IT36893: FIPS ENABLED SYSTEM DOESN'T COMPLETE CLIENT INSTALLATION

APAR status

• Closed as program error.

Error description

• The client installation fails the FIPS-enabled environment due
  to lack of appropriate package signing.
  
  Diagnostics:
  In the reported case, here are a few of the errors reported when
  the GSKit rpm package signature checking failed:
  
  
  /home/software/TSM/8.1.10/TSMCLI_LNX/tsmcli/linux86 > rpm
  --import GSKit.pub.pgp
  /home/software/TSM/8.1.10/TSMCLI_LNX/tsmcli/linux86 >
  /home/software/TSM/8.1.10/TSMCLI_LNX/tsmcli/linux86 > rpm
  --checksig gskcrypt64-8.0.55.14.linux.x86_64.rpm --verbose
  
  gskcrypt64-8.0.55.14.linux.x86_64.rpm: Header V3 RSA/SHA256
  Signature, key ID fbbfca9c: OK
  Header SHA1 digest: OK
  Payload SHA256 digest: NOTFOUND
  V3 RSA/SHA256 Signature, key ID fbbfca9c: OK
  MD5 digest: NOTFOUND
  
  
  IBM Spectrum Protect Client Versions Affected:  V7.1.x and
  V8.1.x  levels on all supported Linux platforms
  
  
  
  Initial Impact: Low
  
  
  
  Additional Keywords:
  
  TS003795606 FIPS SP client failed install
  

Local fix

• User can install the products in non-FIPS mode and then reboot
  into FIPS mode and use the backup-archive client.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect backup-archive client version 8.1.x on  *
  * Linux platforms installed on FIPS enabled RHEL8 systems      *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See error description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in IBM Spectrum Protect backup-archive *
  * client version 8.1.13 on Linux86_64 platform. Note that this *
  * is subject to change at the discretion of IBM.               *
  ****************************************************************
  

Problem conclusion

• After the fix the backup-archive client installation completes
  successfully.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TSM CLIENT

• Fixed component ID

  5698ISMCL

Applicable component levels