IBM Support

IBM Security Guardium Key Lifecycle Manager Version 4.1.0 - Fix Pack 5 README

Fix Readme


Abstract

Readme file for IBM Security Guardium Key Lifecycle Manager for distributed and containerized platforms, Version 4.1.0 Fix Pack 5 (4.1.0.5) including installation instructions, prerequisites and corequisites, and a list of fixes.

Content

Features and fixes
Features
None
Internal fixes
  • Security fixes: The following CVEs have been fixed - CVE-2023-25685, CVE-2023-25921, CVE-2023-25922, CVE-2023-25925 and CVE-2023-25926
  • Internal defect fixes
APAR fixes 
APAR No. Sev. Description
IJ37936 3 MAXIMUM.KEYCERT.EXPIRATION.PERIOD.IN.YEARS CAN CAUSE ITEMS NOT TO DISPLAY
IJ41021 2 REGULAR EXPRESSION WHERE IT IS NOT ABLE TO DIFFERENTIATE _ AND . . ALLOWING DUPLICATE RECORDS  
Download instructions
  1. Go to IBM Fix Central home page: http://www.ibm.com/support/fixcentral/
  2. In the Product selector field, type IBM Security Key Lifecycle Manager, and select the product name when it appears.
  3. From the Installed Version list, select the installed IBM Security Guardium Key Lifecycle Manager version.
  4. From the Platform list, select the appropriate platform, and click Continue.
  5. On the Identify Fixes page, ensure that the Browse for Fixes is selected, and click Continue.
  6. On the Select Fixes page, select fix pack 4.1.0-ISS-GKLM-FP0005, and click Continue.
    You might be prompted to Sign In.  If you do not have an ID, click the Register now link and follow the registration steps.
  7. On the Download options page, select a download method (default is Download using Download Director).
  8. Select the associated files and README for fix pack: 4.1.0-ISS-GKLM-FP0005 and click Download now.

Back to top

Fix pack files checksum

Fix pack files checksum for IBM Security Guardium Key Lifecycle Manager traditional

Product/Component name

Platform

File name

Command

Checksum

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

AIX

4.1.0-ISS-GKLM-FP0005-AIX.tar.gz

 md5sum FileName.tar.gz

For example (UNIX/Linux): md5sum 4.1.0-ISS-GKLM-FP0005-AIX.tar.gz

Sample output
d88779ad3ed7ac3aeaa54ae326542572 4.1.0-ISS-GKLM-FP0005-AIX.tar.gz

297dc315d14d5b8ae860c99318e3f24f

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

Linux

4.1.0-ISS-GKLM-FP0005-Linux.tar.gz

d88779ad3ed7ac3aeaa54ae326542572

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

zLinux (IBM Z)

4.1.0-ISS-GKLM-FP0005-zLinux.tar.gz

6a58644c385a11974f93c4aeb91d5898

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

Linux PPC

4.1.0-ISS-GKLM-FP0005-LinuxPPC.tar.gz

634927242636c1324e4e8f85d4733099

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

Windows

4.1.0-ISS-GKLM-FP0005-Windows.zip

 certutil -hashfile FileName.zip md5

For example (Windows): certutil -hashfile 4.1.0-ISS-GKLM-FP0005-Windows.zip md5

Sample output
MD5 hash of file 4.1.0-ISS-GKLM-FP0005-Windows.zip: b67dce592e8352ca032e3e9d89014704
CertUtil: -hashfile command completed successfully.

b67dce592e8352ca032e3e9d89014704
 
Fix pack files checksum for IBM Security Guardium Key Lifecycle Manager container

Product/Component name

Platform

File name

Command

Checksum

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

Linux PPC

sklm4105-ppc64le.tar

 md5sum FileName.tar.gz

For example (UNIX/Linux): md5sum sklm4105-ppc64le.tar

Sample output
75a4b41b9694b7789c408557655dee16 sklm4105-ppc64le.tar

b21512ded1ea7b46bfedc116b4d0c193

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

zLinux (IBM Z)

sklm4105-s390x.tar

2f1c36d4ac9ddb50b6bd9fb14ffab296

IBM Security Guardium Key Lifecycle Manager version v4.1.0.5

x86_64

sklm4105-x86_64.tar

998806261b9ff07723a1111b75dd3341

Back to top

Known limitations and issues

Known limitations

  • Rollback of installed fix pack is not supported.

