Java Tunnel Errors

[Exception in thread "main" java.lang.ExceptionInInitializerError]

If you receive the message in the toolkit viewlog, it is most likely after installing Java PTF's. It is a known issue with JDK80 SR7, they have changed the JCE jurisdiction policy files to be signed with the SHA256withRSA signature algorithm.

On V7R2M0 install PTF SI78873 to resolve this issue.

Another solution is to perform the following:

1. Create savefiles JAVA32 and JAVA64
2. Save these files (one to each savefile):
   /QOpenSys/QIBM/ProdData/JavaVM/jdk80/32bit/jre/lib/security
   /QOpenSys/QIBM/ProdData/JavaVM/jdk80/64bit/jre/lib/security
3. Delete local_policy.jar from each of the directories, if it exists
4. Sign off and back on, then try the operation again.

If the toolkit is unable to create the initial connection, consider the following:

com.jcraft.jsch.JSchException: Algorithm negotiation fail

The newer versions of HMC firmware removed support for some ssh algorithms. JSCH version 0.1.55 has been updated to use a different algorithm. To resolve this, download the latest jsch version from http://www.jcraft.com/jsch/ and place it on the controlling LPAR in /QIBM/Qzrdhasm/ssh/.

Next, update the symbolic link to point to the new JAR file:

RMVLNK OBJLNK('/QIBM/Qzrdhasm/ssh/jsch.jar')
ADDLNK NEWLNK('/QIBM/Qzrdhasm/ssh/jsch.jar') OBJ('/QIBM/Qzrdhasm/ssh/jsch-0.1.55.jar')                                                            

Java Version

The most common issue we see is that the customer is running an older variant of Java, such as 1.6.

Our toolkit works on most versions of Java without any issues. However, we do occasionally see issues in the field related to Java and this page will seek to address those issues.

NOTE: DS8000 firmware levels 7.8.30.470 or greater requires Java 8 (5770JV1 opt 16) on the controlling LPAR.

This document specifies how to set the Java version at various IBM i releases:

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020692

http://www-01.ibm.com/support/docview.wss?uid=nas8N1017748

http://www-01.ibm.com/support/docview.wss?uid=nas8N1011867

To determine the version of Java which your job is using, issue this command:

QSH CMD('java -version')

The output will list the version and platform (32 or 64 bit):

java version "1.8.0_311"                                                                                           
Java(TM) SE Runtime Environment (build 8.0.7.0 - pap6480sr7-20211025_01(SR7))                                      
IBM J9 VM (build 2.9, JRE 1.8.0 OS/400 ppc64-64-Bit Compressed References 20211022_15212 (JIT enabled, AOT enabled)
OpenJ9   - 6abb372                                                                                                 
OMR      - b898db9                                                                                                 
IBM      - 2f2c48b)                                                                                                
JCL - 20210930_01 based on Oracle jdk8u311-b11                                                                     

                                        

Java SE 6 (1.6) is not supported.

We recommend using Java SE 8 64-bit (5770JV1 option 16).

To set the Java version, create an environment variable specifying the Java home directory:

ADDENVVAR ENVVAR(JAVA_HOME) VALUE('/QOpenSys/QIBM/ProdData/JavaVM/jdk80/64bit') LEVEL(*SYS)

To verify it is set properly, use the 'echo' command:

QSH CMD('echo $JAVA_HOME')  

Verify the output:

/QOpenSys/QIBM/ProdData/JavaVM/jdk80/64bit

Java group PTFs breaks older versions of the toolkit

The following Java Group PTF levels dropped support for parameters used in the toolkit before the 4/26/2018 build:

• R730 - SF99725 level 8
• R720 - SF99716 level 16
• R710 - SF99752 level 31

If you have those PTF levels or newer, update to 4/26/2018 or newer builds of the toolkit.

Connect manually to see more errors

If there are any conditions that are preventing an SVC session from being established, run the following command in Qshell (qsh) to see more detailed errors:

java -classpath /QIBM/Qzrdhasm/ssh/RunSshTunnel.jar:/QIBM/Qzrdhasm/ssh/jsch-0.1.55.jar com.ibm.ctc.ssh.RunSshTunnel   ip_address userid password /tmp/dummyfilename

and note any error messages.

If there are no errors the command should return "Connecting to session...<SESSION CONNECTED> ".    Type exit and press enter to exit the session. 

Max limit of SVC ssh connections

The SVC at firmware levels 7.5 and newer allow a max of 32 ssh connections (older versions allow 10). Each browser connection consumes at least one connection, and each CHKCSE, SWCSE, CHKFSFLASH or STRFSFLASH consumes at least one as well. Typically we have seen the 10-ssh limit reached after four or five concurrent commands. Use the command 'svcwho' from an ssh command line (on the SVC) to see existing sessions.

Unable to start another job

The Java Tunnel requires that we can spawn additional threads to handle the i/o pipes. If STRFSFLASH is running in a single-threaded subsystem such as QBATCH or in restricted state, then we won't be able to spawn additional threads.

jsch-0.1.52.jar doesn't handle the ssh fingerprint

Although our toolkit is designed for use with jsch-0.1.50.jar, we have encountered a bug in jsch-0.1.52.jar whereby it won't import the fingerprint and add a record to known_hosts. The correct workaround is to us 0.1.50, or if you must use 0.1.52, sign in to the iSeries with QLPAR, and ssh to the SVC in qsh. You will be prompted to accept the fingerprint.

Turn on enhanced debugging