Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.0

This chapter provides an overview of administering the board on both Oracle Solaris and Linux platforms with the scamgr and scadiag utilities, and the scad and scakiod service daemons. Additional instructions for Linux platforms are included in the last two sections. Sections include:

• Using the scamgr Utility
• Logging In and Out With scamgr
• Entering Commands With scamgr
• Initializing the Board With scamgr
• Managing Keystores With scamgr
• Multi-Admin Authentication
• Managing Boards With scamgr
• Using the scadiag Utility
• Managing Services for Oracle Solaris Platforms
• Additional Instructions for Administering the Board on Linux Platforms

---

Using the scamgr Utility

The scamgr utility offers a command-line interface to the board. Only users designated as security officers are permitted to use the scamgr utility. When you first connect to a board with scamgr, you are prompted to create an initial security officer and password.

The scamgr command-line syntax is:

• scamgr [-?]
• scamgr [-H]
• scamgr [-V]
• scamgr [-y] [-h hostname] [-p port] [-d device] [-f filename]
• scamgr [-y] [-h hostname] [-p port] [-d device] command

TABLE 3-1 shows the options for the scamgr utility.

Modes of Operation

scamgr can run in one of three modes. These modes differ mainly in how commands are passed into scamgr. The three modes are Single-Command mode, File mode, and Interactive mode.

Single-Command Mode

In Single-Command mode, you must authenticate as security officer for every command. Once the command is executed, you are logged out of scamgr.

When entering commands in Single-Command mode, you specify the command to be run after all the command-line switches are specified. For example, in Single-Command mode, the following command would show all the users in a given keystore and return the user to the command shell prompt.

$ scamgr show user
Security Officer Name: sec-officer
Security Officer Password:

All output from Single-Command mode goes to the standard output stream. This output can be redirected using standard UNIX shell-based methods.

File Mode

In File mode, you must authenticate as security officer for every file you run. You are logged out of scamgr after the commands in the command file are executed.

To enter commands in File mode, you specify a file from which scamgr reads one or more commands. The file must be ASCII text, consisting of one command per line. Begin each comment with a hash (#) character. If the File mode option is set, scamgr ignores any command-line arguments after the last option. The following example runs the commands in the deluser.scr file and answers all prompts in the affirmative:

$ scamgr -f deluser.scr -y

Interactive Mode

In Interactive mode, you must authenticate as security officer every time you connect to a board. This is the default operating mode for scamgr. To log out of scamgr in Interactive mode, use the logout command. Refer to Logging In and Out With scamgr.

Interactive mode presents the user with an interface similar to ftp(1), where commands can be entered one at a time. The -y option is not supported in Interactive mode.

---

Logging In and Out With scamgr

When you use scamgr from the command line and specify host, port, and device using the -h, -p, and -d attributes respectively, you are immediately prompted to log in as security officer if a successful network connection was made.

The scamgr utility establishes an encrypted network connection (channel) between the scamgr application and the Sun Crypto Accelerator 6000 firmware running on a specific board.

During setup of the encrypted channel, boards identify themselves by their hardware serial ID address and an RSA public key. A trust database ($HOME/.sunw/sca/trustdb) is created the first time scamgr connects to a board. This file contains all of the boards that are currently trusted by the security officer.

scamgr Prompt

The scamgr prompt in Interactive mode is displayed as follows:

scamgr{mcaN@hostname, sec-officer}> command

The following table describes the scamgr prompt variables:

Logging In to a Board With scamgr

If the security officer connects to a new board, scamgr notifies the security officer and prompts with the following options:

1. Abort this connection
2. Trust the board for this session only
3. Trust the board for all future sessions

If the security officer connects to a board that has a remote access key that has been changed, scamgr will notify the security officer and prompt the following three options:

1. Abort this connection
2. Trust the board for this session only
3. Replace the trusted key with the new key

Logging In to a New Board

When connecting to a new board, scamgr must create a new entry in the trust database. The following is an example of logging in to a new board.

# scamgr -h hostname
Warning: Serial ID and Public Key Not Found
--------------------------------------------------------------
The Serial ID and public key presented by this board were
not found in your trust database.
 
Serial ID: 36:30:30:30:30:33
Key Fingerprint: baa4-17f8-1128-1c6a-9a18-3719-988f-64a0-a4a5-f72f
--------------------------------------------------------------
Please select an action:
 
1. Abort this connection
2. Trust the board for this session only.
3. Trust the board for all future sessions.
 
Your Choice -->

Logging In to a Board With a Changed Remote Access Key

When connecting to a board that has a changed remote access key, scamgr must change the entry corresponding to the board in the trust database. The following is an example of logging in to a board with a changed remote access key.

# scamgr -h hostname
Warning: Public Key Conflict
--------------------------------------------------------------
The public key presented by the board you are connecting
to is different than the public key that is trusted for
this Serial ID.
 
