Luna Appliance Software 7.9.2
Luna Appliance Software 7.9.2 was released in November 2026.
>Download Luna Appliance Software 7.9.2 (includes firmware update to Luna HSM Firmware 7.10.0)
NOTE This package requires that you update from Luna Appliance Software 7.9.0.or newer. Refer to Valid Update Paths.
This package also includes Luna Backup HSM 7 Firmware 7.7.3 ready to install (see Updating the Appliance-Connected Luna Backup HSM 7 Firmware).
>Download Luna Cluster Package 1.0.7 (see lnh_cluster-1.0.7 for information on this release)
CAUTION! Read the Advisory Notes before installing this update, to be aware of important changes that may require your attention.
New Features and Enhancements
Luna Appliance Software 7.9.2 includes the following new features and enhancements:
Export Custom Appliance Role Permissions
A user role export command is added to LunaSH to enable exporting a file containing the list of commands allowed by a custom appliance role, which can then be secure-copied to other HSM appliances, and imported, to maintain administrative consistency across your deployed Luna Network HSM 7 appliances. A user role show command is added to allow an admin user to view the command permissions held by a custom role on the appliance, such as when preparing to export a role permissions file.
PQC Support in Luna KSP
The Luna Key Storage Provider (KSP) adds support for the ML-DSA and ML-KEM post-quantum algorithms, aligning with the PQC updates in Microsoft CNG. Microsoft applications that use CNG can use these algorithms, which are available in the HSM firmware, through the Luna KSP. For example, you can create a Microsoft certification authority and enroll certificates using ML-DSA keys protected by the Luna KSP.
Requires Luna HSM Client 10.9.5.
SNMP v3 Refresh
Improvements to interoperability, observability, and security assurance.
Support of extended authentication (SHA variants) and privacy (AES variants) protocols for SNMP users and traps..
Improved compliance with RFC3414 in the handling of both msgAuthoritativeEngineBoots and msgAuthoritativeEngineTime data fields.
See SNMP Operation and Limitations with Luna Network HSM 7.
Luna Cluster Package 1.0.7
This version of the Luna Cluster package requires Luna Appliance Software 7.9.2 and Luna HSM Firmware 7.10.0. Use the procedure for Updating the Cluster.
lnh_cluster-1.0.7
This release includes the following enhancements to the Clusters feature:
Post-quantum cryptography (PQC) support on clusters
Clusters now support the post-quantum algorithms ML-KEM and ML-DSA. The cluster and the client plugin (lnh-uc-plugin) both include PQC support. The following operations are available:
>ML-KEM:
•Generate and destroy ML-KEM keys
•Encapsulate and decapsulate keys
>ML-DSA:
•Generate and destroy ML-DSA keys
•Create ML-DSA certificates
•Sign and verify with ML-DSA keys
Cluster backup and restore supports PQC keys
Cluster backup and restore has been enhanced to include PQC keys (ML-KEM and ML-DSA), in addition to legacy keys.
Database changes to support in-service update
This release includes cluster database changes to support in-service updates.
Additional cluster changes
The lnh_cluster-1.0.7 release also includes the following changes:
>Security updates
This release contains bug fixes and security updates.
>Client plugin update
The lnh-uc-plugin 1.0.7 release (Linux, AIX, and Windows) adds PQC support and additional bug fixes.
>Zeroized cluster member leaves the cluster
If the HSM on a cluster member is zeroized, the member automatically leaves the cluster. You must perform a factory reset on that member before it can be reused.
Luna REST API 18
This release includes Luna REST API 18.0.0, which has the following new features and enhancements:
CAUTION! Read the Advisory Notes before installing this update, to be aware of important changes that may require your attention.
New REST API features
>Inject entropy into SA7 partitions.
>Retrieve the NTLS client, server, and CA certificates.
>List and export the LunaSH role definition file.
>Authenticate RADIUS users and manage RADIUS servers.
>Retrieve the network bonding mode.
>Retrieve the K7 battery level.
>Configure REST API timestamps to use ISO 8601 format. The previous format remains available for backward compatibility.
>Manage the PED server service.
REST API enhancements
>When listing appliance user certificates, you can request SHA-256 fingerprints by setting a query parameter. SHA-1 remains the default for backward compatibility.
>SNMP support in the REST API is aligned with the SNMPv3 changes in LunaSH.
>The REST API webserver supports IPv6 and dual-stack (IPv4 and IPv6) networks.
>Users with the monitor role can run the network ping action.
>Syslog remote hosts can be configured using DNS hostnames.
>System configuration restore and NTLS client mapping are aligned with LunaSH behavior.
>Syslog CSR endpoint responses are aligned with the other endpoints.
>Performance of NTLS configuration updates and SNMP notification creation is improved.
>A factory reset restores the default webserver values for sessiontimeout, threads, and maxFileSize.
>Error messages are clearer and more consistent across endpoints.
