IBM Support

Updating the system installed IBM® openSSL and openSSH packages in an IBM PureData System for Operational Analytics environment.

How To


Summary

IBM PureData System for Operational Analytics (PDOA) uses AIX on its management, management standby, admin, admin standby, data, and data standby hosts or LPARs. AIX includes installp based OpenSSL and OpenSSH packages and these packages might need to be updated outside of the normal IBM PureData System for Operational Analytics fix pack process. This document describes that process.

Objective

The goal of this document is to describe how to determine the OpenSSH and OpenSSL levels installed on the AIX LPARs, determine how to obtain new levels, and how to install those levels in an IBM PureData System for Operational Analytics environment.
 
Review the following technote,https://www.ibm.com/support/pages/node/366721. This note describes in general the philosophy for updating components outside of the fix pack process.
 
IBM PureData System for Operational Analytics tracks specific OpenSSL and OpenSSH levels as part of its validated stacks. (See IBM PureData System for Operational Analytics Validated Stack Pages ).

Steps

Planning:
OpenSSL and OpenSSH are critical components in the environment. Updating either package can lead to connectivity issues between the AIX LPARs and the rest of the environment. In practice updates have impacted connectivity from the management LPAR to the SAN Switches, Storage Enclosures and the Network Switches. IBM strongly recommends upgrading to the latest V1.1 fix pack before applying OpenSSH or OpenSSL updates to reduce the risk of connectivity issues as many issues are remediated through the application of the fix pack.
In an IBM PureData System for Operational Analytics environment, there is more to consider depending on the risk tolerance of the system.
  • If a test environment is available, use that environment to test any updates. All update steps can be tested and verified away from production.
  • Identify the process for which the updates will be applied.
    • Full system outage. In this case all hosts are quiesced to prepare for the update in an outage window.
    • PDOA V1.1 Fix pack Stage 7 model. In this model, hosts that are currently acting as a standby host will be quiesced, updated, and then unquiesced. After the first set of standby hosts are updated there is a brief interruption to failover hosts. This model takes more time, but involves less risk of an unexpected outage and only requires small interruptions for failovers. Each update cycle is called a "pass".
    • No outage. In this model updates are applied to hosts without quiescing services on those hosts. This is not recommended for production systems or systems with uptime requirements.
  • On the system being updated, whether it is test or production, identify a host that can be used as a test host to practice the update. In an IBM PureData System for Operational Analytics environment the best host is the management standby host. This host is not critical to production use.
  • Verify that the host or hosts each has a recent mksysb.
  • For faster recovery, break the mirror for rootvg and create a new clone for that host. Refer to the PDOA V1.1 FP4 readme file, Stage 7, Phase 3 for more information about cloning AIX LPARs in PDOA environments. V1.1 FP4 includes fix pack tools that can be used to manage rootvg safely. If not using the tools , refer to "Appendix -- Backup rootvg" which includes the AIX commands needed to create a rootvg clone.
  • If using the full system outage model or the V1.1 Fix pack Stage 7 model, quiesce the system or quiesce the hosts to be updated. If there are no standby hosts that need to be updated, but there are still hosts that need to be updated, then perform failovers as necessary.
  • Apply updates when LPARs are quiesced. A quiesced host has all services, GPFS, TSA and DB2, stopped on the host. This practice follows the update methodology described in Stage 7 of the V1.1 FP2, V1.1 F3 and V1.1 FP4 readme files, where updates only occur on hosts that have the "Standby" role and are quiesced. This practice therefore allows updates to occur without significant downtime.
  • Components can be downloaded to /BCU_share/support. In this case, /BCU_share/support/openssh_openssl. This is an NFS based file system that can be mounted on all LPARs as needed.
  • Be sure to test the connectivity to and from updated LPARs and the outside world as well as from the management node to each component type from the management LPAR: (management to HMC, management to SAN, management to V7000, management to Flash900, management to network switches).
  • Verify connectivity and root login credentials from the HMC to all servers via the virtual terminal or vtmenu (hmc command line). If there is an issue with ssh after installation you may not be able to ssh in or out over the internal or corporate networks.
Determine the current fix pack level used in the environment. As the root user on the management host, run the following command. Note that this value is not updated until Stage 9 of a PDOA fix pack (V1.1 FP2 and higher). Contact IBM Support for more information about updating OpenSSH and/or OpenSSL as part of an overall fix pack application.
$ appl_ls_cat -i
NAME                     VERSION                       STATUS                   DESCRIPTION
bwr3                     4.0.9.0                       Committed                Updates for IBM_PureData_System_for_Operational_Analytics
The version pattern is '4.0.#.Y'. The # symbol is used to identify the fix pack level. The following table shows the relationship to the version column and the appliance fix pack version. To determine the fix pack version simply subtract 4 from the number represented by '#'.
Relationship between the appl_ls_cat version column and the appliance version.
appl_ls_cat version column Appliance Version
4.0.4.0 V1.1 GA
4.0.5.0 V1.1 FP1
4.0.6.0 V1.1 FP2
4.0.7.0 V1.1 FP3
4.0.8.0 V1.1. FP4
4.0.9.0 V1.1 FP5
Review the release dates for the fix pack versions using the following links.
 
