IBM Business Process Manager Interactive Installation and Configuration Guide

One of my IBM colleagues led me to discover this, when he asked for guidance on installing IBM BPM Standard 8.5.5 onto an existing installation of WebSphere Application Server (WAS): -

IBM Business Process Manager Interactive Installation and Configuration Guide

This guide takes you through the steps for installing and configuring IBM Business Process Manager (IBM BPM).

If you are migrating business data and applications from a previous version, use the Interactive Migration Guide instead of this guide. The Interactive Migration Guide generates instructions for a complete migration, including installing and configuring the product.

The Interactive Installation and Configuration Guide works best in supported versions of Firefox on Windows 7. To report problems with using this guide, use the feedback link. In most instances, the generated output is restricted to supported installation scenarios. However, it might be possible to generate an unsupported set of instructions. For information about supported installation scenarios, go to the IBM Support Portal or use the installation roadmaps.

The Interactive Installation and Configuration Guide uses installation and configuration rules and considerations that are described in other topics in this information center. Each of those topics is accessible to screen readers, but the Interactive Installation and Configuration Guide itself is not fully accessible. For fully accessible information, use the installation topics in the information center as an alternative to using the Interactive Installation and Configuration Guide.

IBM Security Bulletins - Padding Oracle On Downgraded Legacy Encryption (POODLE)

Saw these and thought of ... well, everyone: -

Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere Application Server (CVE-2014-3566)

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled by default in IBM WebSphere Application Server.

Security Bulletin: Vulnerability in SSLv3 affects IBM HTTP Server (CVE-2014-3566)

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled by default in the Apache based IBM HTTP Server.

IBM Tivoli Access Manager WebSEAL overview

IBM(R)Tivoli(R)Access Manager for e-business (Tivoli Access Manager) is a robust and secure centralized policy management solution for e-business and distributed applications. IBM Tivoli Access Manager WebSEAL is a high performance, multi-threaded Web server that applies fine-grained security policy to the Tivoli Access Manager protected Web object space. WebSEAL can provide single sign-on solutions and incorporate back-end Web application server resources into its security policy.

This overview chapter introduces you to the main capabilities of the WebSEAL server.

Topic Index:

• Introducing IBM Tivoli Access Manager and WebSEAL

• Understanding the Tivoli Access Manager security model

• Protecting the Web space with WebSEAL

• Planning and implementing the security policy

• Understanding WebSEAL authentication

• Understanding WebSEAL junctions

IBM Tivoli Access Manager WebSEAL overview

Interesting glitch with IBM Tivoli Access Manager 6.1.1 when creating Policy

This is what I was running: -

/opt/PolicyDirector/sbin/mgrsslcfg -config -f no

and this is what I was seeing: -

Aborted (core dumped)

which, I think you will agree, is less than helpful.

This is what I had installed: -

rpm -qa | grep -i 6.1.1

PDWebADK-PD-6.1.1-8.i386
PDAuthADK-PD-6.1.1-8.i386
PDAcld-PD-6.1.1-8.i386
PDlic-PD-6.1.1-0.i386
TivSecUtl-TivSec-6.1.1-2.i386
PDWPM-PD-6.1.1-8.i386
PDMgr-PD-6.1.1-8.i386
PDWebRTE-PD-6.1.1-8.i386
PDMgrPrxy-PD-6.1.1-8.i386
PDWeb-PD-6.1.1-8.i386
PDRTE-PD-6.1.1-0.i386
PDJrte-PD-6.1.1-8.i386

Note that the PDRTE component was back-level.

I thought I'd patched things up.

Once I applied the fix: -

rpm -Uvh /tmp/fixes/PDRTE-PD-6.1.1-8.i386.rpm

things started working better: -

/opt/PolicyDirector/sbin/mgrsslcfg -config -f no

Creating the SSL certificate.  This might take several minutes.
The SSL configuration of the Tivoli Access Manager policy server
has completed successfully.

The policy server's signed SSL certificate is base-64 encoded and
saved in text file "/var/PolicyDirector/keytab/pdcacert.b64."

