IBM Security Guardium Key Lifecycle Manager Version 4.1.1

Fix Readme

Abstract

Readme file for IBM Security Guardium Key Lifecycle Manager for Distributed and Containerized Platforms, Version 4.1.1 Fix Pack 2 (4.1.1.2) including installation-related instructions, prerequisites and corequisites, and a list of fixes.
Websphere Liberty version shipped with this fixpack is 21.0.0.9.

Content

List of fixes and features
Download instructions
Supported platforms
Prerequisites
Known limitations

Installation information
Variable definitions
Installing the fix pack on IBM Security Guardium Key Lifecycle Manager traditional
Uninstalling the fix pack
Installing the fix pack on IBM Security Guardium Key Lifecycle Manager container
Post fix-pack installation

Features included in Guardium Key Lifecycle Manager Traditional Version 4.1.1.2

Support for symmetric key wrapping for 3592 tape drives.
Support for Mutual-TLS based authentication between EKMF Web and IBM Security Guardium Key Lifecycle Manager.
Server certificate enhancements.
- Support for changing TLS server certificates for UI access.
- Support for presenting the certificate chain of trust.
Enhanced performance of KMIP query to retrieve and show real-time HADR status.

For more information, see IBM Security Guardium Key Lifecycle Manager Version 4.1.1 Fix Packs.

Internal Fixes

WebSphere Liberty start up issue post applying the fix pack .
Defect fixes around REST and Swagger UI.
Includes Apache Log4j (2.15.0) to remediate CVE-2021-44228.

APAR fixes included in Version 4.1.1.2

None

Download instructions

Go to IBM Fix Central home page: http://www.ibm.com/support/fixcentral/
In the Product selector field, type IBM Security Key Lifecycle Manager, and select the product name when it appears.
From the Installed Version list, select 4.1.1.
From the Platform list, select the appropriate platform, and click Continue.
On the Identify Fixes page, ensure that the Browse for Fixes is selected, and click Continue.
On the Select Fixes page, select fix pack 4.1.1-ISS-GKLM-FP0002, and click Continue.
You might be prompted to Sign In. If you do not have an ID, click the Register now link and follow the registration steps.
On the Download options page, select a download method (default is Download using Download Director).
Select the associated files and README for fix pack: 4.1.1-ISS-GKLM-FP0002 and click Download now.

Supported platforms

See IBM Security Guardium Key Lifecycle Manager Support Matrix.

Fix pack files per platform for IBM Security Guardium Key Lifecycle Manager Traditional

Product/Component name	Platform	File name	Command	Checksum
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	AIX	4.1.1-ISS-GKLM-FP0002-AIX.tar.gz	md5sum FileName.tar.gz For example (UNIX/Linux): md5sum 4.1.1-ISS-GKLM-FP0002-AIX.tar.gz Sample output c5f3c9189138505a3efdb6d0c6816acd 4.1.1-ISS-GKLM-FP0002-AIX.tar.gz	c5f3c9189138505a3efdb6d0c6816acd
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	Linux	4.1.1-ISS-GKLM-FP0002-Linux.tar.gz		ddb31cac1be63336c00eaaf83ff55971
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	zLinux (IBM Z)	4.1.1-ISS-GKLM-FP0002-zLinux.tar.gz		54b74e9716d273870e4958d681093688
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	Linux PPC	4.1.1-ISS-GKLM-FP0002-LinuxPPC.tar.gz		355bed9848d821dbd247de74cac65c1f
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	Windows	4.1.1-ISS-GKLM-FP0002-Windows.zip	certutil -hashfile FileName.zip md5 For example (Windows): certutil -hashfile 4.1.1-ISS-GKLM-FP0002-Windows.zip md5 Sample output MD5 hash of file 4.1.1-ISS-GKLM-FP0002-Windows.zip: 91657394caf47c866a1c20b4c9dc0041 CertUtil: -hashfile command completed successfully.	91657394caf47c866a1c20b4c9dc0041

