Chapter 2: ProtectServer External 2 Installation and Configuration
NOTE
Enabling FIPS mode will block all mechanisms that are not FIPS-approved. If you are
using unapproved mechanisms and understand the implications, do not enable FIPS mode.
Networking and Firewall Configuration
There is no means to authenticate the client to the HSM or vice-versa. It is therefore recommended that the
HSM and client are connected to the same secure network segment, to prevent sensitive data from traveling
through insecure intermediate network(s). This configuration prevents Man-in-the-Middle and other malicious
attacks. If possible, connect the HSM directly to the client using a cross-cable.
The ProtectServer External 2 includes two network ports, each of which can be connected to a different
network. It is highly recommended that you keep the management network and the network running your
applications isolated from each other at all times. Further restrictions on communication between network
segments can be enforced by means of static routes. See
"Network Configuration" on page 31
for instructions
on setting up static routes.
The ProtectServer External 2 supports an iptables-based firewall. The firewall must be configured with
appropriate rules to restrict access to identified network resources only. See
for details on setting iptables.
Separation of Roles
The ProtectServer External 2 has two role categories: Appliance and HSM users. For optimal security,
maintain these roles and their credentials separately; do not share between users. Do not share the appliance
management, HSM Administration, and User terminals.
Appliance Users
The following roles can log in to the PSE shell (PSESH) to configure and manage the appliance:
>
admin
>
pseoperator
>
audit
See
in the
PSESH Command Reference Guide
for the responsibilities of each role.
HSM Users
The following roles can log in to manage the HSM token and perform cryptographic operations:
>
Administration Security Officer (ASO)
>
Administrator
>
Security Officer (SO)
>
Token Owner (User)
See
in the
ProtectToolkit-C Administration Guide
for the responsibilities of each role.
First Login and System Test
When starting up your ProtectServer External 2 for the first time, follow these steps:
Thales ProtectServer HSM 5.9.1 ProtectServer HSM and ProtectToolkit Installation and Configuration Guide
2021-11-02 08:51:40-04:00 Copyright 2009-2021 Thales Group
28