This file is required by the configuration program on each machine
in your secure domain.

which is nice.

Installing IBM Tivoli Directory Server 6.3 on Red Hat Enterprise Linux 6.5

Mount the ISO

mount /dev/sr0 /media

mount: block device /dev/sr0 is write-protected, mounting read-only

Install ITDS

/media/ibm_im_64bit/tools/imcl -input installITDS63.rsp -acceptLicense

ERROR: Error during "install" phase:

  ERROR:   GLPINS005E The IBM Security Directory Server licenses cannot be installed.

with: -

 <message>Cannot run program "/opt/ibm/ldap/V6.3.1/tmp/license/idsLicense": java.io.IOException: error=2, No such file or directory</message>

in the IIM log ( /var/ibm/InstallationManager/logs/20141018_1816.xml ).

Read the Technote

GLPINS005E Error - Cannot run program idsLicense installing SDS 6.3.1

...

Cause

The shebang line of the idsLicense script requires ksh

...

Install the missing ksh RPM

yum install ksh

Loaded plugins: product-id, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package ksh.x86_64 0:20120801-10.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

==================================================================================================================
 Package               Arch                     Version                            Repository                Size
==================================================================================================================
Installing:
 ksh                   x86_64                   20120801-10.el6                    server                   756 k

Transaction Summary
==================================================================================================================
Install       1 Package(s)

Total download size: 756 k
Installed size: 1.7 M
Is this ok [y/N]: y
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : ksh-20120801-10.el6.x86_64                                                                     1/1 
  Verifying  : ksh-20120801-10.el6.x86_64                                                                     1/1 

Installed:
  ksh.x86_64 0:20120801-10.el6                                                                                    

Complete!

Repeat the ITDS Installation

/media/ibm_im_64bit/tools/imcl -input installITDS63.rsp -acceptLicense

ERROR: Error during "install" phase:

  ERROR:   GLPINS009E An error occurred while uninstalling DB2 package.

  ERROR:   GLPINS008E An error occurred while installing GSKIT package.

Diagnose Further

view /var/ibm/InstallationManager/logs/20141018_1821.xml 

....

Output:  Aborting the current installation ...
  Run installation with the option "-f sysreq" parameter to force the installation.

Error:WARNING:
   The 32 bit library file libstdc++.so.6 is not found on the system.
   32-bit applications may be affected.
WARNING:
   The required library file libstdc++.so.5 is not found on the system.
WARNING:
DBT3534W  The db2prereqcheck utility determined that ASLR is set to ON and that this could cause issues with some tools.
WARNING:
   The 32-bit library file libpam.so is not found on the system.
   Check the following web site for the up-to-date system requirements
   of IBM DB2 9.7
   http://www.ibm.com/software/data/db2/udb/sysreqs.html
   http://www.software.ibm.com/data/db2/linux/validate  </message>

...

Install missing RPMs

yum install libstdc++.so.6
yum install libstdc++.so.5

Repeat the ITDS Installation

/media/ibm_im_64bit/tools/imcl -input installITDS63.rsp -acceptLicense

ERROR: Error during "install" phase:

  ERROR:   GLPINS009E An error occurred while uninstalling DB2 package.

  ERROR:   GLPINS008E An error occurred while installing GSKIT package.

Further Diagnosis

view /var/ibm/InstallationManager/logs/20141018_1824.xml

...

Output:  Aborting the current installation ...
  Run installation with the option "-f sysreq" parameter to force the installation.

Error:WARNING:
   The required library file libstdc++.so.5 is not found on the system.
WARNING:
DBT3534W  The db2prereqcheck utility determined that ASLR is set to ON and that this could cause issues with some tools.
WARNING:
   The 32-bit library file libpam.so is not found on the system.
   Check the following web site for the up-to-date system requirements
   of IBM DB2 9.7
   http://www.ibm.com/software/data/db2/udb/sysreqs.html
   http://www.software.ibm.com/data/db2/linux/validate  </message>

....