Serial ID: 36:30:30:30:30:33
New Key Fingerprint: baa4-17f8-1128-1c6a-9a18-3719-988f-64a0-a4a5-f72f
Trusted Key Fingerprint: e207-6ff7-41f4-3766-bafd-5910-973d-a32b-46e8-6e73
--------------------------------------------------------------
Please select an action:
 
1. Abort this connection
2. Trust the board for this session only.
3. Replace the trusted key with the new key.
 
Your Choice -->

Logging Out of a Board With scamgr

If you are working in Interactive mode, you might want to disconnect from one board and connect to another board without completely exiting scamgr. To disconnect from a board and log out, but remain in Interactive mode, use the logout command:

scamgr{mcaN@hostname, sec-officer}> logout
scamgr>

In the previous example, notice that the scamgr> prompt no longer displays the device instance number, hostname, or security officer name. To log in to another device, type the connect command with the following optional parameters.

Example:

scamgr{mcaN@hostname, sec-officer}> logout
scamgr> connect host hostname dev mca2
Security Officer Login: sec-officer
Security Officer Password: 
scamgr{mca2@hostname, sec-officer}> 

scamgr does not let you issue the connect command if you are already connected to a board. You must first log out and then issue the connect command.

Each new connection causes scamgr and the target board firmware to renegotiate new session keys to protect the administrative data that is sent.

---

Entering Commands With scamgr

This section lists the available scamgr commands and describes their usage.

scamgr Commands

TABLE 3-4 lists the scamgr commands.

The scamgr utility has a command language that must be used to interact with the board. Commands are entered using all or part of a command (enough to uniquely identify that command from any other command). Entering sh instead of show would work, but re is ambiguous because it could be reset or rekey.

The following example shows entering commands using entire words:

scamgr{mcaN@hostname, sec-officer}> show user
User                                    Status    
-----------------------------------------------------
web-admin                              Enabled   
Tom                                    Enabled   
-----------------------------------------------------

The same information can be obtained in the previous example using partial words as commands, such as sh us.

An ambiguous command produces an explanatory response:

scamgr{mcaN@hostname, sec-officer}> re
Ambiguous command: re

Getting Help for Commands

scamgr has built-in help functions. To get help, you must enter a question mark (?) character following the command you want more help on. If an entire command is entered and a “?” exists anywhere on the line, you get the syntax for the command, for example:

scamgr{mcaN@hostname, sec-officer}> create ?
Sub-Command                     Description
-----------------------------------------------------
so                              Create a new security officer
user                            Create a new user
 
scamgr{mcaN@hostname, sec-officer}> create user ?
Usage: create user [<username>]
 
scamgr{mcaN@hostname, sec-officer}> set ?
Sub-Command                     Description
-----------------------------------------------------
lock                            Lock master key (Prevents key backup)
multiadmin                      Configure Multi-Admin mode
passreq                         Set password security level
password                        Change password for security officer
timeout                         Set firmware auto-logout timer

You can also enter a question mark at the scamgr prompt to see a list of all of the scamgr commands and their description, for example:

scamgr{mcaN@hostname, sec-officer}> ?
Sub-Command                     Description
--------------------------------------------------------------
backup                          Backup master key
connect                         Begin admin session with firmware
create                          Create users and accounts
delete                          Delete users and accounts
diagnostics                     Run diagnostic tests
disable                         Disable users, modes or options
enable                          Enable users, modes or options
exit                            Exit scamgr
load                            Load data items
logout                          Logout current session
quit                            Exit scamgr
rekey                           Generate new system keys
reset                           Reset the hardware
set                             Set operating parameters
show                            Show system settings
zeroize                         Delete all keys and reset board
 

Quitting the scamgr Utility

Two commands allow you to exit from scamgr, quit and exit. The Ctrl-D key sequence also exits from scamgr.

---

Initializing the Board With scamgr

The first step in configuring a board is to initialize it. When you initialize a board it is necessary to create a keystore. (See Web Server Concepts and Terminology.) When you first connect to a board with scamgr, you are prompted to initialize the board with a new keystore or an existing keystore, which is stored in a backup file. scamgr prompts you for all the required information for either type of board initialization.

Initializing the Board With a New Keystore

This section describes how to initialize the board with a new keystore.

1. Initialize the board with the scamgr command.

• If the board is installed locally, enter scamgr at the system prompt.
• If the system is remote, enter scamgr -h hostname

2. Enter 2 then 1 as shown in the following example:

# scamgr -h hostname
Please select an action:
 
1. Abort this connection
2. Trust the board for this session only.
3. Replace the trusted key with the new key.
 
Your Choice --> 2
This board is uninitialized.
You will now initialize the board. You may either
completely initialize the board and start with a new
keystore or initialize the board to use an existing
keystore, providing a backup file in the process.
 
1. Initialize the board with a new keystore
2. Initialize the board to use an existing keystore
 
Your Choice (0 to exit) --> 1

3. Create a keystore name.

See Naming Requirements.

Keystore Name: keystore-name

4. Select FIPS 140-2 mode or non-FIPS mode.

When in FIPS mode the board is FIPS 140-2, level 3 compliant. FIPS 140-2 is a Federal Information Processing standard that requires tamper-resistance and a high level of data integrity and security. Refer to the FIPS 140-2 document located at:
http://www.nist.gov/dmvp

Run in FIPS 140-2 mode? (Y/Yes/N/No) [No]: y

5. Create an initial security officer name and password.

See Naming Requirements.