Customers who are not on the current fix pack level should consider upgrading to the current fix pack level before applying any component level updates.
This document refers to V1.1 FP4 and its readme file ( IBM PureData System for Operational Analytics V1.1 Fix Pack 4 Readme file). V1.1 FP4 includes scripts that are not only helpful in applying V1.1 FP4, they also aid in managing the system. Many of these tools are compatible with previous versions of IBM PureData System for Operational Analytics. One such tool is "/BCU_share/FP8_FP4/fixpack_tools/application/mirror_utility.sh" which helps to maintain rootvg with mirror, unmirror, clone, and unclone functions. For more information about this tool, refer to Stage 2 Phase 2, and Stage 7 Phase 3 in the V1.1 FP4 Readme. There are two Appendixes, Appendix – Backup rootvg volume group and Appendix – Restoring rootvg mirrors, which provide the raw AIX commands to clone and re-mirror rootvg as needed. The tools and fix pack readme files are updated with each fix pack release, so use the latest fix pack available if possible. The list of available fix pack readme files can be found in the link PureData System for Operational Analytics fix pack readme documents .
Determine the current OpenSSH and OpenSSL Levels on the appliance. This dsh command is run on the management host as the root user. The following command shows the output of a V1.1 FP5 system.
$ dsh -n ${ALL} 'lslpp -la | egrep "openssl.base|openssh.base" | sort | uniq' | dshbak -c
HOSTS -------------------------------------------------------------------------
host01, host02, host03, host04, host05, host06, host07
-------------------------------------------------------------------------------
  openssh.base.client   8.1.102.2105  COMMITTED  Open Secure Shell Commands
  openssh.base.server   8.1.102.2105  COMMITTED  Open Secure Shell Server
  openssl.base            1.0.2.2104  COMMITTED  Open Secure Socket Layer
The AIX Links for downloading OpenSSH and OpenSSL packages can be found in the AIX technote titled Downloading and Installing or Upgrading OpenSSL and OpenSSH. To download any of the fixes requires an IBM ID.
If you were directed here from a security bulletin, refer to the security bulletin for the version that needs to be downloaded. It is important to review the readme files as it may be necessary to synchronize the OpenSSH and OpenSSL versions.
Create a new directory in /BCU_share/support on the management host to contain the new files depending upon the type (openssh or openssh) . The /BCU_share directory is exported via NFS to all hosts in the environment.
mkdir -p /BCU_share/support/openssh_openssl
As of this writing, the latest available OpenSSL and OpenSSH versions available that are appropriate for PDOA available from the AIX marketing site are:
Package Version Filenames
OpenSSL 1.0.2 for AIX 6.1, 7.1, 7.2 & 7.3 VRMF: 1.0.2.2105 (1.0.2u)
openssl-1.0.2.2105.tar.Z
Readme-1.0.2.2105.txt
OpenSSH 8.1 (compiled with OpenSSL 1.0.2) VRMF: 8.1.102.2106
OpenSSH_8.1.102.2106.tar.Z
Readme-8.1.102.2106.txt
Note that PDOA uses OpenSSL 1.0.2 in V1.1 FP5. Do not download a different OpenSSL version nor an OpenSSH version compiled with a different OpenSSL version.
Download all of these files to the support directory.
In this case the directory listing will show:
$ ls -la
total 100624
drwxr-xr-x    2 root     system          256 Feb 17 17:48 .
drwxr-xr-x   18 root     system        16384 Feb 17 17:39 ..
-rwx------    1 root     system     12606589 Feb 17 17:48 OpenSSH_8.1.102.2106.tar.Z
-rwx------    1 root     system         9686 Feb 17 17:48 Readme-1.0.2.2105.txt
-rwx------    1 root     system         9185 Feb 17 17:48 Readme-8.1.102.2106.txt
-rwx------    1 root     system     38870113 Feb 17 17:48 openssl-1.0.2.2105.tar.Z
Review the readme file documents carefully for any instructions or compatibility issues. As OpenSSH depends on OpenSSL it may be necessary to update both even if the security bulletin only mentions one or the other components.
Unpack the tar.Z packages. These files are packaged with the component and version name in sub-directories, however, this may change in the future.
$ ls *.tar.Z | while read x;do gzip -d < ${x} | tar -xvf -;done
x OpenSSH_8.1.102.2106
x OpenSSH_8.1.102.2106/openssh.base, 12819456 bytes, 25038 media blocks.
x OpenSSH_8.1.102.2106/openssh.license, 446464 bytes, 872 media blocks.
x OpenSSH_8.1.102.2106/openssh.man.en_US, 184320 bytes, 360 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.CA_ES, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.CS_CZ, 21504 bytes, 42 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.DE_DE, 21504 bytes, 42 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.EN_US, 17408 bytes, 34 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.ES_ES, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.FR_FR, 21504 bytes, 42 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.HU_HU, 21504 bytes, 42 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.IT_IT, 19456 bytes, 38 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.JA_JP, 24576 bytes, 48 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.Ja_JP, 26624 bytes, 52 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.KO_KR, 22528 bytes, 44 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.PL_PL, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.PT_BR, 19456 bytes, 38 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.RU_RU, 25600 bytes, 50 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.SK_SK, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.ZH_CN, 25600 bytes, 50 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.ZH_TW, 25600 bytes, 50 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.Zh_CN, 21504 bytes, 42 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.Zh_TW, 21504 bytes, 42 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.ca_ES, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.cs_CZ, 27648 bytes, 54 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.de_DE, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.en_US, 17408 bytes, 34 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.es_ES, 19456 bytes, 38 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.fr_FR, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.hu_HU, 20480 bytes, 40 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.it_IT, 19456 bytes, 38 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.ja_JP, 26624 bytes, 52 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.ko_KR, 19456 bytes, 38 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.pl_PL, 27648 bytes, 54 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.pt_BR, 19456 bytes, 38 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.ru_RU, 27648 bytes, 54 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.sk_SK, 26624 bytes, 52 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.zh_CN, 21504 bytes, 42 media blocks.
x OpenSSH_8.1.102.2106/openssh.msg.zh_TW, 21504 bytes, 42 media blocks.
x openssl-1.0.2.2105
x openssl-1.0.2.2105/openssl.base, 59109376 bytes, 115448 media blocks.
x openssl-1.0.2.2105/openssl.license, 50176 bytes, 98 media blocks.
x openssl-1.0.2.2105/openssl.man.en_US, 3290112 bytes, 6426 media blocks.