Install the 32-bit library that includes libstdc++.so.5

yum install compat-libstdc++-33

Validate that DB2 is now mostly happy

/media/ibm_db2/db2prereqcheck 

WARNING:
DBT3534W  The db2prereqcheck utility determined that ASLR is set to ON and that this could cause issues with some tools.
WARNING: 
   The 32-bit library file libpam.so is not found on the system. 

This is a known issue with older versions of DB2, as per this Technote: -

IC87092: DB2PREREQCHECK GIVES WARNING "THE 32-BIT LIBRARY FILE LIBPAM.SO IS NOT FOUND ON THE SYSTEM." WHEN THE REQUIRED LIBPAM.SO.0 EXIST

The "circumvention" is to do this: -

cd /lib

ln -s libpam.so.0 libpam.so

so we now get this: -

/media/ibm_db2/db2prereqcheck 

WARNING:
DBT3534W  The db2prereqcheck utility determined that ASLR is set to ON and that this could cause issues with some tools.

Repeat the ITDS Installation

/media/ibm_im_64bit/tools/imcl -input installITDS63.rsp -acceptLicense

ERROR: Error during "install" phase:

  ERROR:   GLPINS008E An error occurred while installing GSKIT package.

So, whilst DB2 is OK, we've got to look at GSKIT.

Debug

view /var/ibm/InstallationManager/logs/20141018_1906.xml

...

Error:  package gskcrypt32-8.0-14.26.i386 is already installed
        package gskssl32-8.0-14.26.i386 is already installed</message>

...

 <message>com.ibm.security.directoryserver.installer.components.InstallGSKIT : Error occured while executing command: /bin/rpm -Uhv /media/ibm_gskit/gskcrypt32-8*.rpm /media/ibm_gskit/gskssl32-8*.rpm</message>

...

Validate what GSK components are installed

rpm -qa | grep -i gsk

gskcrypt64-8.0-14.26.x86_64
gskssl32-8.0-14.26.i386
gskssl64-8.0-14.26.x86_64
gskcrypt32-8.0-14.26.i386

Uninstall GSK

rpm -e `rpm -qa | grep -i gsk`

Repeat the ITDS Installation

/media/ibm_im_64bit/tools/imcl -input installITDS63.rsp -acceptLicense

Installed com.ibm.cic.agent_1.7.0.20130828_2012 to the /opt/IBM/InstallationManager/eclipse directory.
Installed com.ibm.security.directoryserver.v631_6.3.1.0 to the /opt/ibm/ldap/V6.3.1 directory.

Pour a G&T

Huzzah :-)

Response File - installlITDS63.rsp

<?xml version="1.0" encoding="UTF-8"?>
<agent-input>
<server>
<repository location='/media/ibm_im_64bit/'/>
<repository location='/media/ibm_sds'/>
</server>

<profile id='IBM Installation Manager' installLocation='/opt/IBM/InstallationManager/eclipse' kind='self'>
<data key='eclipseLocation' value='/opt/IBM/InstallationManager/eclipse'/>
<data key='user.import.profile' value='false'/>
<data key='cic.selector.os' value='linux'/>
<data key='cic.selector.ws' value='gtk'/>
<data key='cic.selector.arch' value='x86_64'/>
<data key='cic.selector.nl' value='de,ru,ko,el,lt,en,it,pt_BR,fr,hu,es,zh,cs,ar,zh_TW,zh_HK,ja,sl,pl,da,tr'/>
</profile>