Fix pack files for IBM Security Guardium Key Lifecycle Manager container

Product/Component name	Platform	File name	Command	Checksum
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	Linux PPC	sklm4112-ppc64le.tar	md5sum FileName.tar.gz For example (UNIX/Linux): md5sum sklm4112-ppc64le.tar Sample output 1767e9e3648ae669f5ba773bbcb9a4e2 sklm4112-ppc64le.tar	1767e9e3648ae669f5ba773bbcb9a4e2
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	zLinux (IBM Z)	sklm4112-s390x.tar		4c17d2c5b8e74d80ee226f40ea787b85
IBM Security Guardium Key Lifecycle Manager version 4.1.1 Fix Pack - 4.1.1-ISS-GKLM-FP0002	x86_64	sklm4112-x86_64.tar		fc0274d511fb36974ac2075531a8125c

Prerequisite for IBM Security Guardium Key Lifecycle Manager Traditional

Ensure that IBM Security Guardium Key Lifecycle Manager is not in use.
Back up the IBM Security Guardium Key Lifecycle Manager server. For instructions, see Configuring backup and restore.
(Only on IBM Security Guardium Key Lifecycle Manager traditional) Ensure the following prerequisites:
- Ensure that IBM Security Guardium Key Lifecycle Manager, Version 4.1.1 (GA version) is already installed.
- Ensure that /tmp directory does not contain klmPrev.properties. If present, rename or remove this file before you start applying fix pack.
  Also, ensure that the /tmp directory has all the permissions and does not have noexec set.
- On Linux for System z server, ensure that gtk 2 libraries are installed. Also, add following parameter in IM_INSTALL_DIR/eclipse/IBMIM.ini file. Add the following properties just before "--launcher.appendVmargs" in IBMIM.ini file.
  --launcher.GTK_version
  2
- On AIX platform, run following command before applying fix pack -
  su - <db2 user>
  db2 connect to <db name> user <root> using <root password>
  db2 grant secadm on database to user <db2 user>
- Ensure that umask is set to 0022.
- Back up the WebSphere Liberty files. For instructions, see the following table:

S.No.	Instruction	Windows Commands	UNIX/Linux Commands
1.	Windows - Open command line. Linux / AIX - Open a ksh or bash shell.	Click Start > Run, type cmd, and click OK.	If your default shell is not ksh or bash, run "exec ksh" or "exec bash".
2.	Stop WebSphere Liberty.	WAS_HOME\bin\server.bat stop	WAS_HOME/bin/server.sh stop
3.	Make a temporary directory.	mkdir WAS_BACKUP_DIRECTORY For example: mkdir C:\wasbackup	mkdir WAS_BACKUP_DIRECTORY For example: mkdir /tmp/wasbackup
4.	Change directory to the temporary directory.	cd C:\wasbackup	cd /tmp/wasbackup
5.	Copy or archive the files from the directory where WebSphere Liberty is installed.	xcopy /y /e /d WAS_HOME C:\wasbackup	tar -cvf wasbackup.tar WAS_HOME/*
6.	Start WebSphere Liberty.	WAS_HOME\bin\server.bat start	WAS_HOME/bin/server.sh start

Known limitations

Rollback of installed fix pack is not supported.
Only applicable for Linux for System z platform: After you apply the fix pack, the graphical user interface of Guardium Key Lifecycle Manager does not start.
Workaround:
1. Stop WebSphere Liberty.
2. Stop Db2.
3. Start Db2.
4. Start WebSphere Liberty.
The graphical user interface will be accessible.
Unable to apply FP if 411GA or 411FP1 is enabled with TLSv1.3.
Workaround: Enable TLSv1.2 and then apply FP.

Installing the fix pack on IBM Security Guardium Key Lifecycle Manager traditional

Installing a fix pack involves the following steps:

1. Complete the prerequisites.

2. Prepare to install the fix pack.

3. Install the fix pack.

By using the graphical user interface
Silently

4. Complete the post fix-pack installation tasks.

Prepare to install the fix pack

Open the command line.
Create a temporary directory to extract the fix pack installer files.
Windows
mkdir C:\sklminstall_windowsfp
UNIX/Linux
mkdir /sklminstall_linuxfp
Change directory to this temporary directory.
Windows
cd C:\sklminstall_windowsfp
UNIX/Linux
cd /sklminstall_linuxfp
Download the fix pack installer files into the directory. See Download Instructions.
Extract the downloaded files.
For example:
Windows: 4.1.1-ISS-GKLM-FP0002-Windows.zip [Right-click and extract all]

UNIX/Linux: tar -xvf 4.1.1-ISS-GKLM-FP0002-Linux.tar.gz

Note: Use the platform-specific file.