(0) root @ b30i01: 7.2.0.0: /BCU_share/support/openssh_openssl
Before proceeding ensure you have read the planning documentation and have taken appropriate measures to revert any changes (cloning, mksysb) and to mitigate any issues that are encountered. Always install OpenSSL before OpenSSH if installing both.
As part of the planning for this update you should plan to quiesce servers that are being updated. This takes full advantage of the redundant design of the appliance. For PDOA fix packs this model is used in Stage 7 where updates are performed on Standby LPARs that have been quiesced. Once the updates are completed the updated Standby LPARs are put back into service. This is referred to as a pass. Once a pass is completed it is possible to plan for failovers to move services from LPARs that are not yet updated to the updated LPARs. Simply repeat this process until all LPARs have been updates. The maximum number of passes in a PDOA environment needed is 4 and can be spread over multiple windows.
Note that in PDOA, OpenSSL is only used by OpenSSH as shipped. However, third party components may use OpenSSL. When planning the installation any existing component will continue to use the previous level of OpenSSL and OpenSSH. Applications that are starting after the installation is complete will use the updated levels. Therefore for security purposes it is generally easier to plan to reboot the host.
If Installing OpenSSL, preview the OpenSSL installation use the following to find the latest OpenSSL installation. This command is run as root on that specific host. Note, with planning it is possible to run these commands in parallel on multiple hosts with 'dsh' or using separate logins.
$ find /BCU_share/support/openssh_openssl -name openssl.base | sort | tail -1 | xargs dirname
/BCU_share/support/openssh_openssl/openssl-1.0.2.2105
Use the following to run the installp preview on the target host. This command finds the latest OpenSSL directory and runs the installp preview operation.
$ find /BCU_share/support/openssh_openssl -name openssl.base | sort | tail -1 | xargs dirname | xargs -I{} installp -apYd {} openssl
*******************************************************************************
installp PREVIEW:  installation will not actually occur.
*******************************************************************************

+-----------------------------------------------------------------------------+
                    Pre-installation Verification...
+-----------------------------------------------------------------------------+
Verifying selections...done
Verifying requisites...done
Results...

SUCCESSES
---------
  Filesets listed in this section passed pre-installation verification
  and will be installed.

  Selected Filesets
  -----------------
  openssl.base 1.0.2.2105                     # Open Secure Socket Layer
  openssl.license 1.0.2.2105                  # Open Secure Socket License
  openssl.man.en_US 1.0.2.2105                # Open Secure Socket Layer

  << End of Success Section >>

+-----------------------------------------------------------------------------+
                   BUILDDATE Verification ...
+-----------------------------------------------------------------------------+
Verifying build dates...done
FILESET STATISTICS
------------------
    3  Selected to be installed, of which:
        3  Passed pre-installation verification
  ----
    3  Total to be installed

RESOURCES
---------
  Estimated system resource requirements for filesets being installed:
                (All sizes are in 512-byte blocks)
      Filesystem                     Needed Space             Free Space
      /                                      96                5804120
      /usr                                 3465               19218072
      /var                                    8               14070296
      -----                            --------                 ------
      TOTAL:                               3569               39092488

  NOTE:  "Needed Space" values are calculated from data available prior
  to installation.  These are the estimated resources required for the
  entire operation.  Further resource checks will be made during
  installation to verify that these initial estimates are sufficient.
  Use the option to extend filesystems (-X flag) to ensure that any
  additional resources which may be needed are automatically allocated.

******************************************************************************
End of installp PREVIEW.  No apply operation has actually occurred.
******************************************************************************

(0) root @ host01: 7.2.0.0: /BCU_share/support/openssh_openssl
To update OpenSSL using the following command, run as root on the host.
$ find /BCU_share/support/openssh_openssl -name openssl.base | sort | tail -1 | xargs dirname | xargs -I{} installp -aXYd {} openssl
+-----------------------------------------------------------------------------+
                    Pre-installation Verification...
+-----------------------------------------------------------------------------+
Verifying selections...done
Verifying requisites...done
Results...

SUCCESSES
---------
  Filesets listed in this section passed pre-installation verification
  and will be installed.

  Selected Filesets
  -----------------
  openssl.base 1.0.2.2105                     # Open Secure Socket Layer
  openssl.license 1.0.2.2105                  # Open Secure Socket License
  openssl.man.en_US 1.0.2.2105                # Open Secure Socket Layer

  << End of Success Section >>

+-----------------------------------------------------------------------------+
                   BUILDDATE Verification ...
+-----------------------------------------------------------------------------+
Verifying build dates...done
FILESET STATISTICS
------------------
    3  Selected to be installed, of which:
        3  Passed pre-installation verification
  ----
    3  Total to be installed

+-----------------------------------------------------------------------------+
                         Installing Software...
+-----------------------------------------------------------------------------+

installp:  APPLYING software for:
        openssl.man.en_US 1.0.2.2105


. . . . . << Copyright notice for openssl.man.en_US >> . . . . . . .
 Licensed Materials - Property of IBM

 5765G6281
   Copyright International Business Machines Corp. 2011, 2022.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssl.man.en_US >>. . . .

