IBM(R) Tivoli(R) Security Compliance Manager, Patch 5.1.1-TIV-SCM-FP0005 README
===============================================================================

(C) Copyright International Business Machines Corporation 2007.
    All rights reserved.

U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Friday, 30 March 2007

-------------------------------------------------------------------------------

    CONTENTS

    1.0 ABOUT THIS PATCH
        1.1 Patch contents
        1.2 Architectures
        1.3 Patches superseded
        1.4 Dependencies
    2.0 APARS AND DEFECTS FIXED
        2.1 Problems fixed by patch 5.1.1-TIV-SCM-FP0005
        2.2 Problems fixed by patch 5.1.1-TIV-SCM-LA0003
    3.0 BEFORE INSTALLING THIS PATCH
        3.1 Review this entire document before installing
        3.2 Patch installation overview
        3.3 Back up the Tivoli Security Compliance Manager Server and database
    4.0 INSTALLING THIS PATCH
        4.1 Installing the patch on the server
        4.2 Installing the patch on the DB2 database server
        4.3 Installing the patch on systems with the administration utilities
            component
        4.4 Installing this patch on a NetWare client
        4.5 Restarting the server
        4.6 Automatically installing the patch on client systems
    5.0 AFTER INSTALLING THIS PATCH
        5.1 Updating server.ini if report.sectionsList contains custom reports
        5.2 Installing additional base components after installing a fix pack
    6.0 DOCUMENTATION UPDATES
        6.1 IBM Tivoli Security Compliance Manager Administration Guide
        6.2 IBM Tivoli Security Compliance Manager Administration Guide
        6.3 IBM Tivoli Security Compliance Manager IISSCN Extension Release Notes
        6.4 IBM Integrated Security Solution for Cisco Networks Deployment Guide
        6.5 Expiration of the original IBMJCE certificates.
        6.6 "Installation Guide: all components" update.
    7.0 SOFTWARE LIMITATIONS
        7.