Installing the fix pack by using the graphical user interface

S. No.	Instruction	Steps
1.	Start Installation Manager in GUI mode.	Windows Open a command line, and change the directory to the directory where you extracted the installer files. For example: C:\sklminstall_windowsfp Run the following command: updateSKLM.bat IM_INSTALL_LOCATION WAS_INSTALL_LOCATION For example: updateSKLM.bat "C:\Program Files\IBM\Installation Manager" "C:\Program Files\IBM\WebSphere\Liberty" UNIX/Linux Open a command line, and change the directory to the directory where you extracted the installer files. For example: /sklminstall_linuxfp Run the following commands: chmod +x ./updateSKLM.sh ./updateSKLM.sh IM_INSTALL_LOCATION WAS_INSTALL_LOCATION For example: updateSKLM.sh /opt/IBM/InstallationManager /opt/IBM/WebSphere/Liberty
2.	Select Websphere Liberty package group and IBM Security Guardium Key Lifecycle Manager, Version 4.1.1 software package group.	1. Select the Update all packages (mandatory) with recommended updates and recommended fixes checkbox to select the IBM Security Guardium Key Lifecycle Manager, Version 4.1.1 software package group and Websphere Liberty package group. 2. Click Next.
3.	Accept license agreement.	1. Read license agreement carefully. If you are ok, accept license agreement. 2. Click Next.
4.	Configuration for IBM Websphere Liberty	1. Enter the update option for Websphere Liberty. Do not select checkbox to connect to online IBM Websphere Liberty Repository. 2. Click Next.
5.	Provide credentials for SKLM admin user (default: SKLMAdmin) and Db2 user (default: klmdb411).	In the Update Packages Configuration for IBM Security Guardium Key Lifecycle Manager v4.1.1.2 pane: Enter Username and Password for IBM Security Guardium Key Lifecycle Manager Application Administrator. Enter Username and Password for IBM Db2 user. Click Validate Credentials. Validation might take few minutes. Wait until the Next button is enabled. Click Next.
6.	Complete the final step.	In the Update Packages > Summary pane, review the software packages that you want to install, and click Update. After Installation Manager successfully updates the fix pack for the services that you select, a message is displayed.