Filesets processed:  1 of 3  (Total time:  1 mins 11 secs).

installp:  APPLYING software for:
        openssl.license 1.0.2.2105


. . . . . << Copyright notice for openssl.license >> . . . . . . .
 Licensed Materials - Property of IBM

 5765G6281
   Copyright International Business Machines Corp. 2011, 2022.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssl.license >>. . . .

Filesets processed:  2 of 3  (Total time:  1 mins 12 secs).

installp:  APPLYING software for:
        openssl.base 1.0.2.2105


. . . . . << Copyright notice for openssl.base >> . . . . . . .
 Licensed Materials - Property of IBM

 5765G6281
   Copyright International Business Machines Corp. 2011, 2022.
   Copyright Baltimore Technologies Ltd. 2004.
   Copyright KISA (Korea Information Security Agency), 2007.
   Copyright Ben Laurie (ben@links.org), 2008.
   Copyright Richard Levitte <richard@levitte.org), 2004.
   Copyright The OpenSSL Project. 1998-2008
   Copyright The OpenTSA Project. 2002
   Copyright Andy Polyakov <appro@openssl.org>, 2008
   Copyright Sun Microsystems, Inc. 2002.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssl.base >>. . . .

Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Successfully updated the Kernel RBAC log level.
Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Successfully updated the Kernel RBAC log level.
Finished processing all filesets.  (Total time:  1 mins 40 secs).

+-----------------------------------------------------------------------------+
                                Summaries:
+-----------------------------------------------------------------------------+

Installation Summary
--------------------
Name                        Level           Part        Event       Result
-------------------------------------------------------------------------------
openssl.man.en_US           1.0.2.2105      USR         APPLY       SUCCESS
openssl.license             1.0.2.2105      USR         APPLY       SUCCESS
openssl.base                1.0.2.2105      USR         APPLY       SUCCESS
openssl.base                1.0.2.2105      ROOT        APPLY       SUCCESS

(0) root @ host03: 7.2.0.0: /BCU_share/support/openssh_openssl
Verify the update. The example shows that host03 has an updated openssl.base, and that base is committed.
$ dsh -n ${ALL} 'lslpp -la | egrep "openssl.base|openssh.base" | sort | uniq' | dshbak -c
HOSTS -------------------------------------------------------------------------
host03
-------------------------------------------------------------------------------
  openssh.base.client   8.1.102.2105  COMMITTED  Open Secure Shell Commands
  openssh.base.server   8.1.102.2105  COMMITTED  Open Secure Shell Server
  openssl.base            1.0.2.2105  COMMITTED  Open Secure Socket Layer

HOSTS -------------------------------------------------------------------------
host01, host02, host04, host05, host06
-------------------------------------------------------------------------------
  openssh.base.client   8.1.102.2105  COMMITTED  Open Secure Shell Commands
  openssh.base.server   8.1.102.2105  COMMITTED  Open Secure Shell Server
  openssl.base            1.0.2.2104  COMMITTED  Open Secure Socket Layer

(0) root @ host03: 7.2.0.0: /BCU_share/support/openssh_openssl
Check for processes that are using the previous openssl package. The example shows an sshd session (the one we are using to apply the update) is using the previous openssl package.
$ dsh -n ${ALL} 'fuser -d /usr 2>&1 | sed "s|/usr:||" | sed "s|[se]||g" | xargs -n 1 ps | grep -v PID' | sort
host03:  1508356      - A     0:00 /usr/sbin/sshd
host03:  2818934      - A     1:07 sendmail: accepting connections
host03:  2949934      - A     0:00 sshd: root@pts/0
 Using proctree on the sshd 'pid' we can see all of the pids are related to 'pts/0' and that 'pts/0' is our current session. In practice new SSH sessions will use the updated OpenSSL packages.
$ proctree 1508356
1311484    /usr/sbin/srcmstr
   1508356    /usr/sbin/sshd
      2949934    sshd: root@pts/0
         2032488    -ksh
            1835654    proctree 1508356

$ ps
     PID    TTY  TIME CMD
 3604814  pts/0  0:00 ps
 2032488  pts/0  0:00 -ksh
If applying the SSH update continue on with the next step, otherwise skip to updating the AIX RPM packaging.
Backup /etc/.ssh.
tar /etc/.ssh /tmp/ssh_backup_$(hostname)_$(date +%Y%m%d).tar
If directed to update OpenSSH, do the following to run the OpenSSH preview.
$ find /BCU_share/support/openssh_openssl -name openssh.base | sort | tail -1 | xargs dirname | xargs -I{} installp -apYd {} openssh
*******************************************************************************
installp PREVIEW:  installation will not actually occur.
*******************************************************************************

+-----------------------------------------------------------------------------+
                    Pre-installation Verification...
+-----------------------------------------------------------------------------+
Verifying selections...done
Verifying requisites...done
Results...

SUCCESSES
---------
  Filesets listed in this section passed pre-installation verification
  and will be installed.

