HP HP-UX 10.20 User manual

HP Praesidium SpeedCard Getting
Started Guide
For HP-UX 10.20, 11.0 and 11i
Fifth Edition
HP 9000 Networking
Manufacturing Part Number: A5486-90013
E1200
U.S.A.
© Copyright 1998, Hewlett-Packard Company.

2
Legal Notices
The information in this document is subject to change without notice.
Hewlett-Packard makes no warranty of any kind with regard to this
manual, including, but not limited to, the implied warranties of
merchantability and fitness for a particular purpose. Hewlett-Packard
shall not be held liable for errors contained herein or direct, indirect,
special, incidental or consequential damages in connection with the
furnishing, performance, or use of this material.
Warranty. A copy of the specific warranty terms applicable to your
Hewlett-Packard product and replacement parts can be obtained from
your local Sales and Service Office.
Year 2000 Compliance Warranty. Manufacturer warrants that all HP
Products will be “Year 2000 Compliant.” Year 2000 Compliant products
will perform without error, loss of data, or loss of functionality on account
of any inability to process, calculate, compare or sequence date data
accurately. In addition, Year 2000 Compliant products will not cause any
associated HP products or any systems in which they may be used to fail
in any of the ways described above. This Year 2000 Compliance warranty
will remain in effect through December 31, 2000, notwithstanding any
other warranty period specified in this Agreement.
Restricted Rights Legend. Use, duplication or disclosure by the U.S.
Government is subject to restrictions as set forth in subparagraph (c) (1)
(ii) of the Rights in Technical Data and Computer Software clause at
DFARS 252.227-7013 for DOD agencies, and subparagraphs (c) (1) and
(c) (2) of the Commercial Computer Software Restricted Rights clause at
FAR 52.227-19 for other agencies.
HEWLETT-PACKARD COMPANY 3000 Hanover Street Palo Alto,
California 94304 U.S.A.
Use of this manual and flexible disk(s) or tape cartridge(s) supplied for
this pack is restricted to this product only. Additional copies of the
programs may be made for security and back-up purposes only. Resale of
the programs in their present form or with alterations, is expressly
prohibited.
Copyright Notices. ©copyright 1983-2000 Hewlett-Packard Company,
all rights reserved.

3
Reproduction, adaptation, or translation of this document without prior
written permission is prohibited, except as allowed under the copyright
laws.
©copyright 1979, 1980, 1983, 1985-93 Regents of the University of
California
This software is based in part on the Fourth Berkeley Software
Distribution under license from the Regents of the University of
California.
©copyright 1980, 1984, 1986 Novell, Inc.
©copyright 1986-1992 Sun Microsystems, Inc.
©copyright 1985-86, 1988 Massachusetts Institute of Technology.
©copyright 1989-93 The Open Software Foundation, Inc.
©copyright 1986 Digital Equipment Corporation.
©copyright 1990 Motorola, Inc.
©copyright 1990, 1991, 1992 Cornell University
©copyright 1989-1991 The University of Maryland
©copyright 1988 Carnegie Mellon University
Trademark Notices. UNIX is a registered trademark in the United
States and other countries, licensed exclusively through X/Open
Company Limited.
X Window System is a trademark of the Massachusetts Institute of
Technology.
Netscape, Netscape Communications, the Netscape Communications
logo, LiveWire, LiveWire Pro, Netscape Catalog Server, Netscape
Commerce Server, Netscape Communications Server, Netscape Directory
Server, Netscape Enterprise Server, Netscape FastTrack Server,
Netscape Mail Server, Netscape Navigator, Netscape News Server, and
Netscape Proxy Server are trademarks of Netscape Communications
Corporation.

