Network

The network card of the server operates in the configuration Network Bonding (see [^1]). The configuration file for Network Bonding is listed below.

network configuration:

/etc/netplan/network-config.yaml

Operating multiple a.sign RK HSM Server

When ordering multiple a.sign RK HSMs, these are provided as independent servers with the same key material. Issued certificates are automatically synchronized with the other servers. Configuration for load balancing must be configured by the customer. This can be done either by an upstream load balancer, DNS round robin or implementation in the client software.

Changing the IP address

If the IP address of one server changes, the hosts file of every server must be updated to reflect the configuration of the network interfaces.

An administrator will need to udpate the hosts file (/etc/hosts) on the a.sign RK HSM server.

Data transmission takes place via an encrypted SSH connection between the servers. Therefore the server must be able to communicate on port 22. For authentication purposes ed25519 key pairs are used. These keys should be redistributed after reconfiguration of a server.

To generate a new key pair on an a.sign RK HSM server, the following commands need to be executed in the terminal on the server.

chmod 640 .ssh/authorized_keys
ssh-keygen -t ed25519

To store the public key to another a.sign RK HSM, the following command must be run in a terminal on the server. This step must be repeated for each server.

ssh-copy-id root@HOSTNAME-OTHER-SERVER

The successful key exchange can be checked using the following command. If no password is required during the login, then the key exchange was successful.

ssh root@HOSTNAME-OTHER-SERVER

[^1] Canonical Ltd.: Netplan configuration example, 2022. https://netplan.io/examples#configuring-interface-bonding