  Selected Filesets
  -----------------
  openssh.base.client 8.1.102.2106            # Open Secure Shell Commands
  openssh.base.server 8.1.102.2106            # Open Secure Shell Server
  openssh.license 8.1.102.2106                # Open Secure Shell License
  openssh.man.en_US 8.1.102.2106              # Open Secure Shell Documentat...
  openssh.msg.CA_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.CS_CZ 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.DE_DE 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.EN_US 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ES_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.FR_FR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.HU_HU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.IT_IT 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.JA_JP 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.Ja_JP 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.KO_KR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.PL_PL 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.PT_BR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.RU_RU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.SK_SK 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ZH_CN 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ZH_TW 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.Zh_CN 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.Zh_TW 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ca_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.cs_CZ 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.de_DE 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.en_US 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.es_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.fr_FR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.hu_HU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.it_IT 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ja_JP 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ko_KR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.pl_PL 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.pt_BR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ru_RU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.sk_SK 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.zh_CN 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.zh_TW 8.1.102.2106              # Open Secure Shell Messages -...

  << End of Success Section >>

+-----------------------------------------------------------------------------+
                   BUILDDATE Verification ...
+-----------------------------------------------------------------------------+
Verifying build dates...done
FILESET STATISTICS
------------------
   39  Selected to be installed, of which:
       39  Passed pre-installation verification
  ----
   39  Total to be installed

RESOURCES
---------
  Estimated system resource requirements for filesets being installed:
                (All sizes are in 512-byte blocks)
      Filesystem                     Needed Space             Free Space
      /                                     192                5804120
      /usr                                 4049               19218072
      -----                            --------                 ------
      TOTAL:                               4241               25022192

  NOTE:  "Needed Space" values are calculated from data available prior
  to installation.  These are the estimated resources required for the
  entire operation.  Further resource checks will be made during
  installation to verify that these initial estimates are sufficient.
  Use the option to extend filesystems (-X flag) to ensure that any
  additional resources which may be needed are automatically allocated.

******************************************************************************
End of installp PREVIEW.  No apply operation has actually occurred.
******************************************************************************

(0) root @ host01: 7.2.0.0: /BCU_share/support/openssh_openssl
To update OpenSSH do the following:
$ find /BCU_share/support/openssh_openssl -name openssh.base | sort | tail -1 | xargs dirname | xargs -I{} installp -aXYd {} openssh
+-----------------------------------------------------------------------------+
                    Pre-installation Verification...
+-----------------------------------------------------------------------------+
Verifying selections...done
Verifying requisites...done
Results...

SUCCESSES
---------
  Filesets listed in this section passed pre-installation verification
  and will be installed.

  Selected Filesets
  -----------------
  openssh.base.client 8.1.102.2106            # Open Secure Shell Commands
  openssh.base.server 8.1.102.2106            # Open Secure Shell Server
  openssh.license 8.1.102.2106                # Open Secure Shell License
  openssh.man.en_US 8.1.102.2106              # Open Secure Shell Documentat...
  openssh.msg.CA_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.CS_CZ 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.DE_DE 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.EN_US 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ES_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.FR_FR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.HU_HU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.IT_IT 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.JA_JP 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.Ja_JP 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.KO_KR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.PL_PL 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.PT_BR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.RU_RU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.SK_SK 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ZH_CN 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ZH_TW 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.Zh_CN 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.Zh_TW 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ca_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.cs_CZ 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.de_DE 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.en_US 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.es_ES 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.fr_FR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.hu_HU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.it_IT 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ja_JP 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ko_KR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.pl_PL 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.pt_BR 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.ru_RU 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.sk_SK 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.zh_CN 8.1.102.2106              # Open Secure Shell Messages -...
  openssh.msg.zh_TW 8.1.102.2106              # Open Secure Shell Messages -...

  << End of Success Section >>

+-----------------------------------------------------------------------------+
                   BUILDDATE Verification ...
+-----------------------------------------------------------------------------+
Verifying build dates...done
FILESET STATISTICS
------------------
   39  Selected to be installed, of which:
       39  Passed pre-installation verification
  ----
   39  Total to be installed

+-----------------------------------------------------------------------------+
                         Installing Software...
+-----------------------------------------------------------------------------+

installp:  APPLYING software for:
        openssh.license 8.1.102.2106


. . . . . << Copyright notice for openssh.license >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2001, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.license >>. . . .

Filesets processed:  1 of 39  (Total time:  1 secs).

installp:  APPLYING software for:
        openssh.base.client 8.1.102.2106
        openssh.base.server 8.1.102.2106


. . . . . << Copyright notice for openssh.base >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2022.
   Copyright Per Allansson, 2001.
   Copyright Gary S. Brown, 1986.
   Copyright The Regents of the University of California, 1983, 1990, 1992, 1993, 1995.
   Copyright Aaron Campbell. 1999
   Copyright CORE SDI S.A., Buenos Aires, Argentina. 1998
   Copyright Gert Doering, 2001.
   Copyright Jason Downs, 1996.
   Copyright Markus Friedl. 1999, 2000, 2001, 2002
   Copyright Free Software Foundation, Inc., 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002.
   Copyright Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK, 2001
   Copyright Wesley Griffin, 2003.
   Copyright Daniel Kouril, 2002.
   Copyright Ben Lindstrom, 2000, 2001, 2003.
   Copyright Andre Lucas, 2000.
   Copyright David Mazieres <dm@lcs.mit.edu>  1995, 1996
   Copyright Damien Miller. 1999-2003
   Copyright Massachusetts Institute of Technology, 1987 - 2001.
   Copyright Nils Nordman, 2002.
   Copyright The OpenBSD project, 2004.
   Copyright Niels Provos. 1995
   Copyright Theo de Raadt. 1999
   Copyright Tim Rice, 2002.
   Copyright Jakob Schlyter, 2003.
   Copyright Dug Song. 1995
   Copyright Kevin Steves. 1995
   Copyright Peter Stuge <stuge-mdoc2man@cdy.org>, 2003
   Copyright Todd C. Miller, 1998.
   Copyright Darren Tucker 2004.
   Copyright Simon Wilkinson, 2001, 2003.
   Copyright Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland, 1995

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.

