Fix Readme
Abstract
Readme file for IBM Guardium Key Lifecycle Manager(GKLM) for distributed and containerized platforms, Version 5.0.0 Fix Pack 1 (5.0.0.1) including installation instructions, prerequisites and corequisites, and a list of fixes.
Content
Important Update: Customers using FlashSystem and DS8000 must apply GKLM 5.0.0.1-IFIX01 (5.0.0.1-ISS-GKLM-IF0001) after GKLM 5.0 FP01 (GKLM 5.0.0.1) is installed. GKLM 5.0 FP01 (GKLM 5.0.0.1) has a regression issue which breaks the communication for FlashSystem and DS8000. The issue has been fixed in 5.0.0.1-ISS-GKLM-IF0001.
NOTE: Only GKLM 5.0 FP01 (GKLM 5.0.0.1) is impacted. GKLM 5.0 is not impacted.
For more details, see: Important update for IBM Guardium Key Lifecycle Manager 5.0. FP01 (GKLM 5.0.0.1) to prevent system outage
- Features and fixes
- Download instructions
- Fix pack files checksum
- Known limitations and issues
- Installation instructions
- Post fix-pack installation activities
- Uninstall
This release includes following features:
- New REST to get served data list for all device groups with used frequency.
- Added support for extended list of special characters in passwords (e.g user password, backup password, export-import password etc) except database password. Now all printable special characters on English keyboard except space are allowed to be used.
This release includes the fixes for the following issues:
- UI related issues - Unable to view summary in History Tab for deleted Endpoint.
- Replication - Objects are not getting created on clone even after removing the restriction.
- Device communication option is set to automatically accept all new devices for DS5k device group.
- Inclusion of username should not be allowed in the password creation.
- Truststore certs doesn't gets migrated if any truststore certs are expired.
- PUT configProperties REST not accepting values like 140-2, 140-3 for parameter fips.
- Indian standard time hardcoded across application in dates.
- Searching LDAP users also lists file based users while adding users in GKLM.
- Audit Log: Medium audit Level missing in new ui.
- Not able to create symmetric keys and key pair and edit client name in japanese, korean,chinese language.
- Liberty truststore get rest is not working.
- Replication is showing successful on UI but latest data is not getting replicated on clone.
For more information, see Known issues in IBM Guardium Key Lifecycle Manager, Version 5.0.0.
APAR fixes included in Version 5.0.0.1
|
APAR No. |
Sev. |
Abstract |
|
3 |
GKLM Server hangs when incremental replication is set to 60 seconds. |
|
|
3 |
Time from REST API is incorrect. [APAR is originally opened for GKLM 4.2.1] |
|
|
2 |
Error with incremental replication when there are pending certs.[APAR is originally opened for GKLM 4.2.1] |
|
|
3 |
Socket connection over Port 1111 triggers replication audit entry. [APAR is originally opened for GKLM 4.2.1] |
|
|
3 |
TS7700 Connection issue, works with clone but not master.[APAR is originally opened for GKLM 4.2] |
|
|
3 |
Production GKLM response time degraded and service unavailable.[APAR is originally opened for GKLM 4.1.1] |
- WebSphere Application Server Liberty 25.0.0.3
- IBM SDK Java Technology Edition 8.0.8.40
- Go to IBM Fix Central home page: http://www.ibm.com/support/fixcentral/
- In the Product selector field, type IBM Security Key Lifecycle Manager, and select the product name when it appears.
- From the Installed Version list, select IBM Guardium Key Lifecycle Manager 5.0.0 version.
- From the Platform list, select the appropriate platform, and click Continue.
- On the Identify Fixes page, ensure that the Browse for Fixes is selected, and click Continue.
- On the Select Fixes page, select fix pack 5.0.0-ISS-GKLM-FP0001, and click Continue.
You might be prompted to Sign In. If you do not have an ID, click the Register now link and follow the registration steps. - On the Download options page, select a download method (default is Download using Download Director).
- Select the associated files and README for fix pack: 5.0.0-ISS-GKLM-FP0001 and click Download now.
