4 - C H A P T E R -

C H A P T E R 4

Administering the Sun Crypto Accelerator 4000 Board With the vcaadm and vcadiag Utilities

This chapter provides an overview of the vcaadm and vcadiag utilities. The following sections are included:

Using vcaadm

Logging In and Out With vcaadm

Entering Commands With vcaadm

Initializing the Sun Crypto Accelerator 4000 Board With vcaadm

Managing Keystores With vcaadm

Managing Boards With vcaadm

Using vcadiag

Using `vcaadm`

The vcaadm program offers a command-line interface to the Sun Crypto Accelerator 4000 board. Only users designated as security officers are allowed to use the vcaadm utility. When you first connect to a Sun Crypto Accelerator 4000 board with vcaadm, you are prompted to create an initial security officer and password.

To access the vcaadm program easily, place the Sun Crypto Accelerator 4000 tools directory in your search path, for example:

$ PATH=$PATH:/opt/SUNWconn/bin

$ export PATH

The vcaadm command-line syntax is:

vcaadm [-H]

vcaadm [-y] [-h host] [-p port] [-d vcaN] [-f filename]

vcaadm [-y] [-h host] [-p port] [-d vcaN] [-s sec_officer] command

Note - When using the -d attribute, vcaN is the board's device name where the N corresponds to the Sun Crypto Accelerator 4000 device instance number.

TABLE 4-1 shows the options for the vcaadm utility.


Option	Meaning
`-H`	Displays help files for `vcaadm` commands and exit.
`-d vcaN`	Connects to the Sun Crypto Accelerator 4000 board that has `N` as the driver instance number. For example, `-d vca1` connects to device `vca1` where `vca` is a string in the board's device name and 1 is the instance number of the device. This value defaults to `vca0` and must be in the form of `vcaN`, where `N` corresponds to the device instance number.
`-f` filename	Interprets one or more commands from `filename` and exit.
`-h host`	Connects to the Sun Crypto Accelerator 4000 board on `host.` The value for `host` can be a host name or an IP address, and defaults to the loopback address.
`-p port`	Connects to the Sun Crypto Accelerator 4000 board on `port. The value for port` defaults to 6870.
`-s sec_officer`	Logs in as a security officer named `sec_officer.`
`-y`	Forces a yes answer to any command that would normally prompt for a confirmation.

Note - The name sec_officer is used throughout this user's guide as an example security officer name.

Modes of Operation

vcaadm can run in one of three modes. These modes differ mainly in how commands are passed into vcaadm. The three modes are Single-Command mode, File mode, and Interactive mode.

Note - To use vcaadm, you must authenticate as security officer. How often you need to authenticate as security officer is determined by which operating mode you are using.

Single-Command Mode

In Single-Command mode, you must authenticate as security officer for every command. Once the command is executed, you are logged out of vcaadm.

When entering commands in Single-Command mode, you specify the command to be run after all the command-line switches are specified. For example, in Single-Command mode, the following command would show all the users in a given keystore and return the user to the command shell prompt.

$ vcaadm show user

Security Officer Name: sec_officer

Security Officer Password:

The following command performs a login as the security officer, sec_officer, and creates the user web_admin in the keystore.

$ vcaadm -s sec_officer create user web_admin

Security Officer Password:

Enter new user password:

Confirm password:

User web_admin created successfully.

Note - The first password is for the security officer, followed by the password and confirmation for the new user web_admin.

All output from Single-Command mode goes to the standard output stream. This output can be redirected using standard UNIX shell-based methods.

File Mode

In File mode, you must authenticate as security officer for every file you run. You are logged out of vcaadm after the commands in the command file are executed.

To enter commands in File mode, you specify a file from which vcaadm reads one or more commands. The file must be ASCII text, consisting of one command per line. Begin each comment with a pound sign (#) character. If the File mode option is set, vcaadm ignores any command-line arguments after the last option. The following example runs the commands in the deluser.scr file and answers all prompts in the affirmative:

$ vcaadm -f deluser.scr -y

Interactive Mode

In Interactive mode, you must authenticate as security officer every time you connect to a board. This is the default operating mode for vcaadm. To logout of vcaadm in Interactive mode, use the logout command. Refer to Logging In and Out With vcaadm.

