IBM Security Key Lifecycle Manager Version 2.5.0 -- Distributed Platforms Fix Pack 3 README

AIX Version 6.1 64-bit

AIX Version 7.1 64-bit

Red Hat Enterprise Linux Version 5 update 4 on x86 64-bit in 32-bit mode

Red Hat Enterprise Linux Version 6 update 3 on x86 64-bit in 32-bit mode

Red Hat Enterprise Linux Version 5 update 4 (System z) on x86 64–bit mode

Red Hat Enterprise Linux Version 6 update 3 (System z) on x86 64–bit mode

SuSE Linux Enterprise Server Version 10 on x86 64–bit

SuSE Linux Enterprise Server Version 11 on x86 64–bit mode

SuSE Linux Enterprise Server Version 11 (System z) on x86 64–bit mode

Sun Server Solaris 10 (SPARC 64–bit in 32-bit mode)

Windows Server 2008 R2 (64-bit in 32-bit mode for all Intel and AMD processors) Standard Edition

Windows Server 2008 R2 (64-bit in 32-bit mode for all Intel and AMD processors) Enterprise Edition

Windows Server 2012 (64-bit in 32-bit mode for all Intel and AMD processors) Standard Edition

VMWare ESX/ESXi Server Versions 4.0, 5.0, 5.1 and 5.5

Red Hat Enterprise Virtualization/Kernel-Based Virtual Machine (RHEV/KVM) Version 5.4

IBM Security Key Lifecycle Manager version 2.5.0 Fix Pack - 2.5.0-ISS-SKLM-FP0003

AIX

2.5.0-ISS-SKLM-FP0003-AIX.tar.gz

IBM Security Key Lifecycle Manager version 2.5.0 Fix Pack - 2.5.0-ISS-SKLM-FP0003

Linux

2.5.0-ISS-SKLM-FP0003-Linux.tar.gz

IBM Security Key Lifecycle Manager version 2.5.0 Fix Pack - 2.5.0-ISS-SKLM-FP0003

Solaris

2.5.0-ISS-SKLM-FP0003-Solaris.tar.gz

IBM Security Key Lifecycle Manager version 2.5.0 Fix Pack - 2.5.0-ISS-SKLM-FP0003

Windows

2.5.0-ISS-SKLM-FP0003-Windows.zip

Open a command prompt.

Click the Start button, Click Run, type cmd and Click the OK button.

Stop the Websphere Application Server

WAS_HOME\bin\stopServer.bat server1 -username [WAS_ADMIN] -password [WAS_PASSWORD]

Make a temporary directory

mkdir [WAS_BACKUP_DIRECTORY]
example: mkdir c:\wasbackup

Change to the temporary directory

cd c:\wasbackup

Copy the files from the directory where Websphere Application Server files is installed

xcopy /y /e /d WAS_HOME c:\wasbackup

Start the Websphere Application Server

WAS_HOME\bin\startServer.bat server1

where:
WAS_HOME is the directory where Websphere Application Server is installed
(default:C:\Program Files (x86)\IBM\WebSphere\AppServer).

Open a ksh or bash shell.

if your default shell is not ksh or bash, run "exec ksh" or "exec bash".

Stop the Websphere Application Server

$WAS_HOME/bin/stopServer.sh server1 -username [WAS_ADMIN] -password [WAS_PASSWORD]

Make a temporary directory

mkdir [WAS_BACKUP_DIRECTORY]
example: mkdir /tmp/wasbackup

Change to the temporary directory

cd /tmp/wasbackup

Archive the files from the directory where Websphere Application Server is installed

tar -cvf wasbackup.tar $WAS_HOME/*

Start the Websphere Application Server

$WAS_HOME/bin/startServer.sh server1
where:
WAS_HOME is the directory where Websphere Application Server is installed (default: /opt/IBM/WebSphere/AppServer).

Make a repository directory

Open a command prompt.Make a repository directory.

• Windows

  Default repository directory is C:\sklminstall_windowsfp
  mdir C:\sklminstall_windowsfp

• Unix

  Default repository directory is /sklminstall_linuxfp
  mkdir /sklminstall_linuxfp

Change directory to the directory created.