Revised REST API reference
The REST API reference is updated to OpenAPI 3.2.0 and REST API version 18, with the following improvements:
>Every operation lists the user roles authorized to call it and names the equivalent LunaSH command.
>Operations include a version history showing the API version in which each change was introduced.
>Operations document the HSM or partition role required, where applicable, and explain the effect of the ForceSoLogin setting where it applies.
>Documented error codes increased from 56 to more than 400, with examples.
>Previously undocumented endpoints are now documented, including SNMP, STC clients, syslog remote hosts, NTLS client CA, API discovery, and indirect login.
>Incorrectly documented endpoint paths are corrected, and request and response examples are added and corrected throughout.
Additional REST API changes
Luna REST API 18.0.0 also includes the following changes:
>When a request includes both a session cookie and an Authorization header for different users, the Authorization header now takes precedence.
>Detailed error information for FRAMEWORK_BAD_REQUEST is returned only to authenticated users.
Valid Update Paths
You can update the Luna Appliance Software to version 7.9.2 from the following previous versions:
>7.9.0, 7.9.1
Advisory Notes
This section highlights important issues you should be aware of before deploying Luna Appliance Software 7.9.2.
REST API Update of Certificate Based Authorization Requires Updating Encryption/Decryption Logic
RSA encryption padding has been migrated to RSA-OAEP, and the default OAEP hash algorithm has been updated from SHA-1 to SHA-256.
Starting from Luna Appliance Software version 7.9.2 (and REST API 18.0.0), the existing Certificate-Based Authorization implementation, using RSA padding (RSA.pkcs1_padding), is no longer compatible due to enforcement of RSA-OAEP padding with SHA-256. If you are using a prior implementation you must update your encryption/decryption logic to use RSA-OAEP and explicitly configure both the OAEP and MGF1 digest algorithms to SHA-256.
Required changes:
Replace RSA.pkcs1_padding with RSA.pkcs1_oaep_padding.
Configure:
OAEP hash algorithm = SHA-256
MGF1 hash algorithm = SHA-256
Failure to implement these changes can result in authentication failures and disruption of existing authorization workflows.
Cluster Commands Not Available After Update to Luna Appliance Software 7.9.1
If you have Luna Clusters installed on the Luna Network HSM 7, the lunash:> cluster commands are not available after updating to Luna Appliance Software 7.9.1 (refer to known issue LUNA-36483). The cluster is not affected; re-install the lnh_cluster-1.0.5 package to recover access to the commands.
Strict Validation Policy Enforced On REST API Input Parameters
Changes have been made to the validation requirements for many REST API input parameters in Luna REST API 17.0.0 and newer. These changes may affect the backwards compatibility of existing applications using previous versions of the Luna REST API. Refer to Validation Schema for a full accounting of the new requirements.
Algorithms Removed from Appliance SSH Support
The following RFC9142 non-compliant key exchange algorithms are no longer supported in Luna Appliance Software 7.9.1 and newer:
>diffie-hellman-group1-sha1
>diffie-hellman-group14-sha1
>diffie-hellman-group-exchange-sha256
>diffie-hellman-group-exchange-sha1
Appliance Re-Image Now Deletes Bonded Interfaces
Using Luna Appliance Software 7.9.0 or newer, the appliance re-image operation deletes all bonded interfaces and supporting network configurations. Those must be reconfigured, if they are needed, after the re-image operation is complete. If you are using bonded interfaces, run lunash:> sysconf reimage start via a serial connection or a physical network interface (eth0/eth1/eth2/eth3) to avoid losing contact with the Luna Network HSM 7.
Refer to Re-Imaging the Appliance to Baseline Software/Firmware Versions.
Disallowed filepaths for SFTP
Using Luna Appliance Software 7.9.0 or newer, the following criteria apply to file transfers to the Luna Network HSM 7:
| Filepath | Allowed/Disallowed |
|---|---|
| Any file path with "../" in it | Disallowed |
| server.pem | Only allowed to get. Cannot replace server.pem on the Luna Network HSM 7 appliance. |
| client_syslog.pem | Only allowed to get. Cannot replace client_syslog.pem on the Luna Network HSM 7 appliance. |
| File name with a length less than 1 or greater than 64 | Disallowed |
| Any file name with "/" in it | Disallowed |
| File name that ends with a space | Disallowed |
| File name with "-" (dash) | Allowed |
| File name that starts with a space | Disallowed |
| File name with special characters other than letters, digits, underscores, periods, spaces, or hyphens. Such as @,#,$,%,^,&,* | Disallowed |
| Empty file names | Disallowed |
Files can be sent to/from only the current user's "my files".