 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2022.
   Copyright Per Allansson, 2001.
   Copyright AppGate Network Security AB, 2004-2009.
   Copyright Gary S. Brown, 1986.
   Copyright The Regents of the University of California, 1983, 1990, 1992, 1993, 1995.
   Copyright Aaron Campbell. 1999
   Copyright CORE SDI S.A., Buenos Aires, Argentina. 1998
   Copyright Gert Doering, 2001.
   Copyright Jason Downs, 1996.
   Copyright Markus Friedl. 1999, 2000, 2001, 2002
   Copyright Free Software Foundation, Inc., 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002.
   Copyright Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK, 2001
   Copyright g10 Code GmbH, 2006, 2007.
   Copyright Wesley Griffin, 2003.
   Copyright Andreas Jellinghaus, 2006.
   Copyright Daniel Kouril, 2002.
   Copyright Ben Lindstrom, 2000, 2001, 2003.
   Copyright Andre Lucas, 2000.
   Copyright David Mazieres <dm@lcs.mit.edu>  1995, 1996
   Copyright Damien Miller. 1999-2003
   Copyright Massachusetts Institute of Technology, 1987 - 2001.
   Copyright The NetBSD Foundation, Inc., 1997, 1998.
   Copyright Nils Nordman, 2002.
   Copyright The OpenBSD project, 2004.
   Copyright Niels Provos. 1995
   Copyright Theo de Raadt. 1999
   Copyright Tim Rice, 2002.
   Copyright Jakob Schlyter, 2003.
   Copyright Dug Song. 1995
   Copyright Kevin Steves. 1995
   Copyright Peter Stuge <stuge-mdoc2man@cdy.org>, 2003
   Copyright Todd C. Miller, 1998.
   Copyright Darren Tucker 2004.
   Copyright Simon Wilkinson, 2001, 2003.
   Copyright Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland, 1995

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.base >>. . . .

Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Successfully updated the Kernel RBAC log level.
Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Successfully updated the Kernel RBAC log level.
Generating rsa key...
Generating dsa key...
Generating ecdsa key...
Generating ed25519 key...
Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Successfully updated the Kernel RBAC log level.
Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Successfully updated the Kernel RBAC log level.
0513-071 The sshd Subsystem has been added.
0513-172 The Subsystem has been changed or deleted,Please stop all existing instances before creating newone.
Filesets processed:  3 of 39  (Total time:  19 secs).

installp:  APPLYING software for:
        openssh.msg.zh_TW 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.zh_TW >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.zh_TW >>. . . .

Filesets processed:  4 of 39  (Total time:  20 secs).

installp:  APPLYING software for:
        openssh.msg.zh_CN 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.zh_CN >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.zh_CN >>. . . .

Filesets processed:  5 of 39  (Total time:  21 secs).

installp:  APPLYING software for:
        openssh.msg.sk_SK 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.sk_SK >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.sk_SK >>. . . .

Filesets processed:  6 of 39  (Total time:  22 secs).

installp:  APPLYING software for:
        openssh.msg.ru_RU 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.ru_RU >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.ru_RU >>. . . .

Filesets processed:  7 of 39  (Total time:  23 secs).

installp:  APPLYING software for:
        openssh.msg.pt_BR 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.pt_BR >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.pt_BR >>. . . .

Filesets processed:  8 of 39  (Total time:  25 secs).

installp:  APPLYING software for:
        openssh.msg.pl_PL 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.pl_PL >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.pl_PL >>. . . .

Filesets processed:  9 of 39  (Total time:  26 secs).

installp:  APPLYING software for:
        openssh.msg.ko_KR 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.ko_KR >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.ko_KR >>. . . .

Filesets processed:  10 of 39  (Total time:  27 secs).

installp:  APPLYING software for:
        openssh.msg.ja_JP 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.ja_JP >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.ja_JP >>. . . .

Filesets processed:  11 of 39  (Total time:  28 secs).

installp:  APPLYING software for:
        openssh.msg.it_IT 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.it_IT >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.it_IT >>. . . .

Filesets processed:  12 of 39  (Total time:  29 secs).

installp:  APPLYING software for:
        openssh.msg.hu_HU 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.hu_HU >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.hu_HU >>. . . .

Filesets processed:  13 of 39  (Total time:  30 secs).

installp:  APPLYING software for:
        openssh.msg.fr_FR 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.fr_FR >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.fr_FR >>. . . .

Filesets processed:  14 of 39  (Total time:  32 secs).

installp:  APPLYING software for:
        openssh.msg.es_ES 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.es_ES >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.es_ES >>. . . .

Filesets processed:  15 of 39  (Total time:  33 secs).

installp:  APPLYING software for:
        openssh.msg.en_US 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.en_US >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.en_US >>. . . .

Filesets processed:  16 of 39  (Total time:  34 secs).

installp:  APPLYING software for:
        openssh.msg.de_DE 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.de_DE >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.de_DE >>. . . .

Filesets processed:  17 of 39  (Total time:  35 secs).

installp:  APPLYING software for:
        openssh.msg.cs_CZ 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.cs_CZ >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.cs_CZ >>. . . .

Filesets processed:  18 of 39  (Total time:  36 secs).

installp:  APPLYING software for:
        openssh.msg.ca_ES 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.ca_ES >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.ca_ES >>. . . .

Filesets processed:  19 of 39  (Total time:  37 secs).

installp:  APPLYING software for:
        openssh.msg.Zh_TW 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.Zh_TW >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.Zh_TW >>. . . .

