Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-11-17 Thread Sasa Drnjevic
Thank you both :-) Now I see what you meant. I did that the other day when upgrading v7.1.7.0 to v8.1.0.0 And I did a test from v8.1.0.0 to v8.1.1.0 and even that small step included new licenses, so I did "REGister LICense FILE=*.lic" I was only doing it once per version jump before... when up

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-11-17 Thread Sergio O. Fuentes
Zoltan is correct... you have to install the license package from 8.1.0.0, I believe. Otherwise you'll get nasty messages in the actlog. Though I'm not sure if it actually breaks functionality. If there any IBMers browsing on a Friday afternoon, PMR 53017,082,000 is opened in reference to our i

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-11-17 Thread Zoltan Forray
I would assume the server license as a minimum. Every time we have jumped a version, there is a new server licensing part/files and we have to do a REGister LICense FILE=*.lic on the server after it is up-and-running. On Fri, Nov 17, 2017 at 2:11 PM, Sasa Drnjevic wrote: > First of all thank yo

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-11-17 Thread Sasa Drnjevic
First of all thank you so much for all the info! Can you please just clarify the following: "Licensing files need to be updated with the 8.1.0.x packages." Which/whose "Licensing files"? Client, server or OC? In which case (upgrade to 8.1.2.0 or 8.1.3.0? THNX! -- Sasa Drnjevic www.srce.unizg.

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-11-17 Thread Sergio O. Fuentes
One thing I forgot to mention... if you use 3rd party CA certs anywhere, you'll want to store the password hash prior to performing the upgrade: TSM:> q sslkeyringpw Copy the password to clipboard In instance directory: gsk8capicmd_64 -keydb -stashpw -db cert.kdb Paste password when prompted. c

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-11-17 Thread Sergio O. Fuentes
I wanted to update this email thread with some of the gotchas that we have or are experiencing due to our upgrade from 7.1.7 to 8.1.3: - Watch out when using configuration management or a library manager. I don't have it documented very carefully, but if you're in a configuration management envir

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-10 Thread Zoltan Forray
That is probably due to: SSLACCEPTCERTFROMSERV - The default value Yes enables the client to automatically accept a self-signed public certificate from the server, and to automatically configure the client to use that certificate when the client connects to a V8.1.2 or later server. On Tue, Oct

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-10 Thread Sergio O. Fuentes
My digicert signed certs are loaded into the server cert.kdb using the gsk8apicmd functions. That's working. My question was getting those non-existent root and intermediate CA certs loaded into the client. Normally, in order to get SSL working, you need the whole signing chain on the client (not

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-10 Thread Loon, Eric van (ITOPT3) - KLM
Hi guys! I read all the discussions with interest and I'm getting more and more confused. I tend to shy away from installing the latest codes on my server and clients after seeing all the issues you can get from them. Let's assume I don't care about the tighter security and I only care about a n

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-10 Thread Zoltan Forray
As I read it, "vendor-acquired certificates" need to be loaded/added to the server using the gsk8capicmd function. This link, while it's for 7.1.1, talks about it: https://www.ibm.com/support/knowledgecenter/en/SSGSG7_7.1.1/com.ibm.itsm.tshoot.doc/r_pdg_ssl_comm.html On Tue, Oct 10, 2017 at 10:0

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-10 Thread Sergio O. Fuentes
I have one other question for any IBMers or people who may have had experience with this: If 8.1.2 clients can negotiate certificates with a 8.1.3 TSM server, does this mean that for users who use third-party signed certificates (not loaded by default in the TSM client) that the certificate chain

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-09 Thread Skylar Thompson
Content preview: I definitely agree with this; at least for TSM v7 it would have been far better to call it v7.2.0 to make it clear that it's a huge change with lots of caveats and potential failure points. We've just now discovered that TSM v7.1.8 does not play nicely with GPFS/mmbac

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-09 Thread Zoltan Forray
duct Wiki: > https://www.ibm.com/developerworks/community/wikis/home/wiki/Tivoli% > 20Storage%20Manager > > "ADSM: Dist Stor Manager" wrote on 2017-10-06 > 15:30:56: > > > From: Zoltan Forray > > To: ADSM-L@VM.MARIST.EDU > > Date: 2017-10-06 15:32 >

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-09 Thread Zoltan Forray
i_storage_manager > > Online documentation: > http://www.ibm.com/support/knowledgecenter/SSGSG7/ > landing/welcome_ssgsg7.html > > Product Wiki: > https://www.ibm.com/developerworks/community/wikis/home/wiki/Tivoli% > 20Storage%20Manager > > "ADSM: Dist Stor Manager&qu

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-07 Thread Andrew Raibeck
ARIST.EDU > Date: 2017-10-06 15:32 > Subject: Re: 7.1.8/8.1.3 Security Upgrade Install Issues > Sent by: "ADSM: Dist Stor Manager" > > Well, my testing of upgrading to 8.1.2/3 is not going well. Sure glad I am > doing this on a test server, since it doesn't bode

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-07 Thread Andrew Raibeck
rks/community/wikis/home/wiki/Tivoli%20Storage%20Manager "ADSM: Dist Stor Manager" wrote on 2017-10-06 23:41:06: > From: "Sergio O. Fuentes" > To: ADSM-L@VM.MARIST.EDU > Date: 2017-10-06 23:43 > Subject: Re: 7.1.8/8.1.3 Security Upgrade Install Issues > Sent by: &q

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-07 Thread Roger Deschner
Thanks to all for this discussion of this 7.1.8/8.1.3 issue. I've heard enough to postpone our production upgrade to 7.1.8, scheduled for tomorrow. We've got to set up a test server and fiddle around with it and see what it breaks in our environment. I'm considering a strategy of upgrading all ser

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-06 Thread Sergio O. Fuentes
Hello all! I just discovered this thread today because I had been testing 8.1.1 server very recently. I had some issues with that on Thursday and then Friday I went further down the rabbit hole. Now I'm finding that major portions of our environment will have to be upgraded very soon. I'm just

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-06 Thread Zoltan Forray
Well, my testing of upgrading to 8.1.2/3 is not going well. Sure glad I am doing this on a test server, since it doesn't bode well for a production system. This is what we did in our testing. 1. Server was upgraded from 8.1.1 to 8.1.3 2. Created a new node. Installed 7.1.6 client on a W10E wo

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-06 Thread Skylar Thompson
Content preview: We recently went from 7.1.7.300 to 7.1.8 in a 3-server environment (one library manager, two library clients). As always, do the library manager before any of the clients. We had some communication problems with one of the library clients that we ended up solving li

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-06 Thread Zoltan Forray
I spent some quality time digging through 7.1.8/8.1.3 docs yesterday and came to similar conclusions (my first thought was that 7.1.8 was just a maintenance release for 7.1.7 - did not realize they back-ported the TLS 1.2 enforcement from 8.1.2+) I am a beta tester for TSMManager and am working wi

Re: 7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-06 Thread Stefan Folkerts
Roger, There has been a discussion about a few things you are asking questions about just a day or so ago, I gave my view on the client and admin situation. I will use the same old and new definitions as you did. It basically boils down to this for client and admin sessions Once a node uses the

7.1.8/8.1.3 Security Upgrade Install Issues

2017-10-05 Thread Roger Deschner
Versions 7.1.8 and 8.1.3 of WDSF/ADSM/TSM/SP have now been made available containing substantial security upgrades. A bunch of security advisories were sent this week containing details of the vulnerabilities patched. Some are serious; our security folks are pushing to get patches applied. For the