Fix pack files checksum
|
Product/Component name |
Platform |
File name |
Command |
Checksum |
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
AIX |
5.0.0-ISS-GKLM-FP0001-AIX.tar.gz |
md5sum FileName.tar.gz
For example (UNIX/Linux): md5sum 5.0.0-ISS-GKLM-FP0001-AIX.tar.gz |
6871594eb49841026015c7e641f04f7d |
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
Linux |
5.0.0-ISS-GKLM-FP0001-Linux.tar.gz |
cf9293a2e7a73f6d5511b84386a9db3d |
|
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
zLinux (IBM Z) |
5.0.0-ISS-GKLM-FP0001-zLinux.tar.gz |
7887b8a72abb6b7d2e15696afbfd9f05 |
|
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
Linux PPC |
5.0.0-ISS-GKLM-FP0001-LinuxPPC.tar.gz |
699cf264ae908c16e1ab18483fee52a6 |
|
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
Windows |
5.0.0-ISS-GKLM-FP0001-Windows.zip |
certutil -hashfile FileName.zip md5
For example (Windows): certutil -hashfile 5.0.0-ISS-GKLM-FP0001-Windows.zip md5 |
13b2599f853e7e84510938facdf8b1d3 |
|
Product/Component name |
Platform |
File name |
Command |
Checksum |
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
Linux PPC |
gklm5001-ppc64le.tar |
md5sum FileName.tar.gz
For example (UNIX/Linux): md5sum gklm5001-ppc64le.tar |
336347d962c6f963d7cacbb0f1ffc6de |
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
zLinux (IBM Z) |
gklm5001-s390x.tar |
be037f148b8c1ad87fd6f02ae076d1b3 |
|
|
IBM Guardium Key Lifecycle Manager 5.0.0.1 |
x86_64 |
gklm5001-x86_64.tar |
50304338c4d9b76ea02d3dbd39a9adc3 |
Known limitations
- Rollback of installed fix pack is not supported.
- DS8000 will not work with FIPS on. To use DS8000 with GKLM, FIPS has to be turned off.
- Symmetric key export will not work with FIPS on. To export symmetric key on GKLM, FIPS has to be turned off.
Known issues
- (Applicable for Windows) GKLM fixpack upgrade crashes on Windows if done in GUI mode (It works fine if done silently). In order to perform upgrade in GUI mode, perform workaround steps mentioned below.
Workaround:
- Upgrade Installation Manager to IM 1.10.1.1 on GKLMv5.0(before applying fixpack). It is bundled in fixpack 5.0.0-ISS-GKLM-FP0001-Windows.zip under im directory.
unzip im_1.10.1.1.zip and then double click on install.exe to begin with IM upgrade.
- Create a directory with name db under C: (e.g C:\db) and copy db2jcc4.jar and com.ibm.tklm.obfuscation.jar from WAS_HOME\usr\shared\resources\lib (e.g C:\Program Files\IBM\WebSphere\Liberty\usr\shared\resources\lib).
- Open IBMIM.ini located at C:\Program Files\IBM\Installation Manager\eclipse\IBMIM.ini and add following lines at end of the file :
--module-pathC:\db--add-modulesdb2jcc4,com.ibm.tklm.obfuscationAlso, in same file, replace this line IM_HOME\eclipse\jre_xxxx\jre\bin\j9vm\jvm.dll
with
IM_HOME\eclipse\jre_xxxx\jre\bin\java.exe
e.g
Replace this line "C:\Program Files\IBM\Installation Manager\eclipse\jre_8.0.8030.20240821_1049\jre\bin\j9vm\jvm.dll"
with
"C:\Program Files\IBM\Installation Manager\eclipse\jre_8.0.8030.20240821_1049\jre\bin\java.exe" - Similarly, open imcl.ini located at C:\Program Files\IBM\Installation Manager\eclipse\tools\imcl.ini and add following lines at end of the file :
--module-pathC:\db--add-modulesdb2jcc4,com.ibm.tklm.obfuscation
- Now, retry fixpack upgrade in GUI mode. It should be successful this time.
- Upgrade Installation Manager to IM 1.10.1.1 on GKLMv5.0(before applying fixpack). It is bundled in fixpack 5.0.0-ISS-GKLM-FP0001-Windows.zip under im directory.
- (Applicable for Ubuntu) Db2 crashes on ubuntu when fp is applied.
Workaround:
- Manually start db2 for FP installation.
- GKLM v5001 upgrade on v5.0 fails with "DB2 user / password invalid" error, if setup is inline migrated.
Workaround:
- Clean /tmp and retry upgrade operation. It will succeed.
- (Applicable for AIX) Silent fixpack upgrade fails on AIX with error "CRIMC1066E: Unable to acquire lock on file /var/ibm/InstallationManager/.imlock".
Workaround:Run following commands:
- touch /var/ibm/InstallationManager/.imlock
- chmod 777 /var/ibm/InstallationManager/.imlock
- Now, retry fixpack upgrade in silent mode on AIX.