Interactive mode presents the user with an interface similar to ftp(1), where commands can be entered one at a time. The -y option is not supported in interactive mode.

Logging In and Out With `vcaadm`

When you use vcaadm from the command-line and specify host, port, and device using the -h, -p, and -d attributes respectively, you are immediately prompted to log in as security officer if a successful network connection was made.

The vcaadm program establishes an encrypted network connection (channel) between the vcaadm application and the Sun Crypto Accelerator 4000 firmware running on a specific board.

During setup of the encrypted channel, boards identify themselves by their hardware Ethernet address and an RSA public key. A trust database ($HOME/.vcaadm/trustdb) is created the first time vcaadm connects to a board. This file contains all of the boards that are currently trusted by the security officer.

Logging In to a Board With `vcaadm`

If the security officer connects to a new board, vcaadm will notify the security officer and prompt the following options:

1. Abort the connection

2. Trust the connection one time only (no changes to trust

   database)

3. Trust this board forever (adds the hardware ethernet address

   and RSA public key to the trust database).

If the security officer connects to a board that has a remote access key that has been changed, vcaadm will notify the security officer and prompt the following three options:

1. Abort the connection

2. Trust the connection one time only (no changes to trust

   database)

3. Replace the old public key bound to this hardware ethernet

   address with the new public key.

Logging In to a New Board

Note - The remaining examples in this chapter were created with the Interactive mode of vcaadm.

When connecting to a new board, vcaadm must create a new entry in the trust database. The following is an example of logging in to a new board.

# vcaadm -h hostname

Warning: MAC ID and Public Key Not Found

-----------------------------------------------------

The MAC ID and public key presented by this board were

not found in your trust database.

MAC ID: 08:00:20:EE:EE:EE

Key Fingerprint: 29FC-7A54-4014-442F-7FD9-5FEA-8411-CFB4

-----------------------------------------------------

Please select an action:

1. Abort this connection

2. Trust the board for this session only.

3. Trust the board for all future sessions.

Your Choice -->

Logging In to a Board With a Changed Remote Access Key

When connecting to a board that has a changed remote access key, vcaadm must change the entry corresponding to the board in the trust database. The following is an example of logging in to a board with a changed remote access key.

# vcaadm -h hostname

Warning: Public Key Conflict

-----------------------------------------------------

The public key presented by the board you are connecting

to is different than the public key that is trusted for

this MAC ID.

MAC ID: 08:00:20:EE:EE:EE

New Key Fingerprint: 29FC-7A54-4014-442F-7FD9-5FEA-8411-CFB4

Trusted Key Fingerprint: A508-38D1-FED8-8103-7ACC-0D19-C9C9-11F2

-----------------------------------------------------

Please select an action:

1. Abort this connection

2. Trust the board for this session only.

3. Replace the current trusted key with the new key.

Your Choice -->

`vcaadm` Prompt

The vcaadm prompt in Interactive mode is displayed as follows:

vcaadm{vcaN@hostname, sec_officer}> command

The following table describes the vcaadm prompt variables:


Prompt Variable	Definition
`vca`N	`vca` is a string that represents the Sun Crypto Accelerator 4000 board. N is the device instance number (unit address) that is in the device path name of the board. Refer to To Set Driver Parameters Using a vca.conf File for details on retrieving this number for a device.
hostname	The name of the host for which the Sun Crypto Accelerator 4000 board is physically connected. hostname may be replaced with the physical host's IP address.
`sec_officer`	The name of the security officer that is currently logged in to the board.

Logging Out of a Board With `vcaadm`

If you are working in Interactive mode, you may want to disconnect from one board and connect to another board without completely exiting vcaadm. To disconnect from a board and logout, but remain in Interactive mode, use the logout command:

vcaadm{vcaN@hostname, sec_officer}> logout

vcaadm>

In the previous example, notice the vcaadm> prompt no longer displays the device instance number, hostname, or security officer name. To log in to another device, type the connect command with the following optional parameters.


Parameter	Meaning
`dev vca`N	Connect to the Sun Crypto Accelerator 4000 board with the driver instance number of N. For example `-d vca1` connects to the device `vca1`; this defaults to device `vca0`.
`host` hostname	Connect to the Sun Crypto Accelerator 4000 board on hostname (defaults to the loopback address). hostname may be replaced with the physical host's IP address.
`port` port	Connect to the Sun Crypto Accelerator 4000 board on port port (defaults to 6870).

