IT25350: DSMC SET PASSWORD FAILS WITH ANS5283E IN FIPS-ENABLED ENV

APAR status

• Closed as program error.

Error description

• If you try to execute command "dsmc set password" to locally
  store a password in FIPS-enabled operating system environment,
  the command will fail due to "ANS5283E The operation was
  unsuccessful.".
  
  L2/Customer Diagnostics:
  
  1: the following command failed:
  
  .# dsmc set password -type=vm vcenter_name.xxx.com ID@xxx.com pw
  
  ANS5283E The operation was unsuccessful.
  
  2: collect Linux strace for the failed command , the strace
  shows below message prior to the failure:
  
  open("/proc/sys/crypto/fips_enabled", O_RDONLY) = 6
  read(6, "1\n", 31)                      = 2
  
  
  Above says  /proc/sys/crypto/fips_enabled has a setting of 1.
  "dsmc  set password" can fail if /proc/sys/crypto/fips_enabled
  has a non-zero value
  .
  a new message need to indicate this condition.
  
  Products affected:
  IBM Spectrum Protect for Virtual Environments:
  Data Protection for VMware version 7.1 and 8.1 on Linux x86_64
  platform.
  
  This problem also affects IBM Spectrum Protect Backup-Archive
  Client which is the data mover for Data Protection for
  VMware 7.1.8 and higher.If you are using Backup-Archive Client
  version 7.1 and 8.1 refer to APAR IT24907
  

Local fix

• 1: follow redhat procedure to disable FIPS:
  
  https://access.redhat.com/solutions/2422061
  
  2: verify the FIPS is disabled after step 1:
  
  cat  /proc/sys/crypto/fips_enabled has a  value 0
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect for Virtual Environments: Data          *
  * Protection for VMware version 7.1 and 8.1 on Linux x86_64    *
  * platform.                                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * This issue is projected to be fixed in the Data Protection   *
  * for VMware Data Mover version 8.1.6 on Linux x86_64          *
  * platform.                                                    *
  * Note 1: This is subject to change at the discretion of IBM.  *
  ****************************************************************
  

Problem conclusion

• The following new error message has been added to the data mover
  code:
  "
  ANS1299E 'Unable to generate an encryption key for storing
  password'
  Explanation: You tried to start an operation that led to storing
  password on the IBM SP client side but the client was unable to
  generate an encryption key very likely due to a configured
  FIPS-enabled operating system environment.
  System Action: Processing stops.
  User Response: The IBM SP client doesn't support the Federal
  Information Processing Standard (FIPS) enabled operating system
  environment for locally stored passwords. See your system
  administrator for assistance in reconfiguring the FIPS-enabled
  operating system environment. For more details on FIPS support,
  see the following techdoc:
  http://www-01.ibm.com/support/docview.wss?uid=swg22007756
  "
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IT24907

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• dsmc
  

Fix information

• Fixed component name

  TSM FOR VE DP V

• Fixed component ID

  5725TVEVM

Applicable component levels