• Windows

  cd C:\sklminstall_windowsfp

• Unix

  cd /sklminstall_linuxfp

Download the SKLM fix pack into the repository directory.

Link to fix pack download table

Extract the downloaded file

• Windows

  Extract downloaded file 2.5.0-ISS-SKLM-FP0003-Windows.zip

• Unix

  Extract downloaded file 2.5.0-ISS-SKLM-FP0003-<platform>.tar.gz

Start Installation Manager in GUI mode

• Windows

  Open a command window, and change to the Installation_Manager_Home/eclipse directory

  where Installation_Manager_Home refers to the installation root directory for Installation Manager

  (Default path :C:\Program Files (x86)\IBM\Installation Manager\eclipse)

  double-click IBMIM.

• Unix

  Open a command window, and change to the Installation_Manager_Home/eclipse directory

  where Installation_Manager_Home refers to the installation root directory for Installation Manager

  (Default path :/opt/IBM/InstallationManager/eclipse)

  and run ./IBMIM.

Set up the fix pack repository preference

1. Select File > Preferences.

2. In the Preferences > Repositories panel, click Add Repository.

3. Click Browse and browse to the location of fixpack

4. Uncheck Search service repository during installation and upgrades option.
   SKLM does not support internet based repositories.

5. Click Apply

6. Click OK to close the Preferences >Repositories panel.

7. On the Installation Manager home page, click Update.
   The Installation Manager > Update Packages window opens.

Select the SKLM software package group

1. Select the base offering, SKLM software package group(IBM Security Key Lifecycle Manager v2.5)

2. click Next.

3. In the Update Packages updates panel
   Select each check box associated with each installed component that you want to update, and click Next.

• IBM Security Key Lifecycle Manager v2.5

• IBM Security Key Lifecycle Manager v2.5.0.0(installed)

• Version 2.5.0.3

Provide credentials for
WAS admin user
(default:wasadmin)
SKLM admin user
(default:SKLMAdmin) and DB2 user
(default:sklmdb2)

In the Update Packages Configuration for IBM Security Key Lifecycle Manager v2.5.0.3

• Enter Username and Password for Application Server Administrator

• Enter Username and Password for IBM Security Key Lifecycle Manager Application Administrator

• Enter Username and Password for IBM DB2 user

• Click on Validate Credentials button,
  Validation may take few minutes, wait till Next button gets enabled.

• Click on Next button

Click on Update button

In the Update Packages > Summary panel,
review the software packages that you want to install and click Update. After Installation Manager successfully updates the fix pack for the services that you select, it displays a message.

Installation Manager utility to encrypt the passwords for users as required

Open a command window, and change to the Installation_Manager_Home/eclipse/tools directory,
where Installation_Manager_Home refers to the installation root directory for Installation Manager

• Windows

Run the following command to generate an encrypted password:
imcl.exe encryptString password_to_encrypt

• Unix

Run the following command to generate an encrypted password:
./imcl encryptString password_to_encrypt

Make a backup of response file

Create a backup of original response file SKLM_Silent_Update_<platform>_Resp.xml by renaming it.
For example: SKLM_Silent_Update_<platform>_Resp_original.xml
This file will be located in the folder where fix pack is extracted

Edit the response file.

• Windows

Edit the silent response file "SKLM_Silent_Update_<platform>_Resp.xml"

1. Edit the repository location to point to current location of installables
   (Sample:<repository location='C:\sklminstall_windowsfp'/>)

2. Edit WASAdmin username and password(Password need to be encrypted)
   (Sample:
   <data key='user.WAS_ADMIN_ID,com.ibm.sklm.win32>value='wasadmin'/>
   <data key='user.WAS_ADMIN_PASSWORD,com.ibm.sklm.win32>value='zN39fpCc9SqIryGJM7+02A=='/>)

3. Edit SKLMAdmin username and password(Password need to be encrypted)
   (Sample:
   <data key='user.SKLM_ADMIN_ID,com.ibm.sklm.win32>value='sklmadmin'/>
   <data key='user.SKLM_ADMIN_PASSWORD,com.ibm.sklm.win32>value='94FrH/Ll220hVIYc9TflNQ=='/>)