Example:

vcaadm{vcaN@hostname, sec_officer}> logout

vcaadm> connect host hostname dev vca2

Security Officer Login: sec_officer

Security Officer Password:

vcaadm{vcaN@hostname, sec_officer}>

vcaadm will not let you issue the connect command if you are already connected to a Sun Crypto Accelerator 4000 board. You must first logout and then issue the connect command.

Each new connection will cause vcaadm and the target Sun Crypto Accelerator 4000 firmware to renegotiate new session keys to protect the administrative data that is sent.

Entering Commands With `vcaadm`

The vcaadm program has a command language that must be used to interact with the Sun Crypto Accelerator 4000 board. Commands are entered using all or part of a word (enough to uniquely identify that word from any other possibilities). Entering sh instead of show would work, but re is ambiguous because it could be reset or rekey.

The following example shows entering commands using entire words:

vcaadm{vcaN@hostname, sec_officer}> show user

User                                    Status

-----------------------------------------------------

web_admin                                enabled

Tom                                    enabled

-----------------------------------------------------

The same information can be obtained in the previous example using partial words as commands, such as sh us.

An ambiguous command produces an explanatory response:

vcaadm{vcaN@hostname, sec_officer}> re

Ambiguous command: re

Getting Help for Commands

vcaadm has built-in help functions. To get help, you must enter a question mark (?) character following the command you want more help on. If an entire command is entered and a "?" exists anywhere on the line, you will get the syntax for the command, for example:

vcaadm{vcaN@hostname, sec_officer}> create ?

Sub-Command                     Description

-----------------------------------------------------

so                              Create a new security officer

user                            Create a new user

vcaadm{vcaN@hostname, sec_officer}> create user ?

Usage: create user [<username>]

vcaadm{vcaN@hostname, sec_officer}> set ?

Sub-Command                     Description

-----------------------------------------------------

passreq                         Set password requirements

password                        Change an existing security officer password

timeout                         Set the auto-logout time

You can also enter a question mark at the vcaadm prompt to see a list of all of the vcaadm commands and their description, for example:

vcaadm{vcaN@hostname, sec_officer}> ?

Sub-Command                     Description

-----------------------------------------------------

backup                          Backup master key

connect                         Begin admin session with firmware

create                          Create users and accounts

delete                          Delete users and accounts

diagnostics                     Run diagnostic tests

disable                         Disable a user

enable                          Enable a user

exit                            Exit vcaadm

loadfw                          Load new firmware

logout                          Logout current session

quit                            Exit vcaadm

rekey                           Generate new system keys

reset                           Reset the hardware

set                             Set operating parameters

show                            Show system settings

zeroize                         Delete all keys and reset board

When not in vcaadm Interactive mode, the "?" character could be interpreted by the shell in which you are working. In this case, be sure to use the command shell escape character before the question mark.

Quitting the `vcaadm` Program in Interactive Mode

Two commands allow you to exit from vcaadm: quit and exit. The Ctrl-D key sequence also exits from vcaadm.

Initializing the Sun Crypto Accelerator 4000 Board With `vcaadm`

The first step in configuring a Sun Crypto Accelerator 4000 board is to initialize it. When you initialize a board it is necessary to create a keystore, refer to Concepts and Terminology. You can either initialize the Sun Crypto Accelerator 4000 board with a new keystore or use a backup file to initialize the board to use an existing keystore.

When you first connect to a Sun Crypto Accelerator 4000 board with vcaadm, you are prompted to initialize the board with a new keystore or initialize the board to use an existing keystore which is stored in a backup file. vcaadm prompts you for all of the required information for either type of board initialization.

To Initialize the Sun Crypto Accelerator 4000 Board With a New Keystore

1. Enter vcaadm at a command prompt of the system with the Sun Crypto Accelerator 4000 board installed or enter vcaadm -h hostname if the system is remote, and select 1 to initialize the board:

# vcaadm -h hostname

This board is uninitialized.

You will now initialize the board.  You may

either completely initialize the board and

start with a new keystore or restore the board

using a backup file.