Hostname requirements are tightened
Requirements for hostnames are tightened using Luna Appliance Software 7.9.0 or newer, to be more compliant with internet standards. If you have hostnames with embedded underscore characters "_", those will have that disallowed character removed during upgrade; so, for example, my_hostname becomes myhostname. Additionally, you may not start or end a hostname with a period "." character or a dash "-" character, but they are suitable to use within a hostname if you wish. For example, "host-name" or "my.host.name" are acceptable, but ".hostname" or "hostname-" are not. The second type of example will have the disallowed characters removed during upgrade. Be sure to update scripts and any working notes or instructions.
Appliance system-level user password policy is changed
Using Luna Appliance Software 7.9.2 or newer, the password policy mandates that passwords must contain characters from all four categories, in accordance with updated Linux standards. Previous releases required characters from only three of the four categories. Existing passwords continue to work until a password change is requested.
Package List Output Revised
The output of the command to list software packages installed on the Luna Network HSM 7 has been trimmed from the previous "everything" list, to a more useful list of product-level packages that include all installed product options in which you would have an interest, as well as external interface packages and application packages needed by our support and engineering teams to perform troubleshooting analysis. Requires Luna Appliance Software 7.8.4 or newer.
See package list.
One-Step NTLS Connections Require Update to Luna HSM Client 10.7.0 Components
Luna Appliance Software 7.9.2 and newer includes changes that require an update to the pscp and plink utilities. If you plan to use the One-Step NTLS Connection Procedure to establish client connections to your appliance, either update the client software to Luna HSM Client 10.7.0 or newer, or replace the pscp and plink utilities in your older client installation with the versions included with Luna HSM Client 10.7.0 or newer.
Appliance System Clock Must Be Set Before Starting the Cluster Service
If the system clock is adjusted after the cluster certificate is created, the certificates might not be valid due to date/time. For example, if the certificate is generated while the system clock is ahead by a few minutes, and the clock is then corrected, the certificate will not be valid until the clock catches up to the time it was set to when the cert was created. If the current system time does not fall within the certificate's range of validity, the cluster service fails to start.
REST API Webserver Automatically Enabled
When upgrading to Luna Appliance Software 7.8.1 or newer, the REST API webserver is automatically enabled. If you have not already configured the webserver to accept REST API calls, this can cause a large volume of error messages to appear in logs. For example:
2022 Nov 22 16:39:29 10 daemon notice systemd: nginx.service: control process exited, code=exited status=1 2022 Nov 22 16:39:29 10 daemon err systemd: Failed to start nginx - high performance web server. 2022 Nov 22 16:39:29 10 daemon notice systemd: Unit nginx.service entered failed state. 2022 Nov 22 16:39:29 10 daemon warning systemd: nginx.service failed.
These error logs can be safely ignored, but you must explicitly disable the webserver service to stop them from accumulating (lunash:> webserver disable). If you plan to configure the webserver to accept REST API calls, you must regenerate the webserver certificate (lunash:> webserver certificate generate) and restart the webserver service (lunash:> service start webserver) to stop the error logs.
Insecure SSH Ciphers Removed From Luna Appliance Software 7.8.0 and Newer
Thales has removed a number of less-secure SSH ciphers from Luna Appliance Software 7.8.0. As a consequence, older client versions may not be able to use SSH to access LunaSH. This affects SSH connections, pscp/scp file transfers, plink, and certain procedures that rely on these tools such as the One-Step NTLS Connection Procedure. To avoid connection problems, you must use the versions of pscp and plink from Luna HSM Client 10.4.0 or newer. If you use Linux-standard applications like scp or ssh, ensure that they are updated to the latest version.
The following ciphers have been removed:
MACS
>umac-64-etm@openssh.com
>umac-128-etm@openssh.com
>umac-64@openssh.com
>umac-128@openssh.com
Host-Based Accepted Key Types
>ssh-rsa-cert-v01@openssh.com
>ssh-dss-cert-v01@openssh.com
>ssh-rsa
>ssh-dss
Host Key Algorithms
>ssh-rsa-cert-v01@openssh.com
>ssh-dss-cert-v01@openssh.com
>ssh-rsa
>ssh-dss
Public Key Accepted Key Types
>ssh-rsa-cert-v01@openssh.com
>ssh-dss-cert-v01@openssh.com
>ssh-dss
Luna Network HSM 7 Reboot Patch is a Prerequisite For Older Appliances
If your Luna Network HSM 7 was shipped to you before December 2019, and you currently have software older than Luna Appliance Software 7.7.0 installed, the software update will not proceed unless you first install the Luna Network HSM 7 Reboot Patch. Appliances shipped from the factory since December 2019 have this patch already installed. If you installed the patch to enable an earlier update (7.7.0 or newer), you do not need to install it again.
sysconf snmp trap set command now defaults to "inform"
Previously, sysconf snmp trap set -traptype command would default to "trap". This has changed with Luna Appliance Software 7.7.0; which adds the option "inform", the new default. If you had any scripts that relied on the default setting, they should now be adjusted to explicitly set the -traptype.
