Skip to content

Commit c79f57f

Browse files
v-regandownerv-regandowner
authored
Merge pull request #264853 from msmbaldwin/payment-hsm
Payment HSM
2 parents 71db13e + 9a87207 commit c79f57f

27 files changed

+335
-250
lines changed

‎articles/payment-hsm/access-payshield-manager-ssh.md

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
---
2+
title: Access the payShield manager for your Azure Payment HSM
3+
description: Access the payShield manager for your Azure Payment HSM
4+
services: payment-hsm
5+
ms.service: payment-hsm
6+
author: msmbaldwin
7+
ms.author: mbaldwin
8+
ms.topic: quickstart
9+
ms.devlang: azurecli
10+
ms.custom: devx-track-azurecli, devx-track-azurepowershell
11+
ms.date: 01/31/2024
12+
---
13+
14+
# Tutorial: Use SSH to access the payShield manager for your payment HSM
15+
16+
After you [Create an Azure Payment HSM](create-payment-hsm.md), you can create a virtual machine on the same virtual network and use it to access the Thales payShield manager.
17+
18+
In this tutorial, you learn how to:
19+
20+
> [!div class="checklist"]
21+
> * Create a subnet for your virtual machine
22+
> * Create a virtual machine
23+
> * Test Connectivity to your VM, and from the VM to your payment HSM
24+
> * Log into the VM to access the payShield manager
25+
26+
To complete this tutorial you need:
27+
28+
- The name of your payment HSM's virtual network. This tutorial assumes the name used in the previous tutorial: "myVNet".
29+
- The address space of your virtual network. This tutorial assumes the address space used in the previous tutorial: "10.0.0.0/16".
30+
31+
## Create a VM subnet
32+
33+
# [Azure CLI](#tab/azure-cli)
34+
35+
Create a subnet for your virtual machine, on the same virtual network as your payment HSM, using the Azure CLI [az network vnet subnet create](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-create) command. You must provide a value to the--address-prefixes argument that falls within the VNet's address space, but differs from the payment HSM subnet addresses.
36+
37+
```azurecli-interactive
38+
az network vnet subnet create -g "myResourceGroup" --vnet-name "myVNet" -n "myVMSubnet" --address-prefixes "10.0.1.0/24"
39+
```
40+
41+
The Azure CLI [az network vnet show](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-create) command lists two subnets associated with your VNet: the subnet with your payment HSM ("mySubnet"), and the newly created "myVMSubnet" subnet.
42+
43+
```azurecli-interactive
44+
az network vnet show -n "myVNet" -g "myResourceGroup"
45+
```
46+
47+
# [Azure PowerShell](#tab/azure-powershell)
48+
49+
First, save the details of your VNet to a variable using the Azure PowerShell [Get-AzVirtualNetwork](/powershell/module/az.network/get-azvirtualnetwork) cmdlet:
50+
51+
```azurepowershell-interactive
52+
$vnet = Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"
53+
```
54+
55+
Next, configure a subnet for your virtual machine, on the same virtual network as your payment HSM, using the Azure PowerShell [New-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/new-azvirtualnetworksubnetconfig) command. You must provide a value to the `--address-prefixes` argument that falls within the VNet's address space, but differs from the payment HSM subnet addresses.
56+
57+
```azurepowershell-interactive
58+
$vmSubnet = New-AzVirtualNetworkSubnetConfig -Name "myVMSubnet" -AddressPrefix "10.0.1.0/24"
59+
```
60+
61+
Lastly, add the subnet configuration to your VNet variable, and then pass the variable to the Azure PowerShell [Set-AzVirtualNetwork](/powershell/module/az.network/set-azvirtualnetwork) cmdlet:
62+
63+
```azurepowershell-interactive
64+
$vnet.Subnets.Add($vmSubnet)
65+
66+
Set-AzVirtualNetwork -VirtualNetwork $vnet
67+
```
68+
69+