<profile id='IBM Security Directory Server' installLocation='/opt/ibm/ldap/V6.3.1'>
<data key='eclipseLocation' value='/opt/ibm/ldap/V6.3.1'/>
<data key='user.import.profile' value='false'/>
<data key='cic.selector.os' value='linux'/>
<data key='cic.selector.arch' value='x86_64'/>
<data key='cic.selector.ws' value='gtk'/>
<data key='cic.selector.nl' value='en'/>
<data key='user.db2.user.password,com.ibm.security.directoryserver.v631' value=''/>
<data key='user.db2.username,com.ibm.security.directoryserver.v631' value=''/>
<data key='user.db2.user.domain,com.ibm.security.directoryserver.v631' value=''/>
<data key='user.use.existing.db2,com.ibm.security.directoryserver.v631' value='false'/>
<data key='user.db2.executable.path,com.ibm.security.directoryserver.v631' value='/media/ibm_db2'/>
<data key='user.use.existing.db2.installpath,com.ibm.security.directoryserver.v631' value=''/>
<data key='user.renter.db2.user.password,com.ibm.security.directoryserver.v631' value=''/>
<data key='user.use.existing.gskit,com.ibm.security.directoryserver.v631' value='false'/>
<data key='user.gskit.executable.path,com.ibm.security.directoryserver.v631' value='/media/ibm_gskit'/>
<data key='user.jdk.executable.path,com.ibm.security.directoryserver.v631' value='/media/ibm_jdk/ibm-java-16sr14-linux-64.tar'/>
</profile>
<install modify='false'>
<offering id='com.ibm.cic.agent' version='1.7.0.20130828_2012' profile='IBM Installation Manager' features='agent_core,agent_jre' installFixes='none'/>
<offering id='com.ibm.security.directoryserver.v631' version='6.3.1.0' profile='IBM Security Directory Server' features='main.feature.db2,main.feature.gskit,main.feature.jdk,main.feature.javaclient,main.feature.server,main.feature.cclient' installFixes='none'/>
</install>
<preference name='com.ibm.cic.common.core.preferences.eclipseCache' value='/opt/IBM/IBMIMShared'/>
<preference name='com.ibm.cic.common.core.preferences.connectTimeout' value='30'/>
<preference name='com.ibm.cic.common.core.preferences.readTimeout' value='45'/>
<preference name='com.ibm.cic.common.core.preferences.downloadAutoRetryCount' value='0'/>
<preference name='offering.service.repositories.areUsed' value='true'/>
<preference name='com.ibm.cic.common.core.preferences.ssl.nonsecureMode' value='false'/>
<preference name='com.ibm.cic.common.core.preferences.http.disablePreemptiveAuthentication' value='false'/>
<preference name='http.ntlm.auth.kind' value='NTLM'/>
<preference name='http.ntlm.auth.enableIntegrated.win32' value='true'/>
<preference name='com.ibm.cic.common.core.preferences.preserveDownloadedArtifacts' value='true'/>
<preference name='com.ibm.cic.common.core.preferences.keepFetchedFiles' value='false'/>
<preference name='PassportAdvantageIsEnabled' value='false'/>
<preference name='com.ibm.cic.common.core.preferences.searchForUpdates' value='false'/>
<preference name='com.ibm.cic.agent.ui.displayInternalVersion' value='false'/>
<preference name='com.ibm.cic.common.sharedUI.showErrorLog' value='true'/>
<preference name='com.ibm.cic.common.sharedUI.showWarningLog' value='true'/>
<preference name='com.ibm.cic.common.sharedUI.showNoteLog' value='true'/>
</agent-input>

VMware - Where the X is my X ?

On a freshly minted VM of Red Hat Enterprise Linux 6.6 on VMware Fusion 7.0.0, I am trying to resolve a problem with a GUI application failing with a rather nice exception: -

java: cairo-misc.c:380: _cairo_operator_bounded_by_source: Assertion `NOT_REACHED' failed.

As part of my problem determination regime, I want to check whether the problem only occurs when tunnelling X11 from my Mac, via SSH, to the RHEL VM.

Therefore, I wanted to use X11 within the VMware terminal itself.

When I type startx, I get : -

-bash: startx: command not found

which makes sense since I didn't explicitly install X11 when I first built the VM.

Therefore, I need to install X11: -

yum install gdm

Some seventy RPMs later, I've got: -

Installed:
  gdm.i686 1:2.30.4-64.el6                                                                                        

so I again try startx: -

...

xauth:  creating new authority file /root/.serverauth.3966
xauth: (argv):1:  bad display name "tameb.uk.ibm.com:0" in "list" command
xauth: (stdin):1:  bad display name "tameb.uk.ibm.com:0" in "add" command
...