4. Edit DB user username and password(Password need to be encrypted)
   (Sample:
   <data key='user.DB_ADMIN_USER,com.ibm.sklm.win32' value='sklmdb2'/>
   <datadata key='user.DB_ADMIN_PASSWORD,com.ibm.sklm.win32' value='SwIhGBTDHcJok80Ux4Sb3g=='/>)

• Unix

Edit the silent response file "SKLM_Silent_Update_<platform>_Resp.xml"

1. Edit the repository location to point to current location of installables
   (Sample for Linux:<repository location='/sklminstall_linuxfp'/>)

2. Edit WASAdmin username and password(Password need to be encrypted)
   (Sample:
   <data key='user.WAS_ADMIN_ID,com.ibm.sklm.Linux>value='wasadmin'/>
   <data key='user.WAS_ADMIN_PASSWORD,com.ibm.sklm.Linux>value='zN39fpCc9SqIryGJM7+02A=='/>)

3. Edit SKLMAdmin username and password(Password need to be encrypted)
   (Sample:
   <data key='user.SKLM_ADMIN_ID,com.ibm.sklm.Linux>value='sklmadmin'/>
   <data key='user.SKLM_ADMIN_PASSWORD,com.ibm.sklm.Linux>value='94FrH/Ll220hVIYc9TflNQ=='/>)

4. Edit DB user username and password(Password need to be encrypted)
   (Sample:
   <data key='user.DB_ADMIN_USER,com.ibm.sklm.linux' value='sklmdb2'/>
   <data key='user.DB_ADMIN_PASSWORD,com.ibm.sklm.linux' value='SwIhGBTDHcJok80Ux4Sb3g=='/>)

Install the fix pack

• Windows

1. Open a command window, and change to the Installation_Manager_Home/eclipse/tools directory,
   where Installation_Manager_Home refers to the installation root directory for Installation Manager

2. Run the following command for your platform to silently install SKLM Fix Pack 3
   imcl -input <Response_File> -silent

   Sample:
   C:\Program Files (x86)\IBM\Installation Manager\eclipse\tools\imcl.exe -input <Response_File> -silent
   
   where:
   -? Returns this command usage
   Response_File should be the complete path to SKLM_Silent_Update_Win32_Resp.xml
   

• Unix

1. Open a command window, and change to the Installation_Manager_Home/eclipse/tools directory,
   where Installation_Manager_Home refers to the installation root directory for Installation Manager

2. Run the following command for your platform to silently install SKLM Fix Pack 3
   ./imcl -input <Response_File> -silent

   
   

   Sample:
   /opt/IBM/InstallationManager/eclipse/tools/imcl -input <Response_File> -silent
   
   where:
   -? Returns this command usage
   Response_File should be the complete path to SKLM_Silent_Update_<platform>_Resp.xml
   

Check logs for fix pack installation success

View the log file output produced for fix pack installation success
Logs are located at <Installation_Manager_Home>/logs/native

Added Support for AES 256 Master Key

Added Support for AES 256 Backup Encryption

Added Support for Indicating Last Used Date for Key on Key Deletion Confirmation

Added Support for User Password Change from SKLM GUI

Added Support for Proof of Encryption

Added Syslog Support in Audit Logs

Added Pending Client Cert List REST Service

Added Pending Client Cert Accept REST Service

Added Pending Client Cert Reject REST Service

Added Support for Windows 2012 R2 Server Standard Edition

Added support for IBM_SYSTEM_X_SED

Added KMIP 1.2 Support

Added support for JSON and XML encodings

IV61442

2

REPEATED RESTORES FAILS WITH SQL2522N MORE THAN ONE BACKUP FILE MATCHES THE TIME STAMP VALUE PROVIDED FOR THE BACKED UP DATABASE IMAGE, AFTER A FAILED RESTORE

