NOTE
Although the k570 appliance is shipped with the HSM Card already reset to
factory defaults, this step is still recommended as a precaution. In addition, you may re-
execute the steps in this section in the future if you wish to re-initialize the SafeNet HSM
Card.
4.
Initialize the SO role.
lunacm:> hsm init -label <admin token slot label>
Optional:
lunacm:> slot list
Notice that the slot with description "Admin Token Slot" now has a label.
lunacm:> role login -n so
lunacm:> partition create
Optional:
lunacm:> slot list
Notice the slot with the slot description "User Token Slot". Remember the ID of this slot as this will be
used later.
lunacm:> role logout
5.
Initialize the partition and the partition SO role.
lunacm:> slot set -slot <slot number of user token slot created above>
lunacm:> partition init -label <new partition label>
6.
Initialize the Crypto Officer role.
lunacm:> role login –name Partition SO
You must be logged in as Partition SO to initialize the Crypto Officer role.
lunacm:> role init –name Crypto Officer
Enter the Crypto Officer password.
Does not prompt for cloning domain.
“co” is the short form for “Crypto Officer”.
lunacm:> role logout
Logs out the Partition SO.
7.
(Mandatory) Change the Crypto Officer password set by the Partition SO. Go to
Resetting the Crypto Officer Password
The Crypto Officer password set by the Partition SO must be changed. If it is not changed, lunacm will generate
a CKR_PIN_EXPIRED error when accessing the partition.
KeySecure k570 Appliance : Installation Guide
16 June 2020, Copyright © 2020 Thales Group. All rights reserved.
29
