PKCSEP11_SESSION(1)

NAME
pkcsep11_session - manage EP11 sessions.

SYNOPSIS
pkcep11_session [-h] [show|logout|vhsmpin|fipspin|status] [-slot slot-number] [-id session-ID] [-pid process-ID] [-date yyyy/mm/dd] [-force]

DESCRIPTION
Use pkcep11_session to set the VHSM and FIPS-session pins, and list and logout leftover EP11 sessions. EP11 sessions are created and destroyed when a PKCS#11 session is logged in and out, respectively. When an application terminates abnormally, without logging out or closing the PKCS#11 session, the corresponding EP11 session is not destroyed. When STRICT_MODE, VHSM_MODE, or FIPS_SESSION_MODE is enabled in the EP11 configuration file, all session-keys belong strictly to the PKCS#11 session or token that created it. These PKCS#11 session keys expire when the session ends.

COMMAND SUMMARY

show
    displays all leftover EP11 sessions. Use the -session-ID, -pid or -date options to filter the list of sessions.

logout
    logs out all leftover EP11 sessions. Use the -session-ID, -pid or -date options to filter the list of sessions.

vhsmpin
    sets the VHSM PIN used for the VHSM_MODE (virtual HSM). The VHSM PIN must contain between 8 and 16 alphanumeric characters. Set the VHSM PIN before enabling the VHSM_MODE in the EP11 configuration file.
    Note: When changing the VHSM PIN, all existing keys stored as token objects become unusable!

fipspin
    sets the FIPS PIN used for the FIPS_SESSION_MODE. The FIPS PIN must contain between 8 and 16 alphanumeric characters. Set the FIPS PIN before enabling the FIPS_SESSION_MODE in the EP11 configuration file.
    Note: When changing the FIPS PIN, all existing keys stored as token objects become unusable!

status
    shows the maximum and currently available number of EP11 sessions for each available EP11 APQN.

OPTIONS

-slot slot-number
    specifies the slot of the EP11 token. This option is required for all commands except the status command.

-force
    deletes a session even if logout fails on some adapters.

-id session-ID
    specifies the EP11 session ID.

-pid process-ID
    specifies the process-ID (pid) for which to display or logout EP11 sessions.

-date yyyy/mm/dd
    filters the EP11 sessions by the specified date. Any EP11 session with a matching or earlier date are displayed or logged out.

-h  show usage information

SEE ALSO
pkcsconf(1),
opencryptoki(7),
pkcsslotd(8).