Initial Security Officer Name: sec-officer
Initial Security Officer Password:
Confirm Password:

6. Verify the configuration information:

Board initialization parameters:
-----------------------------------------------------
Initial Security Officer Name: sec-officer
Keystore name: keystore-name
Run in FIPS 140-2 Mode: Yes
-----------------------------------------------------
 
Is this correct? (Y/Yes/N/No) [No]: y
Initializing crypto accelerator board... This may take a few minutes...Done.

Initializing the Board to Use an Existing Keystore

If you are adding multiple boards to a single keystore, you might want to initialize all of the boards to use the same keystore information. In addition, you might want to restore a board to the original keystore configuration. This section describes how to initialize a board to use an existing keystore which is stored in a backup file.

You must first create a backup file of an existing board configuration before performing this procedure. Creating and restoring a backup file requires a password to encrypt and decrypt the data in the backup file. (See Back Up the Master Key.)

1. Initialize the board with the scamgr command.

• If the board is installed locally, enter scamgr at the system prompt.
• If the system is remote, enter scamgr -h hostname

1. Enter 2 as shown in the following example:

# scamgr -h hostname
This board is uninitialized.
You will now initialize the board.  You may
either completely initialize the board and
start with a new keystore or restore the board
using a backup file.
 
1. Initialize the board with a new keystore
2. Initialize the board to use an existing keystore
 
Your Choice (0 to exit) --> 2

2. Enter the path and password to the backup file:

Enter the path to the backup file: /tmp/board-backup
Password for restore file:

3. Verify the configuration information:

Board restore parameters:
----------------------------------------------------------------
Path to backup file: /tmp/board-backup
Keystore name: sca6000-keystore
Requires Multi-Admin auth: No
----------------------------------------------------------------
 
Is this correct? (Y/Yes/N/No) [No]: y
Restoring data to crypto accelerator board...

---

Managing Keystores With scamgr

A keystore is a repository for key material. Associated with a keystore are security officers and users. Keystores not only provide storage, but a means for key objects to be owned by user accounts. This enables keys to be hidden from applications that do not authenticate as the owner. Keystores have three components:

• Key objects - Long-term keys that are stored for applications such as the Sun Java System Web Server.
• User accounts - These accounts provide applications a means to authenticate and access specific keys.
• Security officer accounts - These accounts provide access to key management functions through scamgr.

Naming Requirements

Security officer names, user names, and keystore names must meet the following requirements:

Password Requirements

Password requirements vary based on the current set passreq setting (low,
med, or high).

1. Start the scamgr utility.

2. Type set passreq.

This command sets the password character requirements for any password prompted by scamgr. There are three settings for password requirements, as shown in the following table:

1. Start the scamgr utility.

2. Type the set passreq command followed by low, med, or high.

The following commands set the password requirements for a board to high:

scamgr{mcaN@hostname, sec-officer}> set passreq high
 
scamgr{mcaN@hostname, sec-officer}> set passreq
Password security level (low/med/high): high

Only security officer passwords may be changed with scamgr. Security officers can change their own password.

1. Start the scamgr utility.

2. Type set password.

For example:

scamgr{mcaN@hostname, sec-officer}> set password
Enter new security officer password: 
Confirm password: 
Security Officer password has been set.

User passwords may be changed through the PKCS#11 interface with the Sun Java System Web Server modutil utility. Refer to the Sun Java System Web Server documentation for details.

Managing Security Officers and Users

This section describes how to populate and list security officers and users and how to enable, disable, and delete them.

There might be more than one security officer for a keystore. Security officer names are known only within the domain of the board and do not need to be identical to any user name on the host system.

1. Start the scamgr utility.

2. Type create so.

When creating a security officer, the name is an optional parameter on the command line. If the security officer name is omitted, scamgr prompts you for the name. (See Naming Requirements.) For example:

scamgr{mcaN@hostname, sec-officer}> create so Alice 
Enter new security officer password: 
Confirm password: 
Security Officer Alice created successfully.
 
scamgr{mcaN@hostname, sec-officer}> create so
New security officer name: Bob
Enter new security officer password: 
Confirm password: 
Security Officer Bob created successfully.

User names are known only within the domain of the board and do not need to be identical to the UNIX user name for the web server process.

1. Start the scamgr utility.

2. Type create user user-name.

When creating a user, the user name is an optional parameter on the command line. If the user name is omitted, scamgr prompts you for the user name. (See Naming Requirements.) For example:

scamgr{mcaN@hostname, sec-officer}> create user web-admin
Enter new user password: 
Confirm password: 
User web-admin created successfully.
 
scamgr{mcaN@hostname, sec-officer}> create user
New user name: Tom
Enter new user password: 
Confirm password: 
User Tom created successfully.

Users must use this password when authenticating during a web server startup.

Caution - Users must remember their password so they can access their keys. There is no way to retrieve a lost password.

You can list users associated with a keystore.Start the scamgr utility.