...

Loading extension GLX

(EE) 
Fatal server error:
(EE) no screens found(EE) 
(EE) 
...

which isn't too nice :-(

I go to check the video adapter: -

lspci | grep VGA

00:0f.0 VGA compatible controller: VMware SVGA II Adapter

at which point the penny drops.

I forgot to install VMware Tools ....

Having done this, alas, I got the same issue - no screens found :-(

Having rebooted, I tried running the VMware configuration utility again: -

vmware-config-tools.pl

taking the defaults: -

...

Distribution provided drivers for Xorg X server are used.

Skipping X configuration because X drivers are not included.
...

which made me think.

I checked to see what VMware drivers were available in the Yum repository: -

yum list | grep -i vmware

xorg-x11-drv-vmware.i686               13.0.1-9.el6                      server 

and installed the ( assume to be ) missing driver: -

yum install xorg-x11-drv-vmware.i686

Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package xorg-x11-drv-vmware.i686 0:13.0.1-9.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

==================================================================================================================
 Package                            Arch                Version                       Repository             Size
==================================================================================================================
Installing:
 xorg-x11-drv-vmware                i686                13.0.1-9.el6                  server                 33 k

Transaction Summary
==================================================================================================================
Install       1 Package(s)

Total download size: 33 k
Installed size: 53 k
Is this ok [y/N]: y
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : xorg-x11-drv-vmware-13.0.1-9.el6.i686                                                          1/1 
  Verifying  : xorg-x11-drv-vmware-13.0.1-9.el6.i686                                                          1/1 

Installed:
  xorg-x11-drv-vmware.i686 0:13.0.1-9.el6                                                                         

Complete!

That did the trick, I can now start X11: -

xauth:  creating new authority file /root/.serverauth.2222


X.Org X Server 1.15.0
Release Date: 2013-12-27
X Protocol Version 11, Revision 0
Build Operating System: x86-022 2.6.18-371.11.1.el5 
Current Operating System: Linux tameb.uk.ibm.com 2.6.32-504.el6.i686 #1 SMP Tue Sep 16 01:56:19 EDT 2014 i686
Kernel command line: ro root=/dev/mapper/vg_tameb-lv_root rd_NO_LUKS  KEYBOARDTYPE=pc KEYTABLE=uk LANG=en_US.UTF-8 rd_NO_MD rd_LVM_LV=vg_tameb/lv_swap SYSFONT=latarcyrheb-sun16 crashkernel=129M@0M rd_LVM_LV=vg_tameb/lv_root rd_NO_DM rhgb quiet
Build Date: 03 September 2014  11:17:40AM
Build ID: xorg-x11-server 1.15.0-22.el6 
Current version of pixman: 0.32.4
Before reporting problems, check https://www.redhat.com/apps/support/
to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
(++) from command line, (!!) notice, (II) informational,
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/var/log/Xorg.0.log", Time: Sat Oct 18 09:29:20 2014
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
Initializing built-in extension Generic Event Extension
Initializing built-in extension SHAPE
Initializing built-in extension MIT-SHM
Initializing built-in extension XInputExtension
Initializing built-in extension XTEST
Initializing built-in extension BIG-REQUESTS
Initializing built-in extension SYNC
Initializing built-in extension XKEYBOARD
Initializing built-in extension XC-MISC
Initializing built-in extension SECURITY
Initializing built-in extension XINERAMA
Initializing built-in extension XFIXES
Initializing built-in extension RENDER
Initializing built-in extension RANDR
Initializing built-in extension COMPOSITE
Initializing built-in extension DAMAGE
Initializing built-in extension MIT-SCREEN-SAVER
Initializing built-in extension DOUBLE-BUFFER
Initializing built-in extension RECORD
Initializing built-in extension DPMS
Initializing built-in extension Present
Initializing built-in extension X-Resource
Initializing built-in extension XVideo
Initializing built-in extension XVideo-MotionCompensation
Initializing built-in extension SELinux
Initializing built-in extension XFree86-VidModeExtension
Initializing built-in extension XFree86-DGA
Initializing built-in extension XFree86-DRI
Initializing built-in extension DRI2
Loading extension GLX
gnome-session[2324]: WARNING: Unable to find provider 'gnome-panel' of required component 'panel'
gnome-session[2324]: WARNING: Unable to find provider 'nautilus' of required component 'filemanager'
GNOME_KEYRING_SOCKET=/tmp/keyring-fG4etF/socket
SSH_AUTH_SOCK=/tmp/keyring-fG4etF/socket.ssh
GNOME_KEYRING_PID=2358

