Chapter 3: Deployment Guidelines
For maximum security, enable all of the above features. See
in the
PTK-C
Administration Guide
for flag descriptions and setup instructions.
NOTE
Enabling FIPS mode will block all mechanisms that are not FIPS-approved. If you are
using unapproved mechanisms and understand the implications, do not enable FIPS mode.
Networking and Firewall Configuration
There is no means to authenticate the client to the HSM or vice-versa. It is therefore recommended that the
HSM and client are connected to the same secure network segment, to prevent sensitive data from traveling
through insecure intermediate network(s). This configuration prevents Man-in-the-Middle and other malicious
attacks. If possible, connect the HSM directly to the client using a cross-cable.
The SafeNet ProtectServer Network HSM includes two network ports, each of which can be connected to a
different network. It is highly recommended that you keep the management network and the network running
your applications isolated from each other at all times. Further restrictions on communication between network
segments can be enforced by means of static routes. See
"Network Configuration" on page 28
for instructions
on setting up static routes.
The SafeNet ProtectServer Network HSM supports an iptables-based firewall. The firewall must be configured
with appropriate rules to restrict access to identified network resources only. See
for details on setting iptables.
Separation of Roles
The SafeNet ProtectServer Network HSM has two role categories: Appliance and HSM users. For optimal
security, maintain these roles and their credentials separately; do not share between users. Do not share the
appliance management, HSM Administration, and User terminals.
Appliance Users
The following roles can log in to the PSE shell (PSESH) to configure and manage the appliance:
>
admin
>
pseoperator
>
audit
See
in the
PSESH Command Reference Guide
for the responsibilities of each role.
HSM Users
The following roles can log in to manage the HSM token and perform cryptographic operations:
>
Administration Security Officer (ASO)
>
Administrator
>
Security Officer (SO)
>
Token Owner (User)
SafeNet ProtectToolkit 5.8 Installation and Configuration Guide
007-013682-006 Rev. A 08 January 2020 Copyright 2009-2020 Gemalto
24