Filesets processed:  20 of 39  (Total time:  38 secs).

installp:  APPLYING software for:
        openssh.msg.Zh_CN 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.Zh_CN >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.Zh_CN >>. . . .

Filesets processed:  21 of 39  (Total time:  40 secs).

installp:  APPLYING software for:
        openssh.msg.ZH_TW 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.ZH_TW >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.ZH_TW >>. . . .

Filesets processed:  22 of 39  (Total time:  41 secs).

installp:  APPLYING software for:
        openssh.msg.ZH_CN 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.ZH_CN >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.ZH_CN >>. . . .

Filesets processed:  23 of 39  (Total time:  42 secs).

installp:  APPLYING software for:
        openssh.msg.SK_SK 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.SK_SK >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.SK_SK >>. . . .

Filesets processed:  24 of 39  (Total time:  43 secs).

installp:  APPLYING software for:
        openssh.msg.RU_RU 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.RU_RU >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.RU_RU >>. . . .

Filesets processed:  25 of 39  (Total time:  44 secs).

installp:  APPLYING software for:
        openssh.msg.PT_BR 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.PT_BR >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.PT_BR >>. . . .

Filesets processed:  26 of 39  (Total time:  45 secs).

installp:  APPLYING software for:
        openssh.msg.PL_PL 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.PL_PL >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.PL_PL >>. . . .

Filesets processed:  27 of 39  (Total time:  46 secs).

installp:  APPLYING software for:
        openssh.msg.KO_KR 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.KO_KR >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.KO_KR >>. . . .

Filesets processed:  28 of 39  (Total time:  48 secs).

installp:  APPLYING software for:
        openssh.msg.Ja_JP 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.Ja_JP >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.Ja_JP >>. . . .

Filesets processed:  29 of 39  (Total time:  49 secs).

installp:  APPLYING software for:
        openssh.msg.JA_JP 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.JA_JP >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.JA_JP >>. . . .

Filesets processed:  30 of 39  (Total time:  50 secs).

installp:  APPLYING software for:
        openssh.msg.IT_IT 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.IT_IT >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.IT_IT >>. . . .

Filesets processed:  31 of 39  (Total time:  51 secs).

installp:  APPLYING software for:
        openssh.msg.HU_HU 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.HU_HU >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.HU_HU >>. . . .

Filesets processed:  32 of 39  (Total time:  52 secs).

installp:  APPLYING software for:
        openssh.msg.FR_FR 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.FR_FR >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.FR_FR >>. . . .

Filesets processed:  33 of 39  (Total time:  53 secs).

installp:  APPLYING software for:
        openssh.msg.ES_ES 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.ES_ES >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.ES_ES >>. . . .

Filesets processed:  34 of 39  (Total time:  54 secs).

installp:  APPLYING software for:
        openssh.msg.EN_US 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.EN_US >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.EN_US >>. . . .

Filesets processed:  35 of 39  (Total time:  55 secs).

installp:  APPLYING software for:
        openssh.msg.DE_DE 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.DE_DE >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.DE_DE >>. . . .

Filesets processed:  36 of 39  (Total time:  57 secs).

installp:  APPLYING software for:
        openssh.msg.CS_CZ 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.CS_CZ >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.CS_CZ >>. . . .

Filesets processed:  37 of 39  (Total time:  58 secs).

installp:  APPLYING software for:
        openssh.msg.CA_ES 8.1.102.2106


. . . . . << Copyright notice for openssh.msg.CA_ES >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2020.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.msg.CA_ES >>. . . .

Filesets processed:  38 of 39  (Total time:  59 secs).

installp:  APPLYING software for:
        openssh.man.en_US 8.1.102.2106


. . . . . << Copyright notice for openssh.man.en_US >> . . . . . . .
 Licensed Materials - Property of IBM

 5765E6111
   Copyright International Business Machines Corp. 2011, 2021.
   Copyright Aaron Campbell. 1999
   Copyright Markus Friedl. 1999, 2000, 2001, 2002
   Copyright David Mazieres <dm@lcs.mit.edu>  1995, 1996
   Copyright Damien Miller. 2001, 2002
   Copyright Theo de Raadt. 1999
   Copyright Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland, 1995

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for openssh.man.en_US >>. . . .

Finished processing all filesets.  (Total time:  1 mins 1 secs).

+-----------------------------------------------------------------------------+
                                Summaries:
+-----------------------------------------------------------------------------+

Installation Summary
--------------------
Name                        Level           Part        Event       Result
-------------------------------------------------------------------------------
openssh.license             8.1.102.2106    USR         APPLY       SUCCESS
openssh.base.client         8.1.102.2106    USR         APPLY       SUCCESS
openssh.base.server         8.1.102.2106    USR         APPLY       SUCCESS
openssh.base.client         8.1.102.2106    ROOT        APPLY       SUCCESS
openssh.base.server         8.1.102.2106    ROOT        APPLY       SUCCESS
openssh.msg.zh_TW           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.zh_CN           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.sk_SK           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.ru_RU           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.pt_BR           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.pl_PL           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.ko_KR           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.ja_JP           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.it_IT           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.hu_HU           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.fr_FR           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.es_ES           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.en_US           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.de_DE           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.cs_CZ           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.ca_ES           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.Zh_TW           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.Zh_CN           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.ZH_TW           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.ZH_CN           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.SK_SK           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.RU_RU           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.PT_BR           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.PL_PL           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.KO_KR           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.Ja_JP           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.JA_JP           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.IT_IT           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.HU_HU           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.FR_FR           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.ES_ES           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.EN_US           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.DE_DE           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.CS_CZ           8.1.102.2106    USR         APPLY       SUCCESS
openssh.msg.CA_ES           8.1.102.2106    USR         APPLY       SUCCESS
openssh.man.en_US           8.1.102.2106    USR         APPLY       SUCCESS