- (Applicable for Linux) Non root fixpack upgrade in GUI mode on Linux prompts for non root user password multiple time (5-6 times).
Workaround:
- Enter password when prompted to reload respective services.
- (Applicable for Ubuntu) The installation of GKLM might fail with a invalid Db2 password error in both GUI and silent fix pack installation modes.
Workaround:
- Log in as the root user and open a terminal window.
- Run the following command:
ln -s {db2_inst_home}/gklm50properties/ $HOME/gklm50propertiesFor example,ln -s /home/klmdb50/gklm50properties/ /root/gklm50properties
- End point communication fails with GKLM v5.0.0.1, caused by change in the QueryServerInformation KMIP response. Containerized version of GKLM is not impacted.
Workaround:
- Upgrade GKLM v5.0.0.1 to GKLM v5.0.0.1 (IF01). GKLM v5.0.0.1 (IF01) is available on IBM Fix Central.
- Ensure that IBM Guardium Key Lifecycle Manager, Version 5.0.0 GA (5.0.0) is already installed.
- Ensure that IBM Guardium Key Lifecycle Manager is not in use (i.e Storage devices should not be communicating with GKLM).
- Back up the IBM Guardium Key Lifecycle Manager server. For instructions, see Configuring backup and restore.
- Ensure that /tmp directory does not contain klmPrev.properties. If it is present, rename or remove this file before you start applying the fix pack. Also, ensure that the /tmp directory has all the permissions and does not have noexec set.
- Ensure that umask is set to 0022.
- Back up the WebSphere Liberty files.
- Open a command line.
- Stop WebSphere Liberty.
- Windows
WAS_HOME\bin\stopServer.bat - Linux
WAS_HOME/bin/stopServer.sh
- Windows
- Make a temporary directory.
- Windows
mkdir WAS_BACKUP_DIRECTORYFor example: mkdir C:\wasbackup - Linux
mkdir WAS_BACKUP_DIRECTORYFor example: mkdir /tmp/wasbackup
- Windows
- Change directory to the temporary directory.
- Windows
cd C:\wasbackup - Linux
cd /tmp/wasbackup
- Windows
- Copy or archive the files from the directory where WebSphere Liberty is installed.
- Windows
xcopy /y /e /d WAS_HOME C:\wasbackup - Linux
tar -cvf wasbackup.tar WAS_HOME/*
- Windows
- Start WebSphere Liberty.
- Windows
WAS_HOME\bin\startServer.bat - Linux
WAS_HOME/bin/startServer.sh
- Windows
- On Ubuntu, run the following command as root user:
ln -s DB_INSTANCE_HOME/gklm50properties/ $HOME/gklm50properties
Where, DB_INSTANCE_HOME is the directory that contains the Db2 database instance for IBM Guardium Key Lifecycle Manager.
For example,ln -s /home/klmdb50/gklm50properties/ $HOME/gklm50properties
- On Linux for System z server, ensure that gtk 2 libraries are installed. Also, add the following parameter in the IM_INSTALL_DIR/eclipse/IBMIM.ini file. Add the following properties just before "--launcher.appendVmargs" in IBMIM.ini file.
--launcher.GTK_version
2
- Installing on a standalone GKLM traditional server
- Installing on a Multi-master setup
- Installing on GKLM container
Installing the fix pack on GKLM traditional
Graphical mode
- Download the fix pack installer files. For instructions, see Download instructions.
- Extract the installer files to a folder of your choice.
- Open a command line.
- Change the directory to the directory where you extracted the fix pack installer files.
- Run the following command to launch the Installation Manager:
-
Windows
updateSKLM.bat IM_INSTALL_LOCATION WAS_HOMEFor example:updateSKLM.bat "C:\Program Files\IBM\Installation Manager" "C:\Program Files\IBM\WebSphere\Liberty"Note: If Installation Manager crashes, follow steps mentioned in Known limitations and issues. -
Linux
chmod +x ./updateSKLM.sh ./updateSKLM.sh IM_INSTALL_DIR WAS_HOMEFor example:./updateSKLM.sh /opt/IBM/InstallationManager /opt/IBM/WebSphere/Liberty
-
- In the Update Packages pane, select the Update all packages (mandatory) with recommended updates and recommended fixes checkbox. Click Next.
- Read the license agreement carefully. If okay, accept the license agreement. Click Next.
- In the WebSphere Liberty configuration window, do not select the checkbox to connect to the online IBM WebSphere Liberty Repository. Click Next.
- Installation Manager fetches the assets and lists all the fixes and features to be installed. Click Next.