Installing the fix pack silently

S. No.	Instruction	Steps
1.	Start the Installation Manager utility to encrypt the passwords for users as required.	Open a command line. Change the directory to the IM_INSTALL_LOCATION/eclipse/tools directory. Windows Run the following command to generate an encrypted password: imcl.exe encryptString password_to_encrypt UNIX/LINUX Run the following command to generate an encrypted password: ./imcl encryptString password_to_encrypt
2.	Back up the response file.	Rename the original response file to create a backup of the file: SKLM_Silent_Update_platform_Resp.xml For example: SKLM_Silent_Update_platform_Resp_original.xml The response file is located in the /sklm directory, which is within the directory where the fix pack is extracted.
3.	Edit the response file.	Windows Edit the response file SKLM_Silent_Update_platform_Resp.xml. Edit the repository location to point to the current location of the installer. Sample: <repository location='C:\sklminstall_windowsfp\wasfp\repository.config'/> <repository location='C:\sklminstall_windowsfp\sklmwasfp\repository.config'/> Edit GKLMAdmin username and password (Password need to be encrypted). Sample: <data key='user.SKLM_ADMIN_USER,com.ibm.gklm411.win> value='SKLMAdmin'/> <data key='user.SKLM_ADMIN_PASSWORD,com.ibm.gklm411.win> value='9YTRJMRIydDSdfhaHPs1ag=='/> Edit Db2 username and password (Password need to be encrypted). Sample: <data key='user.DB_ADMIN_USER,com.ibm.gklm411.win' value='klmdb411'/> <data key='user.DB_ADMIN_PASSWORD,com.ibm.gklm411.win' value='QTh/0AiFvrljhs9gnOYkGA=='/> UNIX/Linux Edit the response file: SKLM_Silent_Update_platform_Resp.xml Edit the repository location to point to the current location of the installer. Sample for Linux: <repository location='/sklminstall_linuxfp/wasfp/repository.config'/> <repository location='/sklminstall_linuxfp/sklm/repository.config'/> Edit GKLMAdmin username and password (Password needs to be encrypted). Sample: <data key='user.SKLM_ADMIN_USER,com.ibm.gklm411.linux> value='SKLMAdmin'/> <data key='user.SKLM_ADMIN_PASSWORD,com.ibm.gklm411.linux> value='9YTRJMRIydDSdfhaHPs1ag=='/> Edit the username and password of the Db2 user (Password need to be encrypted). Sample: <data key='user.DB_ADMIN_USER,com.ibm.gklm411.lin' value='klmdb411'/> <data key='user.DB_ADMIN_PASSWORD,com.ibm.gklm411.lin' value='QTh/0AiFvrljhs9gnOYkGA=='/>
4.	Install the fix pack.	Windows Open a command line, and change directory to the directory where the installer files are extracted. For example: C:\sklminstall_windowsfp For example: /sklminstall_linuxfp Run the following command: silent_updateSKLM.bat IM_INSTALL_LOCATION WAS_INSTALL_LOCATION For example: silent_updateSKLM.bat "C:\Program Files\IBM\Installation Manager" "C:\Program Files\IBM\WebSphere\Liberty" UNIX/Linux Open a command line, and change the directory to the repository directory. For example: /sklminstall_linuxfp Run the following commands: chmod +x ./silent_updateSKLM.sh ./silent_updateSKLM.sh IM_INSTALL_LOCATION WAS_INSTALL_LOCATION For example: ./silent_updateSKLM.sh /opt/IBM/InstallationManager /opt/IBM/WebSphere/Liberty

Installing the fix pack when a Multi-Master environment is set up

Prerequisites

If the original primary master server is acting as a standby master server, promote it to primary and then, install the fix pack. Otherwise, the database updates are not applied to the cluster.

To promote a master server to primary, see Promote to primary.

To install the fix pack

Stop WebSphere Liberty on all the master servers, in any sequence.
- Open a command line.
- Go to the WAS_HOME\bin directory.
  Windows
  C:\Program Files\IBM\WebSphere\Liberty\bin
  Linux
  /opt/IBM/WebSphere/Liberty/bin
- Stop the IBM Security Guardium Key Lifecycle Manager server.
  Windows
  server.bat stop
  Linux
  ./server.sh stop
Stop Agent on all the master servers, in any sequence.
- Open a command line.
- Go to the GKLM_INSTALL_HOME\agent directory.
  Windows
  C:\Program Files\IBM\GKLMV411\agent
  Linux
  /opt/IBM/GKLMV411/agent
- Stop the Agent.
  Windows
  stopAgent.bat WAS_HOME
  For example: stopAgent.bat "C:\Program Files\IBM\WebSphere\Liberty"
  Linux
  ./stopAgent.sh WAS_HOME
  For example: ./stopAgent.sh /opt/IBM/WebSphere/Liberty
Apply fix pack on each master server and verify the installation.
Complete this step in the following sequence:
- Primary master server
- Principal standby master server
- Auxiliary standby master servers
- Non-HADR master servers
  
  For steps to install the fix pack, see Installing the fix pack.
  To verify the installation:
  - Log in to IBM Security Guardium Key Lifecycle Manager and check the version number.
  - Ensure that the master server is running and available for use.

Post fix-pack installation

Use one of the following methods to verify the installation.

Using graphical user interface:
a. Log in to the graphical user interface.
b. On the Welcome page header bar, click the Help (?) icon.
c. Click About.
The page displays the version details.
Using REST interface:
Run the Version Info REST Service. For more information, see Swagger UI.