1. Initialize the board with a new keystore

2. Initialize the board to use an existing keystore

Your Choice (0 to exit) --> 1

2. Create an initial security officer name and password (Refer to Naming Requirements):

Initial Security Officer Name: sec_officer

Initial Security Officer Password:

Confirm Password:

3. Create a keystore name (Refer to Naming Requirements):

Keystore Name: keystore_name

4. Select FIPS 140-2 mode or non-FIPS mode.

When in FIPS mode the Sun Crypto Accelerator 4000 board is FIPS 140-2, level 3 compliant. FIPS 140-2 is a federal information processing standard that requires tamper-resistance and a high level of data integrity and security. Refer to the FIPS 140-2 document located at:
http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

Run in FIPS 140-2 mode? (Y/Yes/N/No) [No]: y

Note - Before an essential parameter is changed or deleted, or before a command is executed that may have drastic consequences, vcaadm prompts you to enter Y, Yes, N, or No to confirm. These values are not case sensitive; the default is No.

5. Verify the configuration information:

Board initialization parameters:

-----------------------------------------------------

Initial Security Officer Name: sec_officer

Keystore name: keystore_name

Run in FIPS 140-2 Mode: Yes

-----------------------------------------------------

Is this correct? (Y/Yes/N/No) [No]: y

Initializing crypto accelerator board...

Initializing the Sun Crypto Accelerator 4000 Board to Use an Existing Keystore

If you are adding multiple boards to a single keystore, you might want to initialize all of the boards to use the same keystore information. In addition, you might want to restore a Sun Crypto Accelerator 4000 board to the original keystore configuration. This section describes how to initialize a board to use an existing keystore which is stored in a backup file.

You must first create a backup file of an existing board configuration before performing this procedure. Creating and restoring a backup file requires a password to encrypt and decrypt the data in the backup file. Refer to Backing Up the Master Key.

To Initialize the Sun Crypto Accelerator 4000 Board to Use an Existing Keystore

1. Enter vcaadm at a command prompt of the system with the Sun Crypto Accelerator 4000 board installed or enter vcaadm -h hostname if the system is remote, and select 2 to restore the board from a backup:

# vcaadm -h hostname

This board is uninitialized.

You will now initialize the board.  You may

either completely initialize the board and

start with a new keystore or restore the board

using a backup file.

1. Initialize the board with a new keystore

2. Initialize the board to use an existing keystore

Your Choice (0 to exit) --> 2

2. Enter the path and password to the backup file:

Enter the path to the backup file: /tmp/board-backup

Password for restore file:

3. Verify the configuration information:

Board restore parameters:

-----------------------------------------------------

Path to backup file: /tmp/board-backup

Keystore name: keystore_name

-----------------------------------------------------

Is this correct? (Y/Yes/N/No) [No]: y

Restoring data to crypto accelerator board...

Managing Keystores With `vcaadm`

A keystore is a repository for key material. Associated with a keystore are security officers and users. Keystores not only provide storage, but a means for key objects to be owned by user accounts. This enables keys to be hidden from applications that do not authenticate as the owner. Keystores have three components:

Key objects - Long-term keys that are stored for applications such as the Sun ONE Web Server.

User accounts - These accounts provide applications a means to authenticate and access specific keys.

Security officer accounts - These accounts provide access to key management functions through vcaadm.

Note - A single Sun Crypto Accelerator 4000 board must have exactly one keystore. Multiple Sun Crypto Accelerator 4000 boards can be configured to collectively work with the same keystore to provide additional performance and fault-tolerance.

Naming Requirements

Security officer names, user names, and keystore names must meet the following requirements:


Name Requirement	Description
Minimum length	At least one character
Maximum length	63 characters for user names and 32 characters for keystore names
Valid characters	Alphanumeric, underscore (_), dash (-), and dot (.)
First character	Must be alphabetic

Password Requirements

Password requirements vary based on the current set passreq setting (low,
med, or high).

Setting the Password Requirements

Use the set passreq command to set the password requirements for the Sun Crypto Accelerator 4000 board. This command sets the password character requirements for any password prompted by vcaadm. There are three settings for password requirements:


Password Setting	Requirements
`low`	Does not require any password restrictions. This is the default while the board is in non-FIPS mode.
`med`	Requires six characters minimum, one character must be nonalphabetic. This is the default setting while the board is in FIPS 140-2 mode and is the minimum password requirements allowed in FIPS 140-2 mode.
`high`	Requires eight characters minimum, three characters must be alphabetic, and one character must be nonalphabetic. This is not a default setting and must be configured manually.

