Problem with "Integrating with SoftHSMv2" manual

[ldc77shirt]

I installed SoftHSMv2 in UBUNTU 24.04LTS as it is writen in the manual with the commands.

apt install -y softhsm2
softhsm2-util --init-token --label Cascade --pin 1234 --so-pin 1234 --free

After this, i was trying to start the kmip2pkcs11 service with the command writen in the manual

sed -i -e 's|^lib_path = .+|lib_path = "/usr/lib/softhsm/libsofthsm2.so"|' /etc/kmip2pkcs11/config.toml
chown -R kmip2pkcs11: /var/lib/softhsm
systemctl start kmip2pkcs11

But the service didn't start.

kmip2pkcs11 needs permission read-write for the configuration file of softhsm2, so i added the command "chown -R kmip2pkcs11:softhsm /etc/softshm"

sed -i -e 's|^lib_path = .+|lib_path = "/usr/lib/softhsm/libsofthsm2.so"|' /etc/kmip2pkcs11/config.toml
chown -R kmip2pkcs11:softhsm /etc/softhsm
chown -R kmip2pkcs11: /var/lib/softhsm
systemctl start kmip2pkcs11

Then the service was started.

Let me known if it's correct.

[mozzieongit]

Usually, config files being read-only is fine. I can only assume, but did you have a path configured to be in /etc/softhsm/ that is written to? What did the service report when it failed to start (the relevant output of the failed start from journalctl -u kmip2pkcs11)?

[ximon18]

Thank you @ldc77shirt for reporting these issues and my apologies for taking so long to follow up.

Indeed the SoftHSM PKCS#11 module C_Initialize() function will fail if the module cannot read its own configuration file at /etc/softhsm/softhsm2.conf and the https://cascade.docs.nlnetlabs.nl/en/latest/softhsm.html page only changes ownership of the softhsm data directory and not of the config file which leaves it owned by root:softhsm with permission 640, thus unreadable by the cascade-hsm-bridge user which cascade-hsm-bridge, and thus also the softhsm module, run as.

Rather than chown an alternate approach which avoids altering the softhsm installation is to add the cascade-hsm-bridge user to the softhsm group.

The page also has an outdated sed command for changing ^lib_path which no longer works as it should now be ^#lib-path instead. Other integration guide pages also wrongly refer to lib_path instead of lib-path and thus also need fixing.

I will fix the instructions in the affected pages.

Ximon