1. Type the show user command. For example:

scamgr{mcaN@hostname, sec-officer}> show user
User                                    Status    
-----------------------------------------------------
web-admin                               Enabled   
Tom                                     Enabled   
-----------------------------------------------------

You can list security officers associated with a keystore.

1. Start the scamgr utility.

2. Type the show so command. For example:

scamgr{mcaN@hostname, sec-officer}> show so
Security Officer                        Multi-Admin Role
----------------------------------------------------------------
sec-officer1                            Enabled   
sec-officer2                            Enabled   
sec-officer3                            Enabled   
sec-officer4                            Disabled  
----------------------------------------------------------------

Users and Security officers are enabled by default. Users may be disabled. Disabled users cannot access their key material with the PKCS#11 interface. Enabling a disabled user restores access to all of that user’s key material.

1. Start the scamgr utility.

2. Type disable user user-name.

When enabling or disabling a user, the user name is an optional parameter on the command line. If the user name is omitted, scamgr prompts you for the user name. For example:

scamgr{mcaN@hostname, sec-officer}> disable user Tom
User Tom disabled.
scamgr{mcaN@hostname, sec-officer}> disable user
User name: web-admin
User web-admin disabled.

1. Start the scamgr utility.

2. Type the enable user user-name command. When enabling a user, the user name is optional. For example:

scamgr{mcaN@hostname, sec-officer}> enable user Tom 
User Tom enabled.
 
scamgr{mcaN@hostname, sec-officer}> enable user
User name: web-admin
User web-admin enabled.

1. Start the scamgr utility.

2. Type delete user user-name.

When deleting a user, the user name is an optional parameter on the command line. If the user name is omitted, scamgr prompts you for the user name. For example:

scamgr{mcaN@hostname, sec-officer}> delete user web-admin
Delete user web-admin? (Y/Yes/N/No) [No]: y
User web-admin deleted successfully.
 
scamgr{mcaN@hostname, sec-officer}> delete user 
User name: Tom
Delete user Tom? (Y/Yes/N/No) [No]: y
User Tom deleted successfully.

1. Start the scamgr utility.

2. Type delete so so-name.

When deleting a security officer, the security officer name is an optional parameter on the command line. If the security officer name is omitted, scamgr prompts you for the security officer name. For example:

scamgr{mcaN@hostname, sec-officer}> delete so Bob
Delete Security Officer Bob? (Y/Yes/N/No) [No]: y
Security Officer Bob deleted.
 
scamgr{mcaN@hostname, sec-officer}> delete so 
Security Officer name: Alice
Delete Security Officer Alice? (Y/Yes/N/No) [No]: y
Security Officer Alice deleted.

Keystores are stored on the disk and encrypted in a master key. This master key is stored in the board firmware and can be backed up by a security officer.

1. Start the scamgr utility.

2. Type backup path-name.

The path name can be placed on the command line or if omitted, scamgr prompts you for the path name.

scamgr{mcaN@hostname, sec-officer}> backup /opt/backup-directory-name/bkup.data
Enter a password to protect the data: 
Confirm password: 
Backup to /opt/SUNWconn/mca/backups/bkup.data successful.

3. Set a passphrase for the backup data.

This passphrase encrypts the master key in the backup file.

Caution - Choose a passphrase that is very difficult to guess when making backup files, because this password protects the master key for your keystore. You must also remember the password you enter. Without the password, you cannot access the master key backup file. There is no way to retrieve the data protected by a lost password.

A site might have a strict security policy that does not permit the master key for a board to leave the hardware.

Caution - Once this command is issued, all attempts to back up the master key will fail. This lock persists even if the master key is rekeyed. The only way to clear this setting is to zeroize the board with the zeroizecommand. (See Perform a Software Zeroize on the Board.)

1. Start the scamgr utility.

2. Type set lock. For example:

scamgr{mcaN@hostname, sec-officer}> set lock
WARNING: Issuing this command will lock the
         master key.  You will be unable to back
         up your master key once this command
         is issued.  Once set, the only way to
         remove this lock is to zeroize the board.
Do you wish to lock the master key? (Y/Yes/N/No) [No]: y
The master key is now locked.

---

Multi-Admin Authentication

The scamgr utility includes a special mode of operation called Multi-Admin mode. In this mode, certain commands require multiple security officers to authenticate and approve the command before it can complete successfully. Security officers must be in the Multi-Admin role before they can authenticate Multi-Admin commands.

When a Multi-Admin command is issued, no other general administration on the board can take place until either the command times out, is cancelled by the security officer who started the command, or the command completes successfully. A timeout from 1 to 15 minutes must be set at or before Multi-Admin mode is enabled. See Set a Multi-Admin Command Timeout for more information. Also security officers must set the number of Multi-Admin role members required to authenticate any Multi-Admin command.

When a Multi-Admin command is initiated, the scamgr session from which it is started will wait until one of three conditions occur: The command completes successfully, the command fails, or the command times out. Other Multi-Admin role members will log in to the device using their respective scamgr sessions. During Multi-Admin mode commands, these role members can only authenticate the command in progress. If the initiating security officer’s scamgr session terminates unexpectedly, the security officer can log back in to the device and cancel the command. Otherwise, the board cannot be administered normally until the command times out.