(0) root @ host03: 7.2.0.0: /BCU_share/support/openssh_openssl
$
Validate the installation completed. The output below shows that openssh.base.client and openssh.base.server are updated to 8.1.102.2106.
$ dsh -n ${ALL} 'lslpp -la | egrep "openssl.base|openssh.base" | sort | uniq' | dshbak -c
HOSTS -------------------------------------------------------------------------
host03
-------------------------------------------------------------------------------
  openssh.base.client   8.1.102.2106  COMMITTED  Open Secure Shell Commands
  openssh.base.server   8.1.102.2106  COMMITTED  Open Secure Shell Server
  openssl.base            1.0.2.2105  COMMITTED  Open Secure Socket Layer

HOSTS -------------------------------------------------------------------------
host01, host02, host04, host05, host06
-------------------------------------------------------------------------------
  openssh.base.client   8.1.102.2105  COMMITTED  Open Secure Shell Commands
  openssh.base.server   8.1.102.2105  COMMITTED  Open Secure Shell Server
  openssl.base            1.0.2.2104  COMMITTED  Open Secure Socket Layer
Check for ssh sessions using previous versions. The example below shows two old ssh sessions using the previous ssh package. Experience shows that newer ssh sessions will use the updated ssh packages.
$ dsh -n ${ALL} 'fuser -d /usr 2>&1 | sed "s|/usr:||" | sed "s|[se]||g" | xargs -n 1 ps | grep -v PID' | sort
host03:  1508356      - A     0:00 /usr/sbin/sshd
host03:  1967074      - A     0:00 sshd: root@pts/1
host03:  2818934      - A     1:07 sendmail: accepting connections
host03:  2949934      - A     0:00 sshd: root@pts/0
Testing.
After updating OpenSSL and/or OpenSSH it is important to test connectivity to and from the test environment across several scenarios. This is due to the changes in the default settings for these components that could impact that connectivity. Be sure to test ssh, scp and dsh type sessions as each can be impacted.
If this is the first update then test ssh connections to each of the components from the test host. Note that only the management host has key based authentication configured from the root user to each of the components, so testing from the management standby will requiring knowing the password for each of the components. This test will verify that there are no new issues introduced with the update. Add the following to the /.ssh/config file on the standby host to ensure the tests will work against the network switches. This change should already have been added to the management host per the V1.1 FP4 readme file. If there are connection issues contact IBM Support to attempt to resolve before applying this update to another host. The ip address list should match all of the network switch ip addresses.
$ cat /.ssh/config
Match host "172.23.1.251,172.23.1.252,172.23.1.253,172.23.1.254"
        HostKeyAlgorithms +ssh-dss
        PubkeyAcceptedKeyTypes +ssh-dss
        PubkeyAuthentication no
For each component type (hmc, storage, san switch, and network switch) pick one ip address and test the connections from the management standby host.
Test using 'hscroot.

$ ssh ${BCUMGMT} '. ~/.profile;appl_ls_hw -r hmc -A M_IP_address'
"172.23.1.245"
"172.23.1.246"

Test using 'superuser'.

$ ssh ${BCUMGMT} '. ~/.profile;appl_ls_hw -r storage -A M_IP_address'
"172.23.1.181"
"172.23.1.182"
"172.23.1.183"
"172.23.1.184"

Test using 'admin'.
$ ssh ${BCUMGMT} '. ~/.profile;appl_ls_hw -r san -A M_IP_address'
"172.23.1.161"
"172.23.1.162"
"172.23.1.163"
"172.23.1.164"

Test using 'admin'.
$ ssh ${BCUMGMT} '. ~/.profile;appl_ls_hw -r net -A M_IP_address'
"172.23.1.254"
"172.23.1.253"
"172.23.1.252"
"172.23.1.251"
For each client, verify the connectivity into the test server. This would include other AIX hosts within the environment, such as the management host and the HMC as well as testing external connections to the test environment. This is
Since many Open Source packages rely on OpenSSL, it is recommended to run the following command, which will update your virtual AIX-rpm package so the rpm installer will be aware of the new or updated libraries. (Required for OpenSSL versions lower than 1.0.2.2101)
/usr/sbin/updtvpkg
Repeat this process on each of the LPARs until the update is applied to all LPARs.
After allowing the changes to burn in, re-mirror rootvg on all systems that were updated and resume planning for updates on remaining LPARs or environments.
  • Important: After re-mirroring rootvg, verify the Paging Space and System Dump Logical Volumes match expectations. Refer to "Stage 8: Phase 10" of the PDOA V1.1 FP4 Readme for more information on how to verify these logical volumes. The goal is to have two online paging spaces that are mirrored of the same size, and two online system dump devices of appropriate size, one on each hdisk in the mirror.
You may wish to clean up the /BCU_share/support/openssh_openssl directory by removing the downloaded packages and the unpacked directories once all updates are complete.

Additional Information

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB10","label":"Data and AI"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSH2TE","label":"PureData System for Operational Analytics A1801"},"ARM Category":[{"code":"a8m0z0000001ijSAAQ","label":"PureData System for Operational Analytics"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"1.1.0"}]

Product Synonym

PDOA

Document Information

Modified date:
24 March 2023

UID

ibm16956574

Page Feedback