4
Printing History
The manual printing date and part number indicate its current edition.
The printing date will change when a new edition is printed. Minor
changes may be made at reprint without changing the printing date. The
manual part number will change when extensive changes are made.
Manual updates may be issued between editions to correct errors or
document product changes. To ensure that you receive the updated or
new editions, you should subscribe to the appropriate product support
service. See your HP sales representative for details.
The printing history for the HP Praesidium SpeedCard Getting Started
Guide is listed below.
First Edition: June 1999 (HP-UX Release 10.20, 11.0)
Second Edition: September 1999 (HP-UX Release 10.20, 11.0)
Third Edition: December 1999 (HP-UX Release 10.20, 11.0)
Fourth Edition: June 2000 (HP-UX Release 10.20, 11.0)
Fifth Edition: December 2000 (HP-UX 11i Release)

Contents
5
1. Safety and Regulatory Information
Regulatory Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
FCC Statement (USA only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Declaration of Conformity Statement. . . . . . . . . . . . . . . . . . . . . . . . . . .8
Declaration Of Conformity Statement (Canada only) . . . . . . . . . . . . .10
Europe RFI Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Australia and New Zealand EMI Statement . . . . . . . . . . . . . . . . . . . .10
Safety Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Safety Symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
2. Introduction
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Who Should Read this Guide? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
What this Guide Contains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
What is the HP Praesidium SpeedCard? . . . . . . . . . . . . . . . . . . . . . . . . .16
On Line Addition and/or Replacement (OLAR) . . . . . . . . . . . . . . . . . . . .18
OLAR Concepts for PCI Cards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Planning and Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
Card Compatibility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
3. Installation
Card Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
HP-UX Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Operating Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Physical Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
A5484A (HSC Version). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
A5485A (HSC Version). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
A5486A (PCI Version) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
Installing the hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . .28

6
Contents
Electrostatic Discharge (ESD) Precautions. . . . . . . . . . . . . . . . . . . . . 28
Installing an A5484A HSC SpeedCard . . . . . . . . . . . . . . . . . . . . . . . . 28
Installing an A5485A HSC SpeedCard . . . . . . . . . . . . . . . . . . . . . . . . 33
Installing an A5486A PCI SpeedCard . . . . . . . . . . . . . . . . . . . . . . . . . 34
Installing the Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Required Patches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Installation overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Cryptoki Module Installation Instructions . . . . . . . . . . . . . . . . . . . . . 38
4. Using the SpeedCard
Diagnostic and Maintenance Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
The SpeedCard’s LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
A5484A (HSC) LED Location. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
A5485A (HSC) LED Location. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
A5486A (PCI) LED Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5. Appendix
Export Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Physical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Electrical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Environmental . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Electromagnetic Compatibility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Chapter 1 7
Safety and Regulatory Information
Regulatory Information
1 Safety and Regulatory
Information
Regulatory Information
This product was tested for conformance to various national and
international regulations and standards. The scope of this regulatory
testing includes electrical and mechanical safety, electromagnetic
emissions and immunity.
When required, approvals are obtained from third party test agencies.
Approval marks appear on the product label. In addition, various
regulatory bodies require some information under the headings noted
below.
FCC Statement (USA only)
This device complies with part 15 of the FCC rules. Operation is subject
to the following two conditions: (1) This device may not cause harmful
interference, and (2) this device must accept any interference received,
including interference that may cause undesired operation.
This equipment has been tested and found to comply with the limits of a
Class A digital device, pursuant to part 15 of FCC rules. These limits are
designed to provide reasonable protection against harmful interference
when the equipment is operated in a commercial environment. This
equipment generates, uses, and can radiate radio frequency energy, and
if not installed and used in accordance with the instruction manual, may
cause harmful interference to radio communications. Operation of this
equipment in a residential area is likely to cause harmful interference, in
which case the user will be required to correct the interference at his own
expense.
Any changes or modifications not expressly approved by
Hewlett-Packard could void the user’s authority to operate this
equipment.

8 Chapter1
Safety and Regulatory Information
Regulatory Information
Declaration of Conformity Statement

Chapter 1 9
Safety and Regulatory Information
Regulatory Information

10 Chapter1
Safety and Regulatory Information
Regulatory Information
Declaration Of Conformity Statement (Canada only)
This Class A digital apparatus meets all the requirements of the
Canadian Interference-Causing Equipment Regulations.
Cet appareil numérique de la classe A respecte toutes les exigences du
Règlement sur le matériel brouilleur du Canada.
Europe RFI Statement
This is a Class A product. In a domestic environment, this product may
cause radio interference, in which case the user may be required to take
adequate measures.
Australia and New Zealand EMI Statement
This product meets the applicable requirements of the Australia and
New Zealand EMC Framework.