To change the password requirements, enter the set passreq command followed by low, med, or high. The following commands set the password requirements for a Sun Crypto Accelerator 4000 board to high:

vcaadm{vcaN@hostname, sec_officer}> set passreq high

vcaadm{vcaN@hostname, sec_officer}> set passreq

Password security level (low/med/high): high

Populating a Keystore With Security Officers

There may be more than one security officer for a keystore. Security officer names are known only within the domain of the Sun Crypto Accelerator 4000 board and do not need to be identical to any user name on the host system.

When creating a security officer, the name is an optional parameter on the command line. If the security officer name is omitted, vcaadm will prompt you for the name. (See Naming Requirements.)

vcaadm{vcaN@hostname, sec_officer}> create so Alice

Enter new security officer password:

Confirm password:

Security Officer Alice created successfully.

vcaadm{vcaN@hostname, sec_officer}> create so

New security officer name: Bob

Enter new security officer password:

Confirm password:

Security Officer Bob created successfully.

Populating a Keystore With Users

These user names are known only within the domain of the Sun Crypto Accelerator 4000 board and do not need to be identical to the UNIX user name that the web server process actually runs as.

When creating a user, the user name is an optional parameter on the command line. If the user name is omitted, vcaadm will prompt you for the user name. (See Naming Requirements.)

vcaadm{vcaN@hostname, sec_officer}> create user web_admin

Enter new user password:

Confirm password:

User web_admin created successfully.

vcaadm{vcaN@hostname, sec_officer}> create user

New user name: Tom

Enter new user password:

Confirm password:

User Tom created successfully.

Users must use this password when authenticating during a web server startup.

Caution - User's must remember their password. Without the password, the users cannot access their keys. There is no way to retrieve a lost password.

Note - The user account is logged out if no commands are entered for more than five minutes. This is a tunable option; see Setting the Auto-Logout Time for details.

Listing Users and Security Officers

To list users or security officers associated with a keystore, enter the show user or show so commands.

vcaadm{vcaN@hostname, sec_officer}> show user

User                                    Status

-----------------------------------------------------

web_admin                               Enabled

Tom                                     Enabled

-----------------------------------------------------

vcaadm{vcaN@hostname, sec_officer}> show so

Security Officer

-----------------------------------------------------

sec_officer

Alice

Bob

-----------------------------------------------------

Changing Passwords

Only security officer passwords may be changed with vcaadm, and the only password that security officers can change are their own. Use the set password command to change security officer passwords.

vcaadm{vcaN@hostname, sec_officer}> set password

Enter new security officer password:

Confirm password:

Security Officer password has been set.

User passwords may be changed through the PKCS#11 interface with the Sun ONE Web Server modutil utility. Refer to the Sun ONE Web Server documentation for modutil for details.

Enabling or Disabling Users

Note - Security officers cannot be disabled. Once a security officer is created, it is enabled until it is deleted.

By default each user is created in the enabled state. Users may be disabled. Disabled users cannot access their key material with the PKCS#11 interface. Enabling a disabled user will restore access to all of that user's key material.

When enabling or disabling a user, the user name is an optional parameter on the command line. If the user name is omitted, vcaadm will prompt you for the user name. To disable a user account, enter the disable user command.

vcaadm{vcaN@hostname, sec_officer}> disable user Tom

User Tom disabled.

vcaadm{vcaN@hostname, sec_officer}> disable user

User name: web_admin

User web_admin disabled.

To enable an account, enter the enable user command.

vcaadm{vcaN@hostname, sec_officer}> enable user Tom

User Tom enabled.

vcaadm{vcaN@hostname, sec_officer}> enable user

User name: web_admin

User web_admin enabled.