Known issues

  • Only applicable for Linux for System z platform (few versions): After you apply the fix pack, the graphical user interface of Guardium Key Lifecycle Manager does not start.
    Workaround:
    1. Stop WebSphere Application Server.
    2. Stop Db2.
    3. Start Db2.
    4. Start WebSphere Application Server.
    The graphical user interface will be accessible.
  • On z/Linux, when you uninstall IBM Security Guardium Key Lifecycle Manager traditional in the GUI mode, the uninstallation might fail.
    Workaround:
    1. In the IBMIM.ini file, add the following (before --launcher.appendVMargs):
      --launcher.GTK_version
      2
    Default location of the IBMIM.ini file:
    On Linux: /opt/IBM/InstallationManager/eclipse/
    On Windows: C:\Program Files\IBM\InstallationManager\eclipse\
  • IBM Security Guardium Key Lifecycle Manager GUI might not render properly on Microsoft Internet Explorer.
    Workaround: Use Microsoft Edge, Firefox or Google Chrome
  • Uninstall of IBM Security Guardium Key Lifecycle Manager traditional might fail in UI mode on system with WebSphere Application Server IFIX installed (for example, PH42762, PH42728 etc).
    Workaround:
    1. First, uninstall WebSphere Application Server IFIX using Installation Manager.
    2. Uninstall IBM Security Guardium Key Lifecycle Manager now.

Back to top

Installation instructions
Prerequisites
  • Ensure that IBM Security Guardium Key Lifecycle Manager is not in use.
  • Back up the IBM Security Guardium Key Lifecycle Manager server. For instructions, see Configuring backup and restore.
  • (Only on IBM Security Guardium Key Lifecycle Manager traditional) Ensure the following prerequisites:
    • Ensure that IBM Security Guardium Key Lifecycle Manager, Version 4.1.0 (GA version) or 4.1.0 FP1 or 4.1.0 FP2 or 4.1.0 FP3 or 4.1.0 FP4 is already installed.
    • Ensure that /tmp directory does not contain klmPrev.properties. If present, rename or remove this file before you start applying fix pack.
      Also, ensure that the /tmp directory has all the permissions and does not have noexec set.
    • On Linux for System z server, ensure that gtk 2 libraries are installed. Also, add following parameter in IM_INSTALL_DIR/eclipse/IBMIM.ini file. Add the following properties just before "--launcher.appendVmargs" in IBMIM.ini file.
      --launcher.GTK_version
      2
    • Ensure that umask is set to 0022.
    • Back up the WebSphere Application Server files. For instructions, see the following table:
      1. Open a command line.
      2. Stop WebSphere Application Server.
        • Windows 
          WAS_HOME\bin\stopServer.bat server1 -username WAS_ADMIN -password WAS_PASSWORD
        • Linux 
          WAS_HOME/bin/stopServer.sh server1 -username WAS_ADMIN -password WAS_PASSWORD
      3. Make a temporary directory.
        • Windows 
          mkdir WAS_BACKUP_DIRECTORY
          For example: mkdir C:\wasbackup
        • Linux 
          mkdir WAS_BACKUP_DIRECTORY
          For example: mkdir /tmp/wasbackup
      4. Change directory to the temporary directory.
        • Windows 
          cd C:\wasbackup
        • Linux 
          cd /tmp/wasbackup
      5. Copy or archive the files from the directory where WebSphere Application Server is installed.
        • Windows 
          xcopy /y /e /d WAS_HOME C:\wasbackup
        • Linux 
          tar -cvf wasbackup.tar WAS_HOME/*
      6. Start WebSphere Application Server.
        • Windows 
          WAS_HOME\bin\startServer.bat server1
        • Linux 
          WAS_HOME/bin/startServer.sh server1
Installation steps
Depending on your setup, see the relevant section:

Installing the fix pack on GKLM traditional

You can use one of the following modes to install a fix pack:

Graphical mode

Complete the following instructions:
  1. Download the fix pack installer files. For instructions, see Download instructions.
  2. Extract the installer files to a folder of your choice.
  3. Open a command line.
  4. Change the directory to the directory where you extracted the fix pack installer files.
  5. Run the following command to launch the Installation Manager:

    • Windows

      updateSKLM.bat IM_INSTALL_LOCATION WAS_HOME WAS_ADMIN WAS_PASSWORD
      For example:
      updateSKLM.bat "C:\Program Files\IBM\Installation Manager" "C:\Program Files\IBM\WebSphere\AppServer" wasadmin wasadminpwd

    • Linux

      chmod +x ./updateSKLM.sh

./updateSKLM.sh IM_INSTALL_LOCATION WAS_HOME WAS_ADMIN WAS_PASSWORD
      For example:
      ./updateSKLM.sh /opt/IBM/InstallationManager /opt/IBM/WebSphere/AppServer wasadmin wasadminpwd

  6. Select the base offering software package group (IBM Security Guardium Key Lifecycle Manager, Version 4.1.0). Click Next.