Chapter 1 11
Safety and Regulatory Information
Safety Information
Safety Information
These products comply with IEC 950/EN 60950; Printed Circuit Board is
rated 94V-0.
Safety Symbols
WARNING A WARNING denotes a hazard that can cause personal injury.
CAUTION A CAUTION denotes a hazard that can damage equipment.

12 Chapter1
Safety and Regulatory Information
Safety Information

13
2 Introduction

14 Chapter2
Introduction
Overview
Overview
Thank you for choosing the HP Praesidium SpeedCard for HP-UX
Internet web servers. The SpeedCard is a hardware- based security
solution that plugs into your server’s bus and enables your server’s CPU
to sustain maximum performance. This product is a member of the HP
Praesidium family of security products. For more information about HP’s
Praesidium products, please refer to the HP Praesidium website at:
http://www.hp.com/praesidium.html
Who Should Read this Guide?
This guide is intended for anyone who needs to install and/or use the HP
Praesidium SpeedCard in an HP-UX system.
What this Guide Contains
This guide contains information to assist you in installing and setting up
your SpeedCard.
Table 2-1 Contents by chapter
CHAPTER/APPENDIX DESCRIPTION
Chapter 1 - Introduction Gives an overview of the HP Praesidium
SpeedCard.
Chapter 2 - Installation Issues Provides information that is important to know
when installing a SpeedCard.
Chapter 3 - Using The HP
Praesidium SpeedCard Describes how to use the SpeedCard.
Appendix A Export considerations and card specifications.

Chapter 2 15
Introduction
Overview
Typographic Conventions
The following typographic conventions are used throughout this guide:
Where to find information on-line
A file of this document may be found at the following URL:
http://www.docs.hp.com/hpux/pdf/A5486-90013.pdf
Table 2-2 Typographic conventions
CONVENTION PURPOSE
italic Used to signal a new term, for place holders, variables,
and file names; or for emphasis.
bold Used for command-line options, names of commands,
menus, dialog boxes, and check boxes.
computer This font denotes syntax, prompts, and code examples.

16 Chapter2
Introduction
What is the HP Praesidium SpeedCard?
What is the HP Praesidium SpeedCard?
The HP Praesidium SpeedCard is a hardware-based security solution
that enables your server’s CPU to sustain maximum performance. It is
designed for applications that demand security yet still need to handle
large client loads. An HP Praesidium SpeedCard is the secure server
performance solution when you experience the following capacity issues:
• Your server is CPU bound (utilization is over 90%) under peak load.
• Your server’s response time is slowing during busy periods, but your
network pipe is not full.
• Your clients are being turned away.
An HP Praesidium SpeedCard dramatically increases your server’s
response time and the number of clients it can support. This is the server
performance solution to help your business grow! The HP Praesidium
SpeedCard easily plugs into your server’s bus and performs the critical
cryptographic functions required by your security system. An HP
Praesidium SpeedCard not only accelerates the lengthy RSA public key
decryption and encryption process, but also relieves the server CPU
bottleneck.
The HP Praesidium SpeedCard also increases the number of clients your
web server can support with security running Secure Sockets Layer
(SSL) transactions.It improves CPU utilization and off-loads your server
to perform other tasks.
The HP Praesidium SpeedCards provide two classes of cryptographic
capabilities:
1. Modular exponentiation functions, including DH, DSA, RSA and raw
modular exponentiation.
2. Random number generation, appropriate for secure key generation.

Chapter 2 17
Introduction
What is the HP Praesidium SpeedCard?
HP Praesidium SpeedCards are a balanced, economical co-processor with
performance of a basic 1024-bit RSA private key decrypt or sign taking
as little as 5 ms. For increased efficiency, multiple cards can be installed
in the same system.

