CyberArk Conjur: nShield HSM Integration Guide

Two container images were created for the purpose of this integration: a hardserver container, and a CyberArk Conjur application container. These images are stored in an external registry:

• nshield-hwsp

  A hardserver container image that controls communication between the HSM(s) and the application containers.

• conjur-appliance

  An Application Access Manager (AAM) container image from CyberArk that will host the Master DAP Server.

We have successfully tested nShield HSM integration with CyberArk Conjur in the following configurations:

We have successfully tested with the following nShield hardware and software versions:

Connect XC

Connect +

Before installing these products, read the associated documentation:

• For the nShield HSM: Installation Guide and User Guide .

• If nShield Remote Administration is to be used: nShield Remote Administration User Guide .

• nShield Container Option Pack User Guide .

• AAM DAP Deployment ( https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/12.3/en/Content/Deployment/DAP/dap-deploy-dap.htm?tocpath=Setup%7CSet%20up%20Conjur%20Enterprise%20(Docker)%7C _ 3)

• HSM Master Key Encryption ( https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/12.3/en/Content/Deployment/DAP/dap-deploy-dap.htm?tocpath=Setup%7CSet%20up%20Conjur%20Enterprise%20(Docker)%7C_3 )

Furthermore, the following design decisions have an impact on how the HSM is installed and configured:

• Whether your Security World must comply with FIPS 140-2 Level 3 standards.

  If using FIPS Restricted mode, it is advisable to create an OCS for FIPS authorization. For information about limitations on FIPS authorization, see the Installation Guide of the nShield HSM.

• Whether to instantiate the Security World as recoverable or not.

For more information about OS support, contact your CyberArk sales representative or Entrust nShield Support, https://nshieldsupport.entrust.com .

Before you can use nSCOP and run the container images, complete the following steps:

1. Install Docker. For information, see https://docs.docker.com/get-docker/ .

2. Gain access to the Conjur appliance image. The following command can be used to load the conjur-appliance .tar file into the local Docker repository:

   % docker load -i conjur-appliance-12.3.0.tar.gz

3. Set up the HSM. See the Installation Guide for your HSM.

4. Configure the HSM(s) to have the IP address of your container host machine as a client.

5. Load an existing Security World or create a new one on the HSM.

6. Copy the Security World and module files to your container host machine at a directory of your choice.

7. Create or edit the cknfastrc file in /opt/nfast , and add one of the following config settings:

8. OCS or Softcard protection:

   CKNFAST_LOADSHARING=1
   CKNFAST_NO_ACCELERATOR_SLOTS=1

9. Module protection:

   CKNFAST_FAKE_ACCELERATOR_LOGIN=1

10. Create a pkcs11.yml file with the following content:

    library: /opt/nfast/toolkits/pkcs11/libcknfast.so
    wrapping_key: <wrapping_key name>
    pin: <passphrase of ocs/softcard if needed>

For more information on configuring and managing nShield HSMs, Security Worlds, and Remote File Systems, see the User Guide for your HSM(s).

The nShield hardserver container has to be configured to enable it to communicate with the CyberArk Conjur Master DAP Server in a later step, see Create and configure the Conjur application container and the Master DAP Server .

To deploy an nSCOP container image for use with CyberArk Conjur:

1. Log in to the container host machine server as root , and launch a terminal window.

2. Set up the nSCOP working directory.

   % mkdir -p /opt/nscop
   
   % tar xf nscop-1.1.0.tar –C /opt/nscop

3. Mount the Security World.

   % mkdir SecWorld-12.71.0
   
   % mount -o loop SecWorld_Lin64-12.71.0.iso SecWorld-12.71.0

4. Set up the hardserver image.

   % ./make-nshield-hwsp SecWorld-12.71.0

5. Configure nshield-hwsp :

   1. Set up the hardserver configuration file and directory.

      % mkdir -p /opt/nscop/config1
      
      % ./make-nshield-hwsp-config --output /opt/nscop/config1 config <hsm ip address>
      
      % cat /opt/nscop/config1/config

   2. Create a new socket so that application containers can use the hardserver.

      % docker volume create socket1

   3. Run the nshield-hwsp container.

      % docker run -d -v /opt/nscop/config1:/opt/nfast/kmdata/config:ro -v socket1:/opt/nfast/sockets nshield-hwsp:12.71.0

   4. Check the status of nshield-hwsp using the enquiry command.

      % NFAST_SERVER=/var/lib/docker/volumes/socket1/_data/nserver /opt/nfast/bin/enquiry

1. Extend the conjur-appliance image with the nfast utilities.

   % ./extend-nshield-application --from conjur-appliance:12.3.0 --pkcs11 SecWorld-12.71.0

2. Tag the generated application image for convenience.

   % docker tag <IMAGEID> conjor-appliance-wnfast:12.3.0

3. Run the conjur-appliance container with the nfast container.

   % docker run --name dap-wnfast -d --restart=always --security-opt seccomp=unconfined -p "443:443" -p "5432:5432" -p "1999:1999" -v /opt/nfast/kmdata:/opt/nfast/kmdata:rw -v socket1:/opt/nfast/sockets conjur-appliance-wnfast:12.3.0

4. Perform the initial configuration of Conjur. The username is admin . For password requirements, see https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/12.3/en/Content/Deployment/DAP/dap-deploy-dap.htm?tocpath=Setup%7CSet%20up%20Conjur%20Enterprise%20(Docker)%7C_3 .

   % docker exec dap-wnfast evoke configure master --accept-eula --hostname dap-wnfast.example.com --admin-password Mypassw0rD1! org1

5. Copy the cknfastrc and pkcs11.yml configuration files into the running container.

   % docker cp cknfastrc dap-wnfast:/opt/nfast/cknfastrc
   
   % docker cp pkcs11.yml dap-wnfast:/opt/conjur/etc/pkcs11.yml

6. Generate a new Key Encryption Key (KEK) for Conjur to be stored on the HSM.

   % docker exec dap-wnfast evoke pkcs11 generate

7. Start the conjur-appliance container, which will act as the Master DAP Server, in interactive mode.

   % docker exec -i -t dap-wnfast /bin/bash

The KEK is now ready for use.

For more examples, see the CyberArk Conjur documentation on Server Key Encryption Methods: https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/Latest/en/Content/Deployment/MasterKeyEncryption/ServerKeyEncryptionMethods.htm