IV65134

2

SKLM 2.5 FP'S MESSED UP UNICODE CHARACTERS IN NON-EN LOCALE TO "??????" IN GUI

OA4599

2

SKLM AUTOBACKUP.BAT FAILS TO INTERPRET PATH IN TIPHOME

IV60256

2

THIRD PARTY CERTIFICATE IS NOT IMPORTED/EXPORTED CORRECTLY

IV60262

2

DS5000 DEVICES REGISTERED KEYS ARE NOT SERVED

IV56472

2

LINUX NON-ROOT INSTALLATION REQUIRES AN SSL PORT GREATER THAN WELL KNOW PORTS 1023

IV56214

2

KMIP TRANSACTION FAILS AFTER UPGRADING TO 2.5 OF SKLM. SEE JAVA.LANG.NULLPOINTEREXCEPTIONIN DEBUG LOG

IV60265

2

INAPPROPRIATE ERROR MEESAGE RETURNED WHEN KMIP GET MESSAGE CONTAINS WRONG DEVICE GROUP

IV60270

2

CLI TKLMKMIPTEMPLATELIST IS NOT DISPLAYING THE REGISTERED KMIP TEMPLATE

IV60284

2

ADDING SYSTEM_X TO KLM

IV60290

2

SKLM UI GETTING LOGGED OUT

IV60406

2

SKLMV2.5 FIX PACK INSTALLATION FAILS WHEN INSTALLING AS NON ROOT ON LINUX SYSTEM

IV60407

2

DISABLE SSL WEAK AND MEDIUM CIPHER SUITES FOR KMIP

IV60412

2

NEWLY CREATED CERTIFICATE NOT SUPPORTING LEASETIME

IV60409

2

RECERTIFY() DIES IF A PKCS10 CERT REQUEST IS SUPPLIED

IV60410

2

GUI DOESN'T DISPLAY SECRETDATA OBJECT

IV60411

2

CANNOT PERFORM MODIFY OPERATION ON DS5000 DEVICES AND ITS FAMILIES.

IV60532

2

LEASETIME IS VALID ATTRIBUTE EVEN IF OBJECT STATE IS REVOKED OR REVOKED_COMPROMISED

IV60528

2

EVALUATE MAX_RESPONSE_SIZE IN TTLV TERMS

IV60931

2

SKLM V2.5 CONFIGURATION WITH LDAP FAILS

IV55432

3

ON AIX PLATFORM RESTORE OPERATION FAILS DUE TO FILE PERMISSION ISSUE

IV55437

3

CERTIFICATE ASSOCIATED WITH JAG DEVICE CANNOT BE REMOVED

IV55446

3

ADDING A DEVICEGROUP FROM REST FOR DEVICEFAMILY GPFS FAILS

IV55447

3

WHEN WE LIST DEVICEGROUPS FROM REST/CLI IT DOES NOT LIST GPFS

IV55460

3

USING REST WHEN WE LIST DEVICEGROUPS FOR ANY TYPE IT DOES NOT LIST 2000 RECORDS

IV55472

3

REST SERVICE ATTRIBUTE NAME "ADDNEWCERTSTOPENDING" IS INCORRECTLY DISPLAYED AS "DEVICE.ADDNEWCERTSTOPENDING"

IV53802

3

THE SKLM V2.5 "SILENT INSTALL" METHOD REQUIRES ENCRYPTED PASSWORDS IN THE SKLM_RESPONSE FILE.

IV54751

1

SKLMADMIN GUI LOGIN GETS WHITE SCREEN USING IE9

IV54976

1

SECURITYKEYLIFECYCLEMANAGER_WAS.INIT FILE CONTAINS PASSWORD FOR WAS ADMIN'S USERID IN CLEAR TEXT ON LINUX SYSTEM

IV53766

2

INSTALL OF 2.5 FAILS WITH ERROR COMPLAINING ABOUT NOT ENOUGH SPACE IN FILE SYSTEM EVEN AFTER PREREQ CHECKING PASSED

IV54303

2

THE 2.5 DOCUMENTATION INCORRECTLY REFERENCES THE REPLICATION PROPERTIES FILE AS REPLICATIONSKLMGRCONFIG.PROPERTIES

IV55418

2

ECDSA ALGORITHM SHOULD NOT BE ALLOWED FOR 3592 OR DS8000 DEVICE GROUPS FROM REST INTERFACE

28/10/14

Create initial draft for 2.5.0-ISS-SKLM-FP0003

PSR

30/10/14

Included review comments

PSR