  For Traditional IBM Security Guardium Key Lifecycle Manager   
  ===========================================================
  IBM Security Guardium Key Lifecycle Manager Version: 4.1.1.2
  IBM Security Guardium Key Lifecycle Manager Build Level: 202112151923
  Liberty WAS Version: 21.0.0.9
  Database Version: DB2/LINUXX8664 SQL110560
  Java Version: JRE 1.8.0_281 IBM J9 VM 2.9
  Operating System Version: Linux:3.10.0-1160.36.2.el7.x86_64:amd64
  Agent Version: 2.0


  For Containerised IBM Security Guardium Key Lifecycle Manager
  ============================================================= 
  IBM Security Guardium Key Lifecycle Manager Version: 4.1.1.2
  IBM Security Guardium Key Lifecycle Manager Build Level: 202112160045
  Liberty WAS Version: 21.0.0.9
  Database Version: PostgreSQL 14.1 (Debian 14.1-1.pgdg110+1)
  Java Version: JRE 1.8.0_301 IBM J9 VM 2.9
  Operating System Version: Linux:4.18.0-305.25.1.el8_4.x86_64:amd64
  Image Tag: 4.1.1.2

Back up the IBM Security Guardium Key Lifecycle Manager server. For more information, see Configuring backup and restore.

Uninstalling the fix pack

Important: The following steps uninstall the entire product package, including IBM Security Guardium Key Lifecycle Manager, IBM Db2, and WebSphere Liberty, and all your data is lost. Take a backup before uninstalling.

Uninstalling IBM Security Guardium Key Lifecycle Manager with the fix pack by using the graphical user interface

See GUI uninstall on Windows.

See GUI uninstall on Linux.

Uninstalling IBM Security Guardium Key Lifecycle Manager with the fix pack silently

See Silent uninstall on Windows.

See Silent uninstall on Linux.

Installing the fix pack on IBM Security Guardium Key Lifecycle Manager container

As a security enhancement, user can now provide encrypted string as environment variable for passwords.

Example :-

echo "Ch@ngemypa55word" | openssl rsautl -encrypt -inkey sklm_public -pubin | base64 -w 0

where, sklm_public key is available at the build location( IBM Fix Central ).

Copy the output of this command as environment variable for container deployment.
Please see section below for Installing IBM Security Guardium Key Lifecycle Manager 4.1.1 fixpack 1 on Kubernetes cluster and Red Hat OpenShift Container Platform cluster.

Installing on a Kubernetes cluster

See Install on a Kubernetes cluster.

Installing on a Red Hat OpenShift Container Platform cluster

See Install on a Red Hat OpenShift Container Platform cluster.

Post fix-pack installation

See Post fix-pack installation.

Copyright and trademark information

http://www.ibm.com/legal/copytrade.shtml

Notices

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both.

Other company, product, or service names may be trademarks or service marks of others.

THIRD-PARTY LICENSE TERMS AND CONDITIONS, NOTICES AND INFORMATION

The license agreement for this product refers you to this file for details concerning terms and conditions applicable to third party software code included in this product, and for certain notices and other information IBM must provide to you under its license to certain software code. The relevant terms and conditions, notices and other information are provided or referenced below. Please note that any non-English version of the licenses below is unofficial and is provided to you for your convenience only. The English version of the licenses below, provided as part of the English version of this file, is the official version.

Notwithstanding the terms and conditions of any other agreement you may have with IBM or any of its related or affiliated entities (collectively "IBM"), the third party software code identified below are "Excluded Components" and are subject to the following terms and conditions:

the Excluded Components are provided on an "AS IS" basis.
IBM DISCLAIMS ANY AND ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS WITH RESPECT TO THE EXCLUDED COMPONENTS, INCLUDING, BUT NOT LIMITED TO, THE WARRANTY OF NON-INFRINGEMENT OR INTERFERENCE AND THE IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IBM will not be liable to you or indemnify you for any claims related to the Excluded Components.
IBM will not be liable for any direct, indirect, incidental, special, exemplary, punitive or consequential damages with respect to the Excluded Components.

End of Document

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTJE47","label":"IBM Security Guardium Key Lifecycle Manager"},"ARM Category":[{"code":"a8m0z000000cvdzAAA","label":"SKLM-\u003EINSTALL-\u003EFIXPACK"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"4.1.1"}]

Tips

IBM Security Guardium Key Lifecycle Manager Version 4.1.1 - Fix Pack 2 README

Fix Readme

Abstract

Content

Was this topic helpful?

Document Information

UID

Share your feedback

Need support?