Configure HSM High Availability (HA)
Prerequisites
You must have at least two Luna SA appliances with PED Authentication, or two with Password Authentication.
Steps
Set up appliances for HA:
Perform the network setup on both HA units: Install the SafeNet Luna SA Client Software.
In
hsm showPolicies
, ensure thatAllow Cloning=on
andAllow Network Replication=on
.Initialize the HSMs on your Luna SA appliances. They must have the same cloning domain (i.e., must share the same red, domain PED Key if they are PED-authenticated) or they must share the same domain string if they are password-authenticated.
Create a partition on each Luna SA. They do not need to have the same labels, but must have the same password.
Record the serial number of each partition created on each Luna SA (use partition show).
Register clients with Luna SA HA:
Proceed with normal client setup, Prepare the Client for Network Trust Link.
Register your client computer with both Luna SAs.
Verify using
./vtl
verify command. It should show the numbers of partitions registered with client.
Create the HA GroupNote for your client version:
Version 5
After creating partitions on (at least) two Luna appliances, and setting up Network Trust Links between those partitions and your client, use LunaCM to configure HA on your client:
Go to the directory:
/usr/safenet/lunaclient/bin/
To add members in haadmin, create a new group on the client:
./vtl haAdmin newGroup -serialNum
.HA Group Number
-labelGroupname
-passwordpassword
For example:
./vtl haAdmin newGroup -serialNum 156453092 -label myHAgroup -password S@fenet123
Add members into your haadmin:
./vtl haAdmin addMember -group
.HA Group Number
-serialNumserial_number
-passwordpassword
For example:
./vtl haAdmin addMember -group 1156453092 -serialNum 156451030 -password S@fenet123
Enable synchronization of HAadmin Members:
./vtl haAdmin synchronize -group
.HA Group Number
-passwordpassword
For example:
./vtl haAdmin synchronize -enable -group 1156453092 -password S@fenet123
To Enable HAOnly:
./vtl haAdmin HAOnly -enable
.Check haadmin status after synchronization:
./vtl haAdmin show
.Note: After synchronization please verify kms master key copied to both partitions registered in hsm ha group. It takes time to copy master key to another partition.
Version 6
After creating partitions on (at least) two Luna appliances, and setting up Network Trust Links between those partitions and your client, use LunaCM to configure HA on your client:
Go to directory:
/usr/safenet/lunaclient/bin/
.Select Lunacm:
./lunacm
.
To add members in hagroup, create a new group on the client:
haGroup creategroup -serialNumber
.serial number
-llabel
-ppassword
For example:
lunacm:>haGroup creategroup -serialNumber 1047740028310 -l HAHSM3 -p S@fenet123
Use the hagroup addmember command to add new member into hagroup client:
hagroup addMember -group
groupname
-serialNumberserial number
-passwordpassword
Field descriptions:
Label for the group (do NOT call the group just "HA"):
groupname
The serial number of the first partition OR the slot number of the first partition:
serial number
The password for the partition:
password
Lunacm also generates and assigns a Serial Number to the group itself.
For example:
lunacm:>hagroup addMember -group rkmsgroup -serialNumber 1047749341551 -password S@fenet123
Use the hagroup addmember command to add another member to the HA group:
hagroup addMember -group
.groupname
-serialNumberserial number
-passwordpassword
For example:
lunacm:>hagroup addMember -serialNumber 1047740028310 -g rkmslgroup -password S@fenet123
Check group member in group using "hagroup listGroups" command:
hagroup listGroups
.Enable HAOnly:
hagroup HAOnly -enable
.Enable synchronization of HAgroup Members:
hagroup synchronize -group
.groupname
-passwordpassword
-enableFor example:
lunacm:>hagroup synchronize -group rkmslgroup -password S@fenet123 -enable
After configuring HSM HA, to run Ranger KMS in HSM HA mode you must specify the virtual group name created above in
HSM_PARTITION_NAME
property ofinstall.properties
and setup and start Ranger KMS. Note: All other configuration for HSM ininstall.properties
of Ranger KMS as mentioned in “Installing Ranger KMS HSM” will remain the same.