Managing Multi-Admin Mode With scamgr

This section describes how to configure and manage Multi-Admin mode with the scamgr utility. First, you must identify your security officers and place them in the Multi-Admin role. You must have enough security officers in that role to satisfy the minimum number set with the set multiadmin minauth command. If the number of Multi-Admin role members is below the minimum threshold, you cannot enable Multi-Admin mode.

1. Start the scamgr utility.

2. Type enable authmember so-name.

If executed in Multi-Admin mode, this command requires authentication by multiple security officers assigned the Multi-Admin role. The following command assigns a security officer the Multi-Admin role.

scamgr{mcaN@hostname, sec-officer}> enable authmember sec-officer 
Added multi-admin role to Security Officer sec-officer.

1. Start the scamgr utility.

2. Type disable authmember so-name.

If executed in Multi-Admin mode, this command requires authentication by multiple security officers assigned the Multi-Admin role. For example:

scamgr{mcaN@hostname, sec-officer}> disable authmember sec-officer 
Removed multi-admin role from Security Officer rew.

This command removes security officers from the Multi-Admin role only if they are in addition to the minimum required. This command exits only if a minimum number of security officers are assigned the Multi-Admin role. See Set the Minimum Number of Security Officers Required to Authenticate Multi-Admin Commands.

1. Start the scamgr utility.

2. Type set multiadmin minauth minimum-role-members.

The minimum-role-members value must be at least two and less than or equal to the total number of security officers on the system. In addition, if Multi-Admin mode is already enabled the new value cannot exceed the number of members with the Multi-Admin role. If executed in Multi-Admin mode, this command requires authentication by multiple security officers assigned the Multi-Admin role.

For example, the following command sets the minimum number of required security officers to authenticate Multi-Admin commands.

scamgr{mcaN@hostname, sec-officer}> set multiadmin minauth 3
Multi-admin mode now requires 3 security officers to authenticate.

1. Start the scamgr utility.

2. Type set multiadmin timeout minutes.

The minutes value must be between 1 and 1440 minutes (1 day). If a value larger than 1440 is specified, the value will be set to 1440. If executed in Multi-Admin mode, this command requires authentication by multiple security officers assigned the Multi-Admin role.

For example, the following command changes the timeout for commands that require Multi-Admin mode authentication.

scamgr{mcaN@hostname, sec-officer}> set multiadmin timeout 3
New multi-admin timeout value is 3 minutes.

1. Start the scamgr utility.

2. Type enable multiadmin.

When enabled, certain commands require multiple security officers to authenticate before the command can complete successfully. When this command is executed, the security officer is presented with the current Multi-Admin mode settings and is given the opportunity to change these settings before the command completes. This command does not accept the -y (yes to all) flag.

For example, the following command enables Multi-Admin mode.

scamgr{mcaN@hostname, sec-officer}> enable multiadmin
WARNING: This command will place the device in multi-
         admin mode.  This mode will require multiple
         security officers to authenticate for certain
         commands to be executed.
 
Enable Multi-Admin Mode? (Y/Yes/N/No) [No]: y
 
Multi-Admin mode parameters:
----------------------------------------------------------------
Minimum number of admins: 3
Multi-Admin command timeout: 3 minutes
----------------------------------------------------------------
 
Is this correct? (Y/Yes/N/No) [No]: y
The board is now in multi-admin mode.

Disable Multi-Admin Mode

1. Start the scamgr utility.

2. Type disable multiadmin.

This command requires authentication by multiple security officers assigned the Multi-Admin role.

For example, the following command disables Multi-Admin mode.

scamgr{mcaN@hostname, sec-officer}> disable multiadmin

Add Additional Security Officers to the Multi-Admin Role

1. Start the scamgr utility.

2. Type enable authmember sec-officerN.

Where N is the number of the security officer.

With the minimum number of required security officers set to three, adding additional security officers requires the authorization of three different security officers, including the initiating security officer, to authenticate before this command can complete.

Execute the following command on the initiating security officer’s scamgr session.

scamgr{mca0@localhost, sec-officer1}> enable authmember sec-officer4
NOTICE: Please wait while the other required 2 administrators
        authenticate this command.  This command will time out
        in 3 minutes.
 
Update: Authenticated security officers: sec-officer1 
Update: Authenticated security officers: sec-officer1 sec-officer3 
Update: Authenticated security officers: sec-officer1 sec-officer3 sec-officer2 
Added multi-admin role to Security Officer sec-officer4.

3. Ask other security officers to log in from their respective scamgr sessions and authorize the command.

# scamgr
Security Officer Login: sec-officer3
Security Officer Password: 
NOTICE: A Multi-Admin command is currently in progress.
        You are a member of the Multi-Admin role and
        may approve this command.
Command: enable authmember sec-officer4
Initiating SO: sec-officer1
 
Authorize this command? (Y/Yes/N/No) [No]: y
Authorization successful

# scamgr
Security Officer Login: sec-officer2
Security Officer Password: 
NOTICE: A Multi-Admin command is currently in progress.
        You are a member of the Multi-Admin role and
        may approve this command.
Command: enable authmember sec-officer4
Initiating SO: sec-officer1
 
Authorize this command? (Y/Yes/N/No) [No]: y
Authorization successful

1. Start the scamgr utility.

2. Type disable authmember sec-officerN.

Where N is the number of the security officer.