The Azure PowerShell [Get-AzVirtualNetwork](/powershell/module/az.network/get-azvirtualnetwork) cmdlet lists two subnets associated with your VNet: the subnet with your payment HSM ("mySubnet"), and the newly created "myVMSubnet" subnet.
70+
71+
```azurepowershell-interactive
72+
Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"
73+
```
74+
75+
# [Portal](#tab/azure-portal)
76+
77+
Create your VM subnet using either Azure CLI or Azure PowerShell. You can use the portal to [Create a VM](#create-a-vm).
78+
79+
---
80+
81+
## Create a VM
82+
83+
# [Azure CLI](#tab/azure-cli)
84+
85+
Create a VM on your new subnet, using the Azure CLI [az vm create](/cli/azure/vm#az-vm-create) command. (In this example we create a Linux VM, but you could also create a Windows VM by augmenting the instructions found at [Create a Windows virtual machine with the Azure CLI](../virtual-machines/windows/quick-create-cli.md) with the details below.)
86+
87+
```azurecli-interactive
88+
az vm create \
89+
--resource-group "myResourceGroup" \
90+
--name "myVM" \
91+
--image "UbuntuLTS" \
92+
--vnet-name "myVNet" \
93+
--subnet "myVMSubnet" \
94+
--admin-username "azureuser" \
95+
--generate-ssh-keys
96+
```
97+
98+
Make a note of where the public SSH key is saved, and the value for "publicIpAddress".
99+
100+
# [Azure PowerShell](#tab/azure-powershell)
101+
102+
To create a VM on your new subnet, first set your credentials with the [Get-Credential](/powershell/module/microsoft.powershell.security/get-credential) cmdlet. Provide a username of "azureuser" and a password of your choice, saving the object as $cred.
103+
104+
```azurepowershell-interactive
105+
$cred = Get-Credential
106+
```
107+
108+
Now create your VM using the Azure PowerShell [New-AzVm](/powershell/module/az.compute/new-azvm) command. (In this example we create a Linux VM, but you could also create a Windows VM by augmenting the instructions found at [Create a Windows virtual machine with the Azure PowerShell](../virtual-machines/windows/quick-create-powershell.md) with the details below.)
109+
110+
```azurepowershell-interactive
111+
New-AzVm `
112+
-ResourceGroupName "myResourceGroup" `
113+
-Name "myVM" `
114+
-Location "eastus" `
115+
-Image "UbuntuLTS" `
116+
-PublicIpAddressName "myPubIP" `
117+
-VirtualNetworkName "myVNet" `
118+
-SubnetName "myVMSubnet" `
119+
-OpenPorts 22 `
120+
-Credential $cred `
121+
-GenerateSshKey `
122+
-SshKeyName "myVM_key"
123+
```
124+
125+
Make a note of where the private SSH key is saved, and the value for "FullyQualifiedDomainName".
126+
127+
# [Portal](#tab/azure-portal)
128+
129+
To create a VM on your new subnet:
130+
131+
1. Select "Virtual machines" from the "Create a Resource" screen of the Azure portal:
132+
:::image type="content" source="./media/portal-create-vm-1.png" alt-text="Screenshot of the portal resource picker.":::
133+
1. On the "Basics" tab of the creation screen, select the resource group that contains your payment HSM ("myResourceGroup"):
134+
:::image type="content" source="./media/portal-create-vm-2.png" alt-text="Screenshot of the portal main VM creation screen.":::
135+
1. On the "Networking" tab of the creation screen, select the VNet that contains your payment HSM ("myVNet"), and the subnet you created above ("myVMSubnet"):
136+
:::image type="content" source="./media/portal-create-vm-3.png" alt-text="Screenshot of the portal networking VM creation screen.":::
137+
1. At the bottom of the networking tab, select "Review and create".
138+
1. Review the details of your VM, and select "Create".
139+
1. Select "Download private key and create resource", and save your VM's private key to a location where you can access it later.
140+
141+
---
142+
143+
## Test connectivity
144+
145+
