keyring unlock
Unlock a specified keyring that has been locked due to reaching the consecutive failed login limit (10 attempts). The Crypto Officer for the partition used to create the keyring must provide authentication.
NOTE Thales recommends Luna Appliance Software 7.8.3 with cluster package 1.0.3, Luna HSM Firmware 7.8.2,
NOTE While the KRSO and KRCO roles are separate, they are intended to be held by the same individual and they must therefore use the same password. Consider this when setting your KRSO password.
The KRCO password is what your applications will specify to access the keyring and create and use objects. Thales recommends that you always use the most secure password possible. The length of your KRSO/KRCO password affects the behavior of the keyring as follows:
>If the KRCO password is 16 characters or shorter, the keyring is locked after 10 failed login attempts and must be unlocked before it can be used again:
PATCH /api/keyrings/{keyringID}
lunash:> keyring unlock {-keyringid <string> | -label <name>} [-copassword <password>]
>If the KRCO password is 17 characters or longer, the lockout counter is not incremented.
Failed login attempts using 6 characters or less never increment the counter.
User Privileges
Users with the following privileges can perform this command:
>Admin
Syntax
keyring unlock {-keyringid <string> | -label <name>} [-copassword <password>]
| Argument(s) | Shortcut | Description |
|---|---|---|
| -copassword | -c | Specifies the Crypto Officer password for the partition used to create the keyring. If this option is omitted on a password-authenticated HSM, LunaSH prompts for the password. If this option is included on a multifactor quorum-authenticated HSM and the partition is not activated, it is ignored. |
| -keyringid | -k | Specifies the UUID of the keyring to be unlocked. Use lunash:> keyring list to display a list of available keyrings and their UUIDs. |
| -label | -l | Specifies the label of the keyring to be unlocked. |
Example
lunash:>keyring unlock -copassword iamtheCO -keyringid e921c334-3d11-4797-a10f-e98bc9ed5621 Success Command Result : 0 (Success)
