6. Log into the partition as Crypo Officer.

   lunacm:> role login -name co

7. Initialize the Crypto User (CU) role. The CU will need to log in and change their password before any other action can be permitted.

   lunacm:> role init -name c