- In the Update Packages Configuration for IBM Guardium Key Lifecycle Manager v5.0.0.1 pane:
- Enter Username and Password for IBM Guardium Key Lifecycle Manager Application Administrator.
- Enter Username and Password for IBM Db2 user.
- Click Validate Credentials. Validation might take few minutes. Wait until the Next button is enabled. Click Next.
- In the Update Packages > Summary pane, review the software packages that you want to install, and click Update. After Installation Manager successfully updates the fix pack for the services that you select, a message is displayed.
Silent mode
- Download the fix pack installer files. For instructions, see Download instructions.
- Go to the directory where you extracted the fix pack installation files.
- Open the /sklm directory, which is within the directory where the fix pack is extracted. It contains the response file (SKLM_Silent_Update_platform_Resp.xml) that we need to edit for the installation.
- Locate the response file. Create a backup of the response file:
For example: SKLM_Silent_Update_platform_Resp_original.xml.
- Open the response file for editing. Edit the relevant elements of the response file SKLM_Silent_Update_platform_Resp.xml.
- Edit the repository location to point to the current location of the installer.
- Windows
<repository location='C:\sklminstall_windowsfp\wasfp\repository.config'/> <repository location='C:\sklminstall_windowsfp\sklmwasfp\repository.config'/> - Linux
<repository location='/sklminstall_linuxfp/wasfp/repository.config'/> <repository location='/sklminstall_linuxfp/sklm/repository.config'/>
- Windows
- Edit GKLM Administrator username and password. The password must be encrypted. To encrypt the password, see Encrypting a password.
- Windows
<data key='user.SKLM_ADMIN_USER,com.ibm.gklm50.win' value='SKLMAdmin'/> <data key='user.SKLM_ADMIN_PASSWORD,com.ibm.gklm50.win' value='9YTRJMRIydDSdfhaHPs1ag=='/> - Linux
<data key='user.SKLM_ADMIN_USER,com.ibm.gklm50.linux' value='SKLMAdmin'/> <data key='user.SKLM_ADMIN_PASSWORD,com.ibm.gklm50.linux' value='9YTRJMRIydDSdfhaHPs1ag=='/>
- Windows
-
Edit Db2 username and password. The password must be encrypted. To encrypt the password, see Encrypting a password.
-
Windows
<data key='user.DB_ADMIN_USER,com.ibm.gklm50.win' value='klmdb50'/> <data key='user.DB_ADMIN_PASSWORD,com.ibm.gklm50.win' value='QTh/0AiFvrljhs9gnOYkGA=='/> - Linux
<data key='user.DB_ADMIN_USER,com.ibm.gklm50.linux' value='klmdb50'/> <data key='user.DB_ADMIN_PASSWORD,com.ibm.gklm50.linux' value='9YTRJMRIydDSdfhaHPs1ag=='/>
-
-
Open a command line, and change directory to the directory where the installer files are extracted.
-
Run the following command:
- Windows
silent_updateSKLM.bat IM_INSTALL_DIR WAS_HOMEFor example:silent_updateSKLM.bat "C:\Program Files\IBM\Installation Manager" "C:\Program Files\IBM\WebSphere\Liberty" - Linux
chmod +x ./silent_updateSKLM.sh ./silent_updateSKLM.sh IM_INSTALL_DIR WAS_HOMEFor example:chmod +x ./silent_updateSKLM.sh ./silent_updateSKLM.sh /opt/IBM/InstallationManager /opt/IBM/WebSphere/Liberty
- Windows
- Open a command line.
- Change directory to the IM_INSTALL_DIR/eclipse/tools directory.
- Run the following command: imcl.exe encryptString password_to_encrypt
- An encrypted password is generated.
Installing the fix pack on a Multi-Master setup
Prerequisites
If the original primary master server is acting as a standby master server, promote it to primary and then, install the fix pack. Otherwise, the database updates are not applied to the cluster.
- Stop WebSphere Liberty on all the master servers, in any sequence.
- Open a command line.
- Go to the WAS_HOME\bin directory.
Windows
C:\Program Files\IBM\WebSphere\Liberty\bin
Linux
/opt/IBM/WebSphere/Liberty/bin
- Stop the IBM Guardium Key Lifecycle Manager server.
Windows
stopServer.bat
Linux
./stopServer.sh - Stop Agent on all the master servers, in any sequence.
- Open a command line.
- Go to the GKLM_INSTALL_HOME\agent directory.
Windows
C:\Program Files\IBM\GKLMV50\agent
Linux
/opt/IBM/GKLMV50/agent - Stop the Agent.