For example, the following command is cancelled. This command must be entered on the initiating security officer’s scamgr session.

scamgr{mca0@localhost, sec-officer1}> disable authmember sec-officer4
NOTICE: Please wait while the other required 2 administrators
        authenticate this command.  This command will time out
        in 3 minutes.
 
Update: Authenticated security officers: sec-officer1

To cancel the command, the initiating security officer must either close the current scamgr session or log in with a second scamgr session.

# scamgr
Security Officer Login: sec-officer1
Security Officer Password: 
NOTICE: A Multi-Admin command is currently in progress.
        Since you are the admin that initiated this
        command, you have the option of cancelling it.
        If you choose not to cancel the command, you
        will be logged out and the board will continue
        with the command.
 
Cancel this command? (Y/Yes/N/No) [No]: y
Authorization successful

If the scamgr session from which the command was initiated is still active, the following message is displayed.

Failed to remove role from Security Officer sec-officer4: Command cancelled

1. Start the scamgr utility.

2. Type a command.

3. Ensure other security officers do not authenticate the command.

For example, the following command is issued by security officer.

scamgr{mca0@localhost, sec-officer1}> disable authmember sec-officer4
WARNING: Issuing this command will remove the
         multi-admin role from this security
         officer.  Once complete, this security
         officer will not be able to validate multi-
         admin commands.
 
Proceed with change? (Y/Yes/N/No) [No]: y
NOTICE: Please wait while the other required 2 administrators
        authenticate this command.  This command will time out
        in 3 minutes.
 
Update: Authenticated security officers: sec-officer1 
Update: Authenticated security officers: sec-officer1 sec-officer2 
Failed to remove role from Security Officer sec-officer4: Multi-Admin command
timeout

  Log in as a non-multi-admin security officer.

# scamgr
Security Officer Login: new-sec-officer
Security Officer Password: 
You have authenticated successfully but this board is
currently waiting for all needed approvals for a
Multi-Admin mode command.  Since you are not a member
of the Multi-Admin role, you will not be able to
administer this board until this command has completed.
 
Connection closed.

1. Start the scamgr utility.

2. Type a command as a security officer without Multi-Admin role permissions.

The command fails. For example:

scamgr{mca0@localhost, new-so}> disable multiadmin
WARNING: Issuing this command will take the board
         out of multi-admin mode and return it to the
         single-administrator mode of authentication.
 
Proceed with change? (Y/Yes/N/No) [No]: y
Failed disabling Multi-admin mode: Unauthorized command

---

Managing Boards With scamgr

This section describes how to manage boards with the scamgr utility.

1. Start the scamgr utility.

2. Type set timeout N.

Where N is the number of minutes before a security officer is automatically logged out. A value of 0 disables the automatic logout feature. The maximum delay is 1,440 minutes (1 day). A newly initialized board defaults to 5 minutes.

The following command changes the auto-logout time for a security officer to 10 minutes:

scamgr{mcaN@hostname, sec-officer}> set timeout 10

1. Start the scamgr utility.

2. Type show status.

This command displays the hardware and firmware versions for that board, the MAC address of the network interface, the status (Up, Down, speed, duplex, and so on) of the network interface, and the keystore name and ID. For example:

scamgr{mcaN@hostname, sec-officer}> show status
Board Status
-------------------------------------------------------------
Version Info:
* Hardware Version: 1.2
* Firmware Version: 1.0
* Serial Number: 36:30:30:30:30:33
 
Keystore Info:
* Keystore Name: sca6000-keystore.600003
* Keystore ID: c3270900c3270900
* Keystore Lock: Disabled
* FIPS 140-2 Mode: Disabled
 
Security Settings:
* Login Session Timeout (in minutes): 5
* Password Policy Security Level: LOW
* Number of Master Key Backups: 0
* Multiadmin Mode: Enabled
* Minimum Number of Authenticators: 2
* Multiadmin Timeout: 5 Minutes
-------------------------------------------------------------

You can update the firmware for the board as new features are added.

1. Start the scamgr utility.

2. Type load firmware path-name.

Where path-name is the path to the firmware file.

A successful update of the firmware requires you to manually reset the board with the reset command. When you reset the board, the currently logged in security officer is logged out.

scamgr{mcaN@hostname, sec-officer}> load firmware /usr/lib/crypto/firmware/sca
Security Officer Login: sec-officer
Security Officer Password:
WARNING: This command will load new firmware onto the
          the target device.  You must issue a reset
          command and log back into the target device in
          order to use the new firmware.
 
Proceed with firmware update? (Y/Yes/N/No) [No]: y

In certain situations, it might be necessary to reset the board. To do this, you must issue the reset command. You are asked if this is what you wish to do. Resetting a board might temporarily cease the acceleration of cryptography on the system unless there are other active board boards able to take over the load. Also, this command automatically logs you out of scamgr, so you must reconnect to the device by logging back into scamgr if you wish to continue administering it.