  7. In the Update Packages pane, select Version 4.1.0.4, and click Next.

  8. Installation Manager fetches the assets and lists all the fixes and features to be installed. Click Next.
  9. In the Update Packages Configuration for IBM Security Guardium Key Lifecycle Manager v4.1.0.5 pane:
    • Enter Username and Password for Application Server Administrator.
    • Enter Username and Password for IBM Security Guardium Key Lifecycle Manager Application Administrator.
    • Enter Username and Password for IBM Db2 user.
  10. Click Validate Credentials. Validation might take few minutes. Wait until the Next button is enabled. Click Next.
  11. In the Update Packages > Summary pane, review the software packages that you want to install, and click Update. After Installation Manager successfully updates the fix pack for the services that you select, a message is displayed.

Silent mode

Complete the following instructions:
  1. Download the fix pack installer files. For instructions, see Download instructions.
  2. Go to the directory where you extracted the fix pack installation files.
  3. Open the /sklm directory, which is within the directory where the fix pack is extracted. It contains the response file (SKLM_Silent_Update_platform_Resp.xml) that we need to edit for the installation.
  4. Locate the response file. Create a backup of the response file: 
    For example: SKLM_Silent_Update_platform_Resp_original.xml. 
  5. Open the response file for editing. Edit the relevant elements of the response file SKLM_Silent_Update_platform_Resp.xml.
  6. Edit the repository location to point to the current location of the installer.
    • Windows 
      <repository location='C:\sklminstall_windowsfp\wasfp\repository.config'/>
<repository location='C:\sklminstall_windowsfp\sklmwasfp\repository.config'/>
    • Linux 
      <repository location='/sklminstall_linuxfp/wasfp/repository.config'/>
<repository location='/sklminstall_linuxfp/sklm/repository.config'/>
  7. Edit WASAdmin username and password. The password must be encrypted. To encrypt the password, see Encrypting a password.
    • Windows 
      <data key='user.WAS_ADMIN_ID,com.ibm.sklm41.win' value='wasadmin'/>
<data key='user.WAS_ADMIN_PASSWORD,com.ibm.sklm41.win' value='e9PjN93MeQxwnSs9VXJFMw=='/>
    • Linux 
      <data key='user.WAS_ADMIN_ID,com.ibm.sklm41.linux' value='wasadmin'/>
<data key='user.WAS_ADMIN_PASSWORD,com.ibm.sklm.Linux' value='e9PjN93MeQxwnSs9VXJFMw=='/>
  8. Edit SKLMAdmin username and password. The password must be encrypted. To encrypt the password, see Encrypting a password.
    • Windows 
      <data key='user.SKLM_ADMIN_ID,com.ibm.sklm41.win' value='SKLMAdmin'/>
<data key='user.SKLM_ADMIN_PASSWORD,com.ibm.sklm41.win' value='9YTRJMRIydDSdfhaHPs1ag=='/>
    • Linux 
      <data key='user.SKLM_ADMIN_ID,com.ibm.sklm41.linux' value='SKLMAdmin'/>
<data key='user.SKLM_ADMIN_PASSWORD,com.ibm.sklm41.linux' value='9YTRJMRIydDSdfhaHPs1ag=='/>
  9. Edit Db2 username and password. The password must be encrypted. To encrypt the password, see Encrypting a password.
    • Windows
      <data key='user.DB2_ADMIN_PWD,com.ibm.sklm41.db2.win.ofng' value='sklmdb41'/>
<data key='user.CONFIRM_PASSWORD,com.ibm.sklm41.db2.win.ofng' value='QTh/0AiFvrljhs9gnOYkGA=='/>
    • Linux 
      <data key='user.DB2_ADMIN_ID,com.ibm.sklm41.db2.lin.ofng' value='sklmdb41'/> 
<data key='user.DB2_ADMIN_PWD,com.ibm.sklm41.db2.lin.ofng' value='QTh/0AiFvrljhs9gnOYkGA=='/>
  10. Open a command line, and change directory to the directory where the installer files are extracted.
  11. Run the following command:
    • Windows 
      silent_updateSKLM.bat IM_INSTALL_LOCATION WAS_HOME WAS_ADMIN WAS_PASSWORD
      For example:
      silent_updateSKLM.bat "C:\Program Files\IBM\Installation Manager" "C:\Program Files \IBM\WebSphere\AppServer" wasadmin wasadminpwd
    • Linux 
      chmod +x ./silent_updateSKLM.sh
./silent_updateSKLM.sh IM_INSTALL_LOCATION WAS_HOME WAS_ADMIN WAS_PASSWORD
      For example: 
      chmod +x ./silent_updateSKLM.sh
./silent_updateSKLM.sh /opt/IBM/InstallationManager /opt/IBM/WebSphere/AppServer wasadmin wasadminpwd
Encrypting a password
Generate an encrypted password. To do so, follow these steps:
  1. Open a command line.
  2. Change directory to the IM_INSTALL_DIR/eclipse/tools directory.
  3. Run the following command: imcl.exe encryptString password_to_encrypt
  4. An encrypted password is generated.

