Thales Luna Network HSM Integration Guide

Overview

This guide configures a Thales Luna Network HSM as a source for the CBOM Secure HSM Sensor over PKCS#11:

  • Symmetric keys (AES, DES, 3DES) in Luna partitions
  • Asymmetric key pairs (RSA, ECC, DSA) and metadata
  • X.509 certificates stored as PKCS#11 certificate objects
  • Secret and data objects; key attributes (label, type, size, usage, extractability, dates)

Prerequisites

  • Admin access to the Luna Network HSM appliance (HSM SO / Appliance Admin).
  • The HSM reachable from the sensor host (default port 1792/TCP).
  • The Luna HSM Client installed (libCryptoki2_64.so) with lunacm and vtl in PATH.
  • Firmware 7.x+; the HSM SO and Partition SO PINs; NTP-synced clock on the sensor host.

Step-by-Step Guide

Step 1: Register the Sensor Host as a Luna Client (NTLS)

Luna uses NTLS mutual TLS. On the sensor host create a client cert, register it on the appliance, and exchange server certs:

# on the sensor host
vtl createCert -n cbom-sensor-client
scp /usr/safenet/lunaclient/cert/client/cbom-sensor-client.pem admin@<HSM_IP>:/tmp/
 
# on the HSM appliance (ssh admin@<HSM_IP>)
client register -client cbom-sensor -hostname <SENSOR_HOSTNAME>
client certificate add -client cbom-sensor -file /tmp/cbom-sensor-client.pem
 
# back on the sensor host — register the HSM server
scp admin@<HSM_IP>:server.pem /usr/safenet/lunaclient/cert/server/<HSM_HOSTNAME>.pem
vtl addServer -n <HSM_HOSTNAME> -c /usr/safenet/lunaclient/cert/server/<HSM_HOSTNAME>.pem
vtl listServers

Step 2: Create a Partition and Assign the Client

# on the HSM appliance (requires HSM SO)
partition create -partition cbom-discovery -label "CBOM Discovery Partition"
client assignPartition -client cbom-sensor -partition cbom-discovery
client show -client cbom-sensor

Step 3: Create a Read-Only Crypto User

In lunacm on the sensor host, select the partition slot, initialize it, then create the Crypto Officer and the least-privileged Crypto User (the sensor credential):

lunacm
lunacm:> slot set -slot <SLOT_NUMBER>
lunacm:> partition init -label "CBOM Discovery Partition"
lunacm:> role login -name "Partition SO"
lunacm:> role init -name "Crypto Officer"
lunacm:> role logout
lunacm:> role login -name "Crypto Officer"
lunacm:> role init -name "Crypto User"       # record this PIN for the sensor
lunacm:> role logout
lunacm:> exit

Confirm the library path with ls -lh /usr/lib/libCryptoki2_64.so.

Step 4: Configure the CBOM Secure Sensor

sensors:
  - name: Discover_HSM
    type: hsm
    enabled: true
    vendor: thales-luna
    connection:
      pkcs11_library: /usr/lib/libCryptoki2_64.so
      hsm_host: 192.168.10.50
      hsm_port: 1792
      slot_number: 0
      partition_label: cbom-discovery
    credentials:
      role: CryptoUser
      pin: "${LUNA_CRYPTO_USER_PIN}"
    discovery:
      object_types: [keys, certificates, data_objects]
      include_attributes: [label, key_type, key_size, id, extractable, sensitive, start_date, end_date, usage_flags]
    tls:
      client_cert: /usr/safenet/lunaclient/cert/client/cbom-sensor-client.pem
      client_key: /usr/safenet/lunaclient/cert/client/cbom-sensor-clientKey.pem
      server_cert: /usr/safenet/lunaclient/cert/server/luna-hsm-appliance.pem
    output:
      tags: { hsm_vendor: thales, hsm_model: luna-network-hsm-7, partition: cbom-discovery }

Step 5: Validate

cbom-sensor run --config /etc/cbom/sensors/thales-luna.yaml --dry-run

Confirm a connection to the HSM, authentication to cbom-discovery as Crypto User, and an object count; run live and verify under Assets → HSM. The Luna audit log should show only C_Login, C_FindObjects, C_GetAttributeValue, and C_Logout for the session.

Common Errors

CKR_PIN_INCORRECT

Cause: The Crypto User PIN doesn’t match, or the wrong role PIN is used.

Resolution: Re-verify by logging in with lunacm; if locked, reset via role changepw as Partition SO / Crypto Officer.

CKR_SLOT_ID_INVALID

Cause: slot_number doesn’t match the partition’s current slot (can shift after restart).

Resolution: Run lunacm slot list and update slot_number.

NTLS connection refused / TLS handshake failure

Cause: The client isn’t registered, the client cert expired, or the server cert changed.

Resolution: Run vtl verify; re-register the server (vtl deleteServer / addServer) or repeat client registration.

Security Recommendations

  • Use the Crypto User role exclusively — never Crypto Officer or Partition SO.
  • Inject the PIN via a secrets manager using the ${} syntax; never hard-code it.
  • Enable and monitor the Luna audit log for unexpected key operations.
  • Firewall port 1792 to the sensor host only; combine with Luna’s IP-based client restrictions.
  • Protect the NTLS client key (chmod 600, chown cbom-service).

Conclusion

With the sensor host registered over NTLS, a dedicated cbom-discovery partition, and a least-privileged Crypto User, the HSM Sensor continuously inventories keys, certificates, and data objects on the Luna HSM over PKCS#11 — with no write or management access to the partition.