I seem to have no keyboard or mouse support within the VMware console itself.

This gave me a pointer: -

Mouse Does Not Function Properly in Linux Guests That Use X.Org 7.1 or Higher (5739104)

and had me check what I had installed in terms of Xorg.

Xorg -version

X.Org X Server 1.15.0
Release Date: 2013-12-27
X Protocol Version 11, Revision 0
Build Operating System: x86-022 2.6.18-371.11.1.el5 
Current Operating System: Linux tameb.uk.ibm.com 2.6.32-504.el6.i686 #1 SMP Tue Sep 16 01:56:19 EDT 2014 i686
Kernel command line: ro root=/dev/mapper/vg_tameb-lv_root rd_NO_LUKS  KEYBOARDTYPE=pc KEYTABLE=uk LANG=en_US.UTF-8 rd_NO_MD rd_LVM_LV=vg_tameb/lv_swap SYSFONT=latarcyrheb-sun16 crashkernel=129M@0M rd_LVM_LV=vg_tameb/lv_root rd_NO_DM rhgb quiet
Build Date: 03 September 2014  11:17:40AM
Build ID: xorg-x11-server 1.15.0-22.el6 
Current version of pixman: 0.32.4
Before reporting problems, check https://www.redhat.com/apps/support/
to make sure that you have the latest version.

rpm -qa | grep -i xorg

xorg-x11-xauth-1.0.2-7.1.el6.i686
xorg-x11-font-utils-7.2-11.el6.i686
xorg-x11-xinit-1.0.9-14.el6.i686
xorg-x11-apps-7.7-6.el6.i686
xorg-x11-server-Xorg-1.15.0-22.el6.i686
xorg-x11-utils-7.5-6.el6.i686
xorg-x11-drv-vmware-13.0.1-9.el6.i686
xorg-x11-drv-ati-firmware-7.3.99-2.el6.noarch
xorg-x11-fonts-Type1-7.2-9.1.el6.noarch
xorg-x11-server-utils-7.7-2.el6.i686
xorg-x11-proto-devel-7.7-9.el6.noarch
xorg-x11-xkb-utils-7.7-4.el6.i686
xorg-x11-server-common-1.15.0-22.el6.i686
xorg-x11-drv-wacom-0.23.0-4.el6.i686

This led me to install mouse and keyboard drivers for Xorg: -

yum install xorg-x11-drv-vmmouse.i686

yum install xorg-x11-drv-keyboard.i686

but I was still finding that the same problem persisted.

I checked the logs: -

cat /var/log/Xorg.0.log

...

[  3403.228] (EE) Failed to load module "evdev" (module does not exist, 0)
[  3403.228] (EE) No input driver matching `evdev'
[  3403.228] (EE) config/hal: NewInputDeviceRequest failed (15)
[  3411.917] (II) vmware(0): Terminating Xv video-stream id:0
[  3412.022] (EE) Server terminated successfully (0). Closing log file.

...

and installed the missing evdev driver: -

yum install xorg-x11-drv-evdev

Hurrah, now I have a working mouse and keyboard within the X11 console session :-)

IBM Tivoli Directory Server - System Requirements

More specifically: -

IBM Security Directory Server, Version 6.3.1, system requirements

Detailed System Requirements - IBM Security Directory Server 6.3.1.5