Installing the fix pack on a Multi-Master setup


Prerequisites 

If the original primary master server is acting as a standby master server, promote it to primary and then, install the fix pack. Otherwise, the database updates are not applied to the cluster.

To promote a master server to primary, see Promote to primary. 

To install the fix pack
  1. Stop WebSphere Application Server on all the master servers, in any sequence.
    1. Open a command line.
    2. Go to the WAS_HOME\bin directory.
      Windows
      C:\Program Files\IBM\WebSphere\AppServer\bin
      Linux
      /opt/IBM/WebSphere/AppServer/bin
    3. Stop the IBM Security Guardium Key Lifecycle Manager server.
      Windows
      stopServer.bat server1 -username wasadmin -password mypwd
      Linux
      ./stopServer.sh server1 -username wasadmin -password mypwd
  2. Stop Agent on all the master servers, in any sequence.
    1. Open a command line.
    2. Go to the GKLM_INSTALL_HOME\agent directory.
      Windows
      C:\Program Files\IBM\SKLMV41\agent
      Linux
      /opt/IBM/SKLMV41/agent
    3. Stop the Agent.
      Windows
      stopAgent.bat WAS_HOME
      For example: stopAgent.bat "C:\Program Files\IBM\WebSphere\AppServer"
      Linux
      ./stopAgent.sh WAS_HOME
      For example: ./stopAgent.sh /opt/IBM/WebSphere/AppServer
  3. Apply fix pack on each master server and verify the installation.
    Complete this step in the following sequence:
    • Primary master server
    • Principal standby master server
    • Auxiliary standby master servers
    • Non-HADR master servers

      For steps to install the fix pack, see Installing the fix pack.
  4. To verify the installation:
    • Log in to IBM Security Guardium Key Lifecycle Manager and check the version number.
    • Ensure that the master server is running and available for use.
Installing the fix pack on GKLM container

Depending on your platform, see the relevant section:

Installing on a Kubernetes cluster

Installing on a Red Hat OpenShift Container Platform cluster

See Install on a Red Hat OpenShift Container Platform cluster.

