> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the transaction processing connection

> Harden the transaction processing connection on the Excrypt HSM and enable only the required PKCS

> [!NOTE]
>
> For this step, you must log in with an identity that has a role with the following permissions: Role:Add, Role:Assign All Permissions, Role:Modify, Keys:All Slots, and Command Settings:Excrypt. You can use the default Administrator role and Admin identities.

> [!NOTE]
>
> This integration guide treats the terms application partition and role as synonymous.

Before logging in to the HSM with an authenticated user, an application connects through a transaction processing connection to the transaction processing application partition. Configure the following items to harden this partition:

* It should not have access to the **All Slots** permissions.
* It should not have access to any key slots.
* Enable only the PKCS #11 communication commands in the following list. Don't enable key operation commands such as **ASYS**; the library runs them only after login, under the application partition.

Choose one of the following methods to configure the transaction processing connection:

## Excrypt Manager

Perform the following steps to configure a transaction processing connection in Excrypt Manager:

**Step 1**

Go to the **Application Partitions** menu, select the transaction processing application partition, and select **\[ Modify ]**.

**Step 2**

In the **Permissions** tab, leave the top-level **Keys** permission checked and clear the **All Slots** sub-permission.

**Step 3**

In the **Key Slots** tab, ensure that the settings do not specify key ranges. By default, the transaction processing application partition can access the entire range of key slots on the HSM.

**Step 4**

In the **Commands** tab, enable only the following PKCS #11 communication commands:

<table>
  <thead>
    <tr>
      <th>***Command***</th>
      <th>***Description***</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>**ECHO**</td>
      <td>Communication test / retrieve version</td>
    </tr>

    <tr>
      <td>**GPKM**</td>
      <td>Retrieve key table information</td>
    </tr>

    <tr>
      <td>**GPKR**</td>
      <td>General-purpose key settings get (read-only)</td>
    </tr>

    <tr>
      <td>**GPKS**</td>
      <td>General-purpose key settings get/change</td>
    </tr>

    <tr>
      <td>**HASH**</td>
      <td>Retrieve device serial</td>
    </tr>

    <tr>
      <td>**PRMD**</td>
      <td>Retrieve HSM permissions</td>
    </tr>

    <tr>
      <td>**RAND**</td>
      <td>Generate random data</td>
    </tr>

    <tr>
      <td>**STAT**</td>
      <td>HSM statistics</td>
    </tr>

    <tr>
      <td>**TIME**</td>
      <td>Get or set time. The Futurex PKCS #11 library reads the HSM time before login.</td>
    </tr>
  </tbody>
</table>

## FXCLI

Run the following **role modify** FXCLI commands to remove all permissions and key ranges that are currently assigned to the **Transaction Processing** role and enable only the PKCS #11 Communication commands:

> [!NOTE]
>
> Because the Transaction Processing role was previously called the Anonymous role, the following commands specify Anonymous in the name field.

```shell title="FXCLI" wrap theme={null}
role modify --name Anonymous --clear-perms --clear-key-ranges
```

```shell title="FXCLI" wrap theme={null}
role modify --name Anonymous --add-perm "Keys" --add-perm Excrypt:ECHO --add-perm Excrypt:GPKM --add-perm Excrypt:GPKR --add-perm Excrypt:GPKS --add-perm Excrypt:HASH --add-perm Excrypt:PRMD --add-perm Excrypt:RAND --add-perm Excrypt:STAT --add-perm Excrypt:TIME
```