Deleting Users

Issue the delete user command and specify the user to be deleted. When deleting a user, the user name is an optional parameter on the command line. If the user name is omitted, vcaadm will prompt you for the user name.

vcaadm{vcaN@hostname, sec_officer}> delete user web_admin

Delete user web_admin? (Y/Yes/N/No) [No]: y

User web_admin deleted successfully.

vcaadm{vcaN@hostname, sec_officer}> delete user

User name: Tom

Delete user Tom? (Y/Yes/N/No) [No]: y

User Tom deleted successfully.

Deleting Security Officers

Issue the delete so command and specify the security officer to be deleted. When deleting a security officer, the security officer name is an optional parameter on the command line. If the security officer name is omitted, vcaadm will prompt you for the security officer name.

vcaadm{vcaN@hostname, sec_officer}> delete so Bob

Delete Security Officer Bob? (Y/Yes/N/No) [No]: y

Security Officer Bob deleted.

vcaadm{vcaN@hostname, sec_officer}> delete so

Security Officer name: Alice

Delete Security Officer Alice? (Y/Yes/N/No) [No]: y

Security Officer Alice deleted.

Backing Up the Master Key

Keystores are stored on the disk and encrypted in a master key. This master key is stored in the Sun Crypto Accelerator 4000 firmware and can be backed up by a security officer.

To back up the master key, use the backup command. The backup command requires a path name to a backup file where the backup will be stored. This path name can be placed on the command line or if omitted, vcaadm will prompt you for the path name.

A password must be set for the backup data. This password is used to encrypt the master key that is in the backup file.

vcaadm{vcaN@hostname, sec_officer}> backup /opt/SUNWconn/vca/backups/bkup.data

Enter a password to protect the data:

Confirm password:

Backup to /opt/SUNWconn/vca/backups/bkup.data successful.

Caution - You should choose a password that is very difficult to guess when making backup files because this password protects the master key for your keystore. You must also remember the password you enter. Without the password, you cannot access the master key backup file. There is no way to retrieve the data protected by a lost password.

Locking the Keystore to Prevent Backups

A site might have a strict security policy that doesn't allow the master key for a Sun Crypto Accelerator 4000 board to ever leave the hardware. This can be enforced using the set lock command.

Caution - Once this command is issued, all attempts to back up the master key will fail. This lock persists even if the master key is rekeyed. The only way to clear this setting is to zeroize the Sun Crypto Accelerator 4000 board with the zeroize command. Refer to Zeroizing a Sun Crypto Accelerator 4000 Board.

vcaadm{vcaN@hostname, sec_officer}> set lock

WARNING: Issuing this command will lock the

         master key.  You will be unable to back

         up your master key once this command

         is issued.  Once set, the only way to

         remove this lock is to zeroize the board.

Do you wish to lock the master key? (Y/Yes/N/No) [No]: y

The master key is now locked.

Managing Boards With `vcaadm`

This section describes how to manage Sun Crypto Accelerator 4000 boards with the vcaadm utility.

Setting the Auto-Logout Time

To customize the amount of time before a security officer is automatically logged out of the board, use the set timeout command. To change the auto-logout time, enter the set timeout command followed by a single number that is the number of minutes before a security officer is automatically logged out. A value of 0 will disable the automatic logout feature and the maximum delay is 1,440 minutes (1 day). A newly initialized Sun Crypto Accelerator 4000 board will default to 5 minutes.

The following command changes the auto-logout time for a security officer to 10 minutes:

vcaadm{vcaN@hostname, sec_officer}> set timeout 10

Displaying Board Status

To get the current status of a Sun Crypto Accelerator 4000 board, issue the show status command. This displays the hardware and firmware versions for that board, the MAC address of the network interface, the status (Up versus Down, speed, duplex, and so on.) of the network interface, and the keystore name and ID.

vcaadm{vcaN@hostname, sec_officer}> show status

Board Status

----------------------------------------------------------------

Hardware Version: 1.0

Firmware Version: 1.0

Bootstrap Firmware Version: VCA Crypto Accelerator 1.0  March 2003

Current Firmware Version: VCA Crypto Accelerator 1.0  March 2003

MAC Address: 00:03:ba:0e:96:aa

Interface information: Link up, 1000Mbps, Full Duplex

Keystore Name: keystore_name

Keystore ID: 832aece03e654790

Login Session Timeout (in minutes): 10

Password policy security level: HIGH

Number of master key backups: 0

* Device is in FIPS 140-2 Mode

----------------------------------------------------------------

Determining if the Board is Operating in FIPS 140-2 Mode

If the Sun Crypto Accelerator 4000 board is operating in FIPS 140-2 mode, the show status command will print the following line:

* Device is in FIPS 140-2 Mode

If the board is not operating in FIPS 140-2 mode, the show status command will not print a line specifying FIPS 140-2 mode.