Back to top

Post fix-pack installation activities

  1.  Run the following scripts.
    • On Windows:
      1. Log in as the administrator user and open the Db2 command prompt.
      2. Run the following commands: 
        cd C:\Program Files\IBM\DB2SKLMV41\BIN
db2 connect to sklmdb41 user <Db2_USER> using <Db2_PASSWORD>
db2 “update KMT_KEY_GROUPS set REF_IDENTIFIER = ‘15’ where NAME = ‘DS8000_TCT’ ”
db2 -td# -vf  C:\sklm41properties\scripts\gklmsql-fp.db2
    • On Linux:
      1. Log in as the Db2 user and open a terminal.
      2. Run the following commands: 
        su - sklmdb41
db2 connect to sklmdb41 user <Db2_user> using <Db2_password>
db2 “update KMT_KEY_GROUPS set REF_IDENTIFIER = ‘15’ where NAME = ‘DS8000_TCT’ ”
/opt/IBM/DB2SKLMV41/bin/db2 -td# -vf /home/sklmdb41/sklm41properties/scripts/gklmsql-fp.db2
  2. For IPP communication over SSL, set the TransportListener.ssl.clientauthentication property to 2. To update the property, you can use the Update Config Property REST Service. For example, you can send the following HTTP request: 
    PUT https://localhost:<port>/SKLM/rest/v1/configProperties { "TransportListener.ssl.clientauthentication" : "2"}
  3. Use one of the following methods to verify the installation.
    • Using graphical user interface:
      a. Log in to the graphical user interface.
      b. On the Welcome page header bar, click the Help (?) icon.
      c. Click About.
      The page displays the version details.
    • Using REST interface:
      Run the Version Info REST Service. For more information, see Swagger UI. 
      For IBM Security Guardium Key Lifecycle Manager Traditional:
      IBM Security Guardium Key Lifecycle Manager Version: 4.1.0.5
IBM Security Guardium Key Lifecycle Manager Build Level: 202304071902
Embedded WAS Version: 9.0.5.5
Database Version: DB2/AIX64 SQL110540
Java Version: JRE 1.8.0_261 IBM J9 VM 2.9
Operating System Version: AIX:7.2:ppc64
Agent Version: 2.0
      For IBM Security Guardium Key Lifecycle Manager Container:
      IBM Security Guardium Key Lifecycle Manager Version: 4.1.0.5
IBM Security Guardium Key Lifecycle Manager Build Level: 202304101559
Liberty WAS Version: 21.0.0.2
Database Version: PostgreSQL 15.2 (Debian 15.2-1.pgdg110+1)
Java Version: JRE 1.8.0_281 IBM J9 VM 2.9
Operating System Version: Linux:3.10.0-1160.88.1.el7.x86_64:amd64
Image Tag: 4.1.0.5
  4. Back up the IBM Security Guardium Key Lifecycle Manager server. For more information, see Configuring backup and restore.
  5. Only applicable on Windows: Complete the following steps to fix the intermittent database crash issue.
    1. Go to the C:\Windows\System32\drivers\etc\ directory and open services file in edit mode.
    2. Remove duplicate entry for the Db2 service:
          DB2_db2_instance_name db2_port/tcp
          For example: DB2_sklmdb41 60000/tcp
    3. Save the services file and close it.

Back to top

Uninstalling the fix pack

Important: The following steps uninstall the entire product package, including IBM Security Guardium Key Lifecycle Manager, IBM Db2, and WebSphere Application Server, and all your data is lost. Take a backup before uninstalling.

Uninstalling IBM Security Guardium Key Lifecycle Manager with the fix pack by using the graphical user interface

 

Uninstalling IBM Security Guardium Key Lifecycle Manager with the fix pack silently

 

Back to top

Copyright and trademark information

http://www.ibm.com/legal/copytrade.shtml

Notices

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both.

Other company, product, or service names may be trademarks or service marks of others.

THIRD-PARTY LICENSE TERMS AND CONDITIONS, NOTICES AND INFORMATION

The license agreement for this product refers you to this file for details concerning terms and conditions applicable to third party software code included in this product, and for certain notices and other information IBM must provide to you under its license to certain software code. The relevant terms and conditions, notices and other information are provided or referenced below. Please note that any non-English version of the licenses below is unofficial and is provided to you for your convenience only. The English version of the licenses below, provided as part of the English version of this file, is the official version.

Notwithstanding the terms and conditions of any other agreement you may have with IBM or any of its related or affiliated entities (collectively "IBM"), the third party software code identified below are "Excluded Components" and are subject to the following terms and conditions:

  • the Excluded Components are provided on an "AS IS" basis.

  • IBM DISCLAIMS ANY AND ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS WITH RESPECT TO THE EXCLUDED COMPONENTS, INCLUDING, BUT NOT LIMITED TO, THE WARRANTY OF NON-INFRINGEMENT OR INTERFERENCE AND THE IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

  • IBM will not be liable to you or indemnify you for any claims related to the Excluded Components.

  • IBM will not be liable for any direct, indirect, incidental, special, exemplary, punitive or consequential damages with respect to the Excluded Components.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTJE47","label":"IBM Security Guardium Key Lifecycle Manager"},"ARM Category":[{"code":"a8m0z000000cvdzAAA","label":"SKLM-\u003EINSTALL-\u003EFIXPACK"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
13 April 2023

UID

ibm16981787

Page Feedback