1. Start the scamgr utility.

2. Type reset.

3. Type y to proceed, type n to cancel.

For example:

scamgr{mcaN@hostname, sec-officer}> reset
WARNING: Issuing this command will reset the
         the board and close this connection.
 
Proceed with reset? (Y/Yes/N/No) [No]: y
Reset successful.

If your security policy changes, you might want to use new keys as the master key or remote access key. The rekey command enables you to regenerate either of these keys, or both.

Rekeying the master key also causes the keystore to be reencrypted under the new key, and invalidates older backed up master key files with the new keystore file. Make a backup of the master key whenever it is rekeyed. If you have multiple boards using the same keystore, you need to back up this new master key and restore it to the other boards.

Rekeying the remote access key logs the security officer out, forcing a new connection that uses the new remote access key.

1. Start the scamgr utility.

2. Type rekey.

3. Specify which keys to rekey.

You may specify one of three key types when issuing the rekey command:

The following is an example of entering a key type of all with the rekey command:

scamgr{mcaN@hostname, sec-officer}> rekey
 
Key type (master/remote/all): all
WARNING: Rekeying the master key will render all old board backups
         useless with the new keystore file. If other boards use this
         keystore, they will need to have this new key backed up and
         restored to those boards. Rekeying the remote access key will
         terminate this session and force you to log in again.
 
Rekey board? (Y/Yes/N/No) [No]: y
Rekey of master key successful.
Rekey of remote access key successful.  Logging out.

There are two methods of clearing a board of all its key material. The first method is with a hardware jumper (shunt). This form of zeroizing returns the board to its original factory state (Failsafe mode). (See Zeroizing the Sun Crypto Accelerator 6000 Hardware to the Factory State.) The second method is to use the zeroize command.

1. Start the scamgr utility.

2. Type zeroize.

3. Confirm the command.

For example:

scamgr{mcaN@hostname, sec-officer}> zeroize
WARNING: Issuing this command will zeroize all keys
         on the board.  Once zeroized, these keys
         cannot be recovered unless you have
         previously backed up your master key.
 
Proceed with zeroize? (Y/Yes/N/No) [No]: y
All keys zeroized successfully.

Diagnostics can be performed from the scamgr utility and from the SunVTS software. The diagnostics command in scamgr covers three major categories in the board hardware - general hardware, cryptographic subsystem, and network subsystem. Tests for general hardware cover DRAM, flash memory, the PCI bus, the DMA controller, and other hardware internals. Tests for the cryptographic subsystem cover random number generators and cryptographic accelerators. Tests on the network subsystem cover the sca device.

1. Start the scamgr utility.

2. Type diagnostics.

For example:

scamgr{mcaN@hostname, sec-officer}> diagnostics
Performing diagnostic tests.  This may take a few minutes...Done.
Diagnostic Results
----------------------------------------------------------------
General Hardware:               PASS
Cryptographic Subsystem:        PASS
USB Hardware:                   PASS
---------------------------------------------------------------- 

---

Using the scadiag Utility

The scadiag utility provides a command-line interface to the board that enables superusers to perform administrative tasks without authenticating as security officer. Command-line options determine the actions that scadiag performs.

To access the scadiag utility easily, place the Sun Crypto Accelerator 6000 tools directory in your search path, for example:

$ PATH=$PATH:/usr/sbin/
$ export PATH

The scadiag command-line syntax (described in TABLE 3-8) for both Oracle Solaris and Linux is as follows:

• scadiag [-?]
• scadiag [-d] mcaN
• scadiag [-f] mcaN
• scadiag [-k] mcaN
• scadiag [-l] mcaN (device name is optional)
• scadiag [-r] mcaN
• scadiag [-u] fw-file device
• scadiag [-V]
• scadiag [-z] mcaN

The Oracle Solaris specific command-line syntax for scadiag is as follows:

• scadiag [-m] [online|offline|diag] mcaN
• scadiag [-s] mcaN

The Linux specific command-line syntax for scadiag is as follows:

• scadiag [-m] [online|offline] mcaN

TABLE 3-8 describes the supported options for the scadiag utility.

The following is an example of the -d option:

# scadiag -d mca0
Running mca0 on-board diagnostics.
Diagnostics on mca0 PASSED.

The following is an example of the -f option:

# scadiag -f mca0
b605-c285-392c-1c8f-5cc6-ec61-e617-1b7f-4ded-71b0

The following is an example of the -k option:

# scadiag -k mca0
Device: mca0
Key Length: 1024 bits
Key Fingerprint: b605-c285-392c-1c8f-5cc6-ec61-e617-1b7f-4ded-71b0
Modulus:
        e4df259c 4725367a 3070ddff d78c4225 bf9a755c
        6d084667 fa043dd1 207595fb 4afdbe95 c9cca1ab
        f2a525ca 348cfffe 9c635056 94523f08 f7941797
        32d79603 3acf96c9 29c6b9ac d3f064ee 7c3a4790
        d06bf143 ce36a467 5f30332b b7782d93 17fc064b
        14438df6 679684ca afc599dc 3d1b2f87 30da4dc1
        63db86b7 48b1a29d
Public Exponent:
        00010001