To access connectivity to your virtual machine, and from your VM to the management NIC IP (10.0.0.4) and host NIC IP, SSH into your VM. Connect to either the public IP address (for example, [email protected]) or the fully qualified domain name (for example, [email protected])
146+
147+
> [!NOTE]
148+
> If created your VM using Azure PowerShell, the Azure portal, or if you did not ask Azure CLI to auto-generate ssh keys when you created the VM, you will need to supply the private key to the ssh command using the "-i" flag (for example, `ssh -i "path/to/sshkey" azureuser@<publicIpAddress-or-FullyQualifiedDomainName>`). Note that the private key **must** be protected ("chmod 400 myVM_key.pem").
149+
150+
```bash
151+
ssh azureuser@<publicIpAddress-or-FullyQualifiedDomainName>
152+
```
153+
154+
If ssh hangs or refuses the connection, review your NSG rules to ensure that you are able to connect to your VM.
155+
156+
If the connection is successful, you should be able to ping both the management NIC IP (10.0.0.4) and the host NIC IP (10.0.0.5) from your VM:
157+
158+
```bash
159+
azureuser@myVM:~$ ping 10.0.0.4
160+
PING 10.0.0.4 (10.0.0.4) 56(84) bytes of data.
161+
64 bytes from 10.0.0.4: icmp_seq=1 ttl=63 time=1.34 ms
162+
64 bytes from 10.0.0.4: icmp_seq=2 ttl=63 time=1.53 ms
163+
64 bytes from 10.0.0.4: icmp_seq=3 ttl=63 time=1.40 ms
164+
64 bytes from 10.0.0.4: icmp_seq=4 ttl=63 time=1.26 ms
165+
^C
166+
--- 10.0.0.4 ping statistics ---
167+
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
168+
rtt min/avg/max/mdev = 1.263/1.382/1.531/0.098 ms
169+
170+
azureuser@myVM:~$ ping 10.0.0.5
171+
PING 10.0.0.5 (10.0.0.5) 56(84) bytes of data.
172+
64 bytes from 10.0.0.5: icmp_seq=1 ttl=63 time=1.33 ms
173+
64 bytes from 10.0.0.5: icmp_seq=2 ttl=63 time=1.25 ms
174+
64 bytes from 10.0.0.5: icmp_seq=3 ttl=63 time=1.15 ms
175+
64 bytes from 10.0.0.5: icmp_seq=4 ttl=63 time=1.37 ms
176+
```
177+
178+
## Access the payShield manager
179+
180+
To access the payShield manager associated with your payment HSM, SSH into your VM using the -L (local) option. If you needed to use the -i option in the [test connectivity](#test-connectivity), you will need it again here.
181+
182+
The -L option will bind your localhost to the HSM resource. Pass to the -L flag the string "44300:`<MGMT-IP-of-payment-HSM>`:443", where `<MGMT-IP-of-HSM-resource>` represents the Management IP of your payment HSM.
183+
184+
```bash
185+
ssh -L 44300:<MGMT-IP-of-payment-HSM>:443 azureuser@<publicIpAddress-or-FullyQualifiedDomainName>
186+
```
187+
188+
For example, if you used "10.0.0.0" as the address prefix for your Payment HSM subnet, the Management IP will be "10.0.0.5" and your command would be:
189+
190+
```bash
191+
ssh -L 44300:10.0.0.5:443 azureuser@<publicIpAddress-or-FullyQualifiedDomainName>
192+
```
193+
194+
Now go to a browser on your local machine and open `https://localhost:44300` to access the payShield manager.
195+
196+
:::image type="content" source="./media/payshield-manager.png" alt-text="Screenshot of the payShield manager for Azure Payment HSM.":::
197+
198+
Here you can commission the device, install or generate LMKs, test the API, and so on. Follow payShield documentation, and contact Thales support if any issues related to payShield commission, setup, and API testing.
199+
200+
## Next steps
201+
202+
Advance to the next article to learn how to remove a commissioned payment HSM through the payShield manager.
203+
> [!div class="nextstepaction"]
204+
> [Remove a commissioned payment HSM](remove-payment-hsm.md)
205+
206+
More resources:
207+
- Read an [Overview of Payment HSM](overview.md)
208+
- Find out how to [get started with Azure Payment HSM](getting-started.md)
209+
- [Create a payment HSM](create-payment-hsm.md)

0 commit comments

Comments
 (0)