You can also use the kstat(1M) utility to determine if the board is operating in FIPS 140-2 mode. The kstat(1M) parameter, vs-mode, returns a value of FIPS if the board is operating in FIPS 140-2 mode. Refer to Sun Crypto Accelerator 4000 Cryptographic and Ethernet Driver Operating Statistics and the online manual page and for kstat(1M).

Loading New Firmware

It is possible to update the firmware for the Sun Crypto Accelerator 4000 board as new features are added. To load firmware, issue the loadfw command and provide a path to the firmware file.

A successful update of the firmware requires you to manually reset the board with the reset command. When you reset the board, the currently logged in security officer is logged out.

vcaadm{vcaN@hostname, sec_officer}> loadfw /opt/SUNWconn/cryptov2/firmware/sca4000fw

Security Officer Login: sec_officer

Security Officer Password:

WARNING: This command will load new firmware onto the

          the target device.  You must issue a reset

          command and log back into the target device in

          order to use the new firmware.

Proceed with firmware update? (Y/Yes/N/No) [No]: y

Resetting a Sun Crypto Accelerator 4000 Board

In certain situations, it might be necessary to reset the board. To do this, you must issue the reset command. You will be asked if this is what you wish to do. Resetting a Sun Crypto Accelerator 4000 board may temporarily cease the acceleration of cryptography on the system unless there are other active Sun Crypto Accelerator 4000 boards able to take over the load. Also, this command will automatically log you out of vcaadm, so you must reconnect to the device by logging back into vcaadm if you wish to continue administering it.

vcaadm{vcaN@hostname, sec_officer}> reset

WARNING: Issuing this command will reset the

         the board and close this connection.

Proceed with reset? (Y/Yes/N/No) [No]: y

Reset successful.

Rekeying a Sun Crypto Accelerator 4000 Board

Over time, it may be necessary because of your security policy to use new keys as the master key or remote access key. The rekey command allows you to regenerate either of these keys, or both.

Rekeying the master key also causes the keystore to be reencrypted under the new key, and invalidates older backed up master key files with the new keystore file. It is advisable to make a backup of the master key whenever it is rekeyed. If you have multiple Sun Crypto Accelerator 4000 boards using the same keystore, you will need to backup this new master key and restore it to the other boards.

Rekeying the remote access key logs the security officer out, forcing a new connection that uses the new remote access key.

You may specify one of three key types when issuing the rekey command:


Key Type	Action
`master`	Rekey the master key.
`remote`	Rekey the remote access key. Logs the security officer out.
`all`	Rekeys both master and remote access keys.

The following is an example of entering a key type of all with the rekey command:

vcaadm{vcaN@hostname, sec_officer}> rekey

Key type (master/remote/all): all

WARNING: Rekeying the master key will render all old board backups

         useless with the new keystore file. If other boards use this

         keystore, they will need to have this new key backed up and

         restored to those boards. Rekeying the remote access key will

         terminate this session and force you to log in again.

Rekey board? (Y/Yes/N/No) [No]: y

Rekey of master key successful.

Rekey of remote access key successful.  Logging out.

Zeroizing a Sun Crypto Accelerator 4000 Board

In some situations, it might be necessary to clear a board of all its key material. This can be done using two methods. The first method is with a hardware jumper; this form of zeroizing will return the Sun Crypto Accelerator 4000 board to its original factory state (failsafe mode). See Zeroizing the Sun Crypto Accelerator 4000 Hardware to the Factory State. The second method is to use the zeroize command.

Note - The zeroize command only removes the key material, and leaves any updated firmware intact. This command also logs the security officer out upon successful completion.

To zeroize a board with the zeroize command, enter the following:

vcaadm{vcaN@hostname, sec_officer}> zeroize

WARNING: Issuing this command will zeroize all keys

         on the board.  Once zeroized, these keys

         cannot be recovered unless you have

         previously backed up your master key.