The following is an example of the -l option:

# scadiag -l 
mca/0
mca/1
# scadiag -l mca0
Device mca1:
State : Online
Status : Initialized

The following is an example of the -m option (note that the diag option is Oracle Solaris only):

# scadiag -m diag mca0
Device mca0 is now in diagnostic mode.
% scadiag -l mca0
Device mca0
State : Diag
Status: Initialized

The following is an example of the -r option:

# scadiag -r mca0
Resetting device mca0, this may take a minute.
Please be patient.
Device mca0 reset ok.

The following is an example of the -s option:

# scadiag -s mca0
Device mca0 free.

The following is an example of the -u option:

# scadiag -u fw-file mca0
Updating firmware on mca0, this may take a few minutes.
Please be patient.
Firmware update on mca0 complete.
Reset required to activate new firmware.

The following is an example of the -V option:

# scadiag -V
scadiag (Sun Crypto Accelerator 6000)
Copyright 2006 Sun Microsystems, Inc.
All rights reserved.
Use is subject to license terms.

The following is an example of the -z option:

# scadiag -z mca0
Zeroizing device mca0, this may take a few minutes.
Please be patient.
Device mca0 zeroized.

---

Managing Services for Oracle Solaris Platforms

Two service daemons are provided for the board: scad and scakiod. The scad service performs administrative I/O functions between the scamgr(1m) utility and the firmware. The scakiod service performs keystore I/O services. The Fault Management Resouce Identifiers (FMRIs) for these two services are svc:/device/scad and svc:/device/scakiod.

  Use the svcadm(1m) command to start and stop the services. For example:

# svcadm enable scad
# svcadm enable scakiod
# svcadm disable scad
# svcadm disable scakiod

You can specify both services in a single command to start both simultaneously.

# svcadm enable scad scakiod

Service Configuration Parameters

TABLE 3-9 lists and describes the service parameters of the scad service.

TABLE 3-10 lists and describes the service parameters of the scakiod service.

Configuration parameters are under the SMF property group config.

  Use the svccfg(1m) command to list service properties. For example:

# svccfg -s service-name listprop

The following is an example of listing the service properties for the scakiod service:

# svccfg -s scakiod listprop
general                       framework
general/action_authorization  astring  solaris.smf.manage.sca
general/entity_stability      astring  Unstable
general/single_instance       boolean  true
fs                            dependency
fs/entities                   fmri     svc:/system/filesystem/local
fs/grouping                   astring  require_all
fs/restart_on                 astring  none
fs/type                       astring  service
start                         method
start/exec                    astring  /usr/lib/crypto/scakiod
start/group                   astring  :default
start/limit_privileges        astring  :default
start/privileges              astring  :default
start/project                 astring  :default
start/resource_pool           astring  :default
start/supp_groups             astring  :default
start/timeout_seconds         count    30
start/type                    astring  method
start/use_profile             boolean  false
start/user                    astring  daemon
start/working_directory       astring  :default
stop                          method
stop/exec                     astring  :kill
stop/timeout_seconds          count    30
stop/type                     astring  method
config                        application
config/debuglevel             astring  NOTICE
config/keystore_dir           astring  /var/sca/keydata
config/log_file               astring  /var/sca/log/scakiod.log
config/value_authorization    astring  solaris.smf.manage.sca
tm_common_name                template
tm_common_name/C              ustring  "Sun Crypto Accelerator"
tm_man_scakiod                template
tm_man_scakiod/manpath        astring  /usr/share/man
tm_man_scakiod/section        astring  1M
tm_man_scakiod/title          astring  scakiod

Use the svccfg(1m) command to modify a property as follows:

# svccfg -s service-name setprop config/property-name=value

For example, the following command defines the hostbind property:

# svccfg -s scad setprop config/hostbind=host: host1 host2 ...

---

Additional Instructions for Administering the Board on Linux Platforms

Administering the board on Linux platforms is similar to Oracle Solaris. The differences are given in this section.

The scamgr program is installed in the /opt/sun/sca6000/bin directory. You can put this directory in your path or directly launch the program with the following command:

% /opt/sun/sca6000/bin/scamgr

A newly installed board must be initialized before using (see Initializing the Board With scamgr). In addition, the board must be re-initialized after performing a zeroize (see Appendix E) with the scamgr program (see Using the scamgr Utility).

The board must be stopped and restarted after initialization or a zeroize. Use the following commands to stop and start the board:

% /etc/init.d/sca stop
% /etc/init.d/sca start

The scadiag program is installed in the /opt/sun/sca6000/sbin directory. You can place this directory in your path or directly launch the program with the following command:

% /opt/sun/sca6000/sbin/scadiag

The scad and scakiod daemons are installed in /opt/sun/sca6000/sbin directory. Do not start or stop these daemons manually. Stop and start the board to stop and start these daemons.

Sun Crypto Accelerator 6000 Board User’s Guide for Version 1.0

819-5536-12

Copyright © 2010, Oracle and/or its affiliates. All rights reserved.