Windows
stopAgent.bat WAS_HOME
For example: stopAgent.bat "C:\Program Files\IBM\WebSphere\Liberty"
Linux
./stopAgent.sh WAS_HOME
For example: ./stopAgent.sh /opt/IBM/WebSphere/Liberty
- Apply fix pack on each master server and verify the installation.
Complete this step in the following sequence:- Primary master server
- Principal standby master server
- Auxiliary standby master servers
- For steps to install the fix pack, see Installing the fix pack.
- To verify the installation:
- Log in to IBM Guardium Key Lifecycle Manager and check the version number.
- Ensure that the master server is running and available for use.
Depending on your platform, see the relevant section:
Installing on a Kubernetes cluster
Install IBM Guardium Key Lifecycle Manager container V5.0.0.1 (target).
In the Helm charts, ensure that you configure the same database and volume details that were referenced by the earlier container (source).
For more information, see Install on a Kubernetes cluster.
Installing on a Red Hat OpenShift Container Platform cluster
Install IBM Guardium Key Lifecycle Manager container V5.0.0.1 (target).
In the Helm charts, ensure that you configure the same database and volume details that were referenced by the earlier container (source).
For more information, see Install on a Red Hat OpenShift Container Platform cluster.
Post fix-pack installation activities
- Use one of the following methods to verify the installation.
- Using graphical user interface:
a. Log in to the graphical user interface.
b. On the Welcome page header bar, click the Help (?) icon.
c. Click About.
The page displays the version details. - Using REST interface:
Run the Version Info REST Service. For more information, see Swagger UI.For IBM Guardium Key Lifecycle Manager Traditional:IBM Guardium Key Lifecycle Manager Version: 5.0.0.1 IBM Guardium Key Lifecycle Manager Build Level: 202504031736 Liberty WAS Version: 25.0.0.3 Database Version: DB2/AIX64 SQL120100 Java Version: JRE 1.8.0_441 IBM J9 VM 2.9 Operating System Version: AIX:7.3:ppc64 Agent Version: 2.0 License Status: ActiveFor IBM Guardium Key Lifecycle Manager Container:IBM Guardium Key Lifecycle Manager Version: 5.0.0.1 IBM Guardium Key Lifecycle Manager Build Level: 202504121429 Liberty WAS Version: 25.0.0.3 Database Version: DB2 DSN12015 Java Version: JRE 1.8.0_441 IBM J9 VM 2.9 Operating System Version: Linux:5.4.0-113-generic:s390x Image Tag: 5.0.0.1 License Status: Active
- Using graphical user interface:
- Back up the IBM Guardium Key Lifecycle Manager server. For more information, see Configuring backup and restore.
Important: The following steps uninstall the entire product package, including IBM Guardium Key Lifecycle Manager, IBM Db2, and WebSphere Liberty, and all your data is lost. Take a backup before uninstalling.
Uninstalling IBM Guardium Key Lifecycle Manager with the fix pack by using the graphical user interface
Uninstalling IBM Guardium Key Lifecycle Manager with the fix pack silently
Copyright and trademark information
http://www.ibm.com/legal/copytrade.shtml
Notices
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.
Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.
Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both.
Other company, product, or service names may be trademarks or service marks of others.
THIRD-PARTY LICENSE TERMS AND CONDITIONS, NOTICES AND INFORMATION
The license agreement for this product refers you to this file for details concerning terms and conditions applicable to third party software code included in this product, and for certain notices and other information IBM must provide to you under its license to certain software code. The relevant terms and conditions, notices and other information are provided or referenced below. Please note that any non-English version of the licenses below is unofficial and is provided to you for your convenience only. The English version of the licenses below, provided as part of the English version of this file, is the official version.
Notwithstanding the terms and conditions of any other agreement you may have with IBM or any of its related or affiliated entities (collectively "IBM"), the third party software code identified below are "Excluded Components" and are subject to the following terms and conditions:
-
the Excluded Components are provided on an "AS IS" basis.
-
IBM DISCLAIMS ANY AND ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS WITH RESPECT TO THE EXCLUDED COMPONENTS, INCLUDING, BUT NOT LIMITED TO, THE WARRANTY OF NON-INFRINGEMENT OR INTERFERENCE AND THE IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-
IBM will not be liable to you or indemnify you for any claims related to the Excluded Components.
-
IBM will not be liable for any direct, indirect, incidental, special, exemplary, punitive or consequential damages with respect to the Excluded Components.
Was this topic helpful?
Document Information
Modified date:
21 July 2025
UID
ibm17228726