18 Chapter2
Introduction
On Line Addition and/or Replacement (OLAR)
On Line Addition and/or Replacement (OLAR)
NOTE The HP Praesidium SpeedCard, version A5486A, can only take
advantage of OLAR features if your system is running the HP-UX 11i
operating system and has a PCI bus.
OLAR Concepts for PCI Cards
Introduction
The letters O, L, A and R stand for On Line Addition [and] Replacement.
This, of course, refers to the ability of a PCI I/O card to be replaced on an
HP-UX computer system designed to support this feature without the
need for completely shutting down, then re-booting the system or
adversely affecting other system components. The system hardware uses
the per-slot power control combined with operating system support to
enable this feature.
IMPORTANT Certain “Classes” of hardware are not intended for access by users. At
this time this includes V-Class and Superdome systems. HP recommends
that these systems only be opened by a qualified HP Engineer. Failure to
observe this requirement can validate any support agreement or
warranty to which the owner might otherwise be entitled.
Important Terms and Concepts
The addition or replacement of an OLAR-compatible card may be done in
either one of two ways:
1. Using the SAM utility.
2. Issuing command-line commands using rad.
If detailed information about the use of either of these two procedures is
required, you should refer to the following document:
Configuring HP-UX For Peripherals, HP Part Number B2355-90698

Chapter 2 19
Introduction
On Line Addition and/or Replacement (OLAR)
This document may be ordered from HP, or you may view, download and
print it from the following website: www.docs.hp.com
IMPORTANT In many cases, other interface cards and slots within the system are
dependent upon the target card. For example:
• If the target card is a multiple-port card, suspending or deleting
drivers for the target card slot also suspends individual drivers for
the multiple hardware paths on that card).
During a card replacement operation, SAM performs a Critical Resource
Analysis, which checks all ports on the target card for critical resources
that would be temporarily unavailable while the card is shut down.
Planning and Preparation
For the most part SAM prevents you from performing OLAR procedures
that would adversely affect other areas of the server. Refer to
Table 2-3 Important Terms
Term Meaning
OLAR All aspects of the OLAR feature
including On-line Addition (OLA)
and On-line Replacement (OLR).
Power Domain A grouping of 1 or more interface
card slots that are powered on or off
as a unit. (NOTE: Multi-slot power
domains are not currently supported)
target card / target card slot The interface card which will be
added or replaced using OLAR, and
the card slot in which it resides.
affected card / affected card slot Interface cards and the card slots in
which they reside, and which are in
the same power domain as the target
slot.

20 Chapter2
Introduction
On Line Addition and/or Replacement (OLAR)
Configuring HP-UX For Peripherals, HP Part Number B2355-90698 for
detailed information.
Critical Resources
Replacing a card that is still operating can have extensive ramifications.
Since power to the slot must be off when the old card is removed and the
new card is inserted, the effects of shutting down the card’s functions
must be considered.
This is particularly important if there is no on-line failover or backup
card to pick up those functions. For example:
• Which mass storage devices will be temporarily disconnected when
the card is shut down?
• Will a critical networking connection be lost?
A critical resource is one that would cause a system crash or prevent the
operation from successfully completing if the resource were temporarily
suspended or disconnected. For example, if the SCSI adapter to be
replaced connects to the un-mirrored root disk or swap space, the system
will crash when the card is shut down.
During an OLAR procedure, it is essential to check the targeted card for
critical resources, as well as the effects of existing disk mirrors and other
situations where a card’s functions can be taken over by another card
that will not be affected.
Fortunately SAM performs a thorough critical resource analysis
automatically, and presents options to you based on it’s findings. If you
determine that critical resources will be affected by the procedure, you
could replace the card when the server is off-line, or if you must take
action immediately, you can use rad to attempt an on-line addition of a
backup card and deletion of the target card.
Firmware Patch Information
For those wishing to use OLAR, your system may need to update its
firmware. For additional details, please refer to the Readme Before
Installing or Updating to HP-UX 11i document provided with your HP
product.