Proceed with zeroize? (Y/Yes/N/No) [No]: y

All keys zeroized successfully.

Using the `vcaadm` `diagnostics` Command

Diagnostics can be run from the vcaadm utility in addition to SunVTS. The diagnostics command in vcaadm covers three major categories in the Sun Crypto Accelerator 4000 hardware: general hardware, cryptographic subsystem, and network subsystem. Tests for general hardware cover DRAM, flash memory, the PCI bus, the DMA controller, and other hardware internals. Tests for the cryptographic subsystem cover random number generators and cryptographic accelerators. Tests on the network subsystem cover the vca device.

vcaadm{vcaN@hostname, sec_officer}> diagnostics

Performing diagnostic tests...Done.

Diagnostic Results

-----------------------------------------------------

General Hardware:               PASS

Cryptographic Subsystem:        PASS

Network Subsystem:              PASS

-----------------------------------------------------

Using `vcadiag`

The vcadiag program provides a command-line interface to the Sun Crypto Accelerator 4000 board that enables root users to perform administrative tasks without authenticating as security officer. Command-line options determine the actions that vcadiag performs.

To access the vcadiag program easily, place the Sun Crypto Accelerator 4000 tools directory in your search path, for example:

$ PATH=$PATH:/opt/SUNWconn/bin

$ export PATH

The vcadiag command-line syntax is:

vcadiag [-D] vcaN

vcadiag [-F] vcaN

vcadiag [-K] vcaN

vcadiag [-Q]

vcadiag [-R] vcaN

vcadiag [-Z] vcaN

Note - When using the [-DFKRZ] attributes, vcaN is the board's device name where the N corresponds to the Sun Crypto Accelerator 4000 device instance number.

TABLE 4-1 shows the options for the vcadiag utility.


Option	Meaning
`-D vca`N	Performs diagnostics on the Sun Crypto Accelerator 4000 board.
`-F vca`N	Displays the public key fingerprint used by the Sun Crypto Accelerator 4000 board for securing administration sessions.
`-K vca`N	Displays the public key and the public key fingerprint used by the Sun Crypto Accelerator 4000 board for securing administration sessions.
`-Q`	Provides information about Sun Crypto Accelerator 4000 devices and software components. Output is a colon-separated list of the following pieces of information: device, internal function, keystore name, keystore serial number, and keystore reference count. You can use this command to determine the association between devices and keystores.
`-R vca`N	Resets the Sun Crypto Accelerator 4000 board.
`-Z vca`N	Zeroizes the Sun Crypto Accelerator 4000 board.

The following is an example of the -D option:

# vcadiag -D vca0

Running vca0 on-board diagnostics.

Diagnostics on vca0 PASSED.

The following is an example of the -F option:

# vcadiag -F vca0

5f26-b516-83b4-d254-a75f-c70d-0544-4de6

The following is an example of the -K option:

# vcadiag -K vca0

Device: vca0

Key Length: 1024 bits

Key Fingerprint: 5f26-b516-83b4-d254-a75f-c70d-0544-4de6

Modulus:

        b7215a99 8bb0dfe9 389363a0 44dac2b0 7c884161

        20ee8c8b d751437d 4e6a5cdb 76fdcb2a ad353c0b

        248edc1d 3c76591d dbca5997 f6ee8022 e8bb5a6d

        465a4f8c 601d46be 573e8681 506e5d8d f240a0db

        11d5c095 2d237061 df27b2de c353900f f531092b

        7d9a755b c5d79782 95a1180b e17303bb aca939ef

        006c73f7 74469031

Public Exponent:

00010001

The following is an example of the -Q option:

# vcadiag -Q

vca0:cb

vca0:cb:keystore_name:83097c2b3e35ef5b:1

vca0:ca

vca0:ca:keystore_name:83097c2b3e35ef5b:1

kcl2pseudo

vca0:om

vca0:om:keystore_name:83097c2b3e35ef5b:1

libkcl

The following is an example of the -R option:

# vcadiag -R vca0

Resetting device vca0, this may take a minute.

Please be patient.

Device vca0 reset ok.

The following is an example of the -Z option:

# vcadiag -Z vca0

Zeroizing device vca0, this may take a few minutes.

Please be patient.

Device vca0 zeroized.

Using vcaadm