IBM Support

IT23560: PREVENTING INCOMPATIBILITY OF LOCAL GSKIT WITH THE SECURITY ENHANCEMENTS INTRODUCED IN CLIENT VERSIONS 7.1.8 AND 8.1.2

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as documentation error.

Error description

  • A new key management security feature was introduced in
    IBM Spectrum Protect client versions 7.1.8 and 8.1.2
    It requires a minimum GSKit level (currently 8.0.50.78).
    The IBM Spectrum Protect client install packages include
    this GSKit for global installation.
    
    Some applications which are backed up by the IBM Spectrum
    Protect client use a local GSKit for their own security
    requirements and force the IBM Spectrum Protect client to use
    that same local GSKit which might not be at the minimum level
    required for IBM Spectrum Protect operations.
    
    This forcing of a local GSKit by a non - IBM Spectrum Protect
    application can happen in 2 ways:
    
    1. By setting the environment.
       Example: IBM Spectrum Scale
       mmbackup starts 'dsmc' in an environment with the variable
       LIBPATH and/or LD_LIBRARY_PATH pointing to their specific
       local GSKit directory.
    
    2. Or by loading the IBM Spectrum Protect API client code when
       the application's local GSKit is already present in the
       application processe's address space.
       Example: DB2 both with and without
               IBM Spectrum Protect for Enterprise Resource Planning
    
    As this local GSKit is potentially downlevel, there is a risk of
    unwanted results, if the necessary precautions are not taken.
    
    Several IBM Spectrum Protect client documents have to be created
    or updated with the goal to make users aware that they have to
    take precautions as part of their IBM Spectrum Protect upgrade
    plans to version 7.1.8 or 8.1.2
    
    Item 1
    A new document with a comprehensive list of the GSKit version
    required with each respective client version.
    
    Item 2
    The requirements document
    http://www-01.ibm.com/support/docview.wss?uid=swg21243309
    needs a reference to the minimum required GSKit levels
    (see item 1).
    
    Item 3
    The user guide "Using the Application Programming Interface"
    needs a chapter with an explanation that helps application
    programmers understand the dependencies and suggest solutions
    how to have their application load the correct GSKit.
    
    Product versions affected: IBM Spectrum Protect
                               Backup-Archive client and API client
                               7.1.8.0 and later 7.1 versions
                               as well as
                               8.1.2.0 and later versions
               Initial impact: Medium
          Additional keywords: gskit key management gsk km
                               certificate cert gpfs hsm
                               application app downlevel
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:                                              *
    * IBM Spectrum Protect: Backup-Archive Clients 8.1.2           *
    * Installation and User's Guide.                               *
    ****************************************************************
    * PROBLEM DESCRIPTION:                                         *
    * See ERROR DESCRIPTION.                                       *
    ****************************************************************
    * RECOMMENDATION:                                              *
    * Apply fixing level when available. This issue is projected   *
    * to be fixed in the 8.1.6 update to the IBM Spectrum Protect: *
    * Backup-Archive Clients Installation and User's Guide.        *
    *                                                              *
    * Until this information is published, the associated          *
    * information updates are documented in the V7.1 Documentation *
    * Updates tech note located here:                              *
    * http://www.ibm.com/support/docview.wss?uid=swg27039351 and   *
    * the V8.1 Documentation Updates tech note located here:       *
    * http://www.ibm.com/support/docview.wss?uid=swg27048955       *
    *                                                              *
    * You can locate the entry associated with this APAR by using  *
    * the APAR number as a keyword to search the document.         *
    *                                                              *
    * Note: This information is subject to change at the           *
    * discretion of IBM.                                           *
    ****************************************************************
    N/A
    

Problem conclusion

  • The missing information will be published with the IBM Spectrum
    Protect: Backup-Archive Clients 8.1.6 documentation and included
    in the V8.1 Documentation Updates tech note. The additional
    information with regard to the required GSKit version will be
    located in the Topic titled as: Creating a symbolic link to
    access the latest GSKit library.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT23560

  • Reported component name

    TSM CLIENT

  • Reported component ID

    5698ISMCL

  • Reported release

    81A

  • Status

    CLOSED DOC

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2017-12-22

  • Closed date

    2018-05-17

  • Last modified date

    2018-05-17

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels



Document information

More support for: Tivoli Storage Manager

Software version: 81A

Reference #: IT23560

Modified date: 17 May 2018


Translate this page: