---
title: "Entrust nShield: Configuring and launching the hardserver"
slug: "oas-ag-entrust-nshield-configuring-and-launching-the-hardserver-3-28"
updated: 2025-07-04T10:04:17Z
published: 2025-07-07T13:30:26Z
canonical: "docs.onespan.com/oas-ag-entrust-nshield-configuring-and-launching-the-hardserver-3-28"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Entrust nShield: Configuring and launching the hardserver

Hardserver configuration involves the following utilities:

- /opt/nfast/bin/config-serverstartup. To configure the [server-startup] values.
- /opt/nfast/bin/nethsmenroll. To configure the [nethsm_imports] values.
- /opt/nfast/bin/enquiry. To test the hardserver settings.
- /opt/nfast/sbin/init.d-ncipher. To launch, restart, or stop the hardserver. This utility uses the following arguments:
  - start
  - restart
  - stop

To configure and launch the hardserver

1. Set the required default hardserver port settings (i.e. defined in the [server-startup] section) with the following command:

/opt/nfast/bin/config-serverstartup -sp
2. Test the new hardserver settings to verify that the port settings are correct. To do so, run:

/opt/nfast/bin/enquiry
3. Register the HSM via the following command:

/opt/nfast/bin/nethsmenroll remote_ip

where remote_ip is the IP address of the HSM.
4. Launch the hardserver:

/opt/nfast/sbin/init.d-ncipher start

> Depending on your Linux distribution, you may need to enable and configure this service to start automatically after server restarts.

Whenever you need to re-configure the hardserver startup or port settings (i.e. via the /opt/nfast/bin/config-serverstartup command), you need to restart the hardserver with the following command:

/opt/nfast/sbin/init.d-ncipher restart

Hardserver settings are defined in /opt/nfast/kmdata/config/config.

[Table: Typical hardserver settings](/sec/docs/oas-ag-entrust-nshield-configuring-and-launching-the-hardserver-3-28#Tab_TypicalHardserverSettings) lists the settings that should be configured accordingly in the hardserver configuration file.

| Section | Setting | Description |
| --- | --- | --- |
| [server_startup] | nonpriv_port | The port through which the hardserver should listen for non-privileged TCP connections. The default value is 9000. |
| priv_port | The port through which the hardserver should listen for privileged TCP connections. The default value is 9001. |
| [nethsm_imports] | local_module | The module number of the imported HSM. |
| remote_ip | The IP of the HSM. |
| privileged | The connection type (privileged VS non-privileged) the hardserver should use to connect to the HSM. The default value is 0 (non-privileged). |
| remote_esn | The serial number of the HSM. |

> The privileged setting must be 1 (privileged), if the host is the first client that loads the keys into the SEE module. After the keys are created and the SEE module has been uploaded, you can set privileged back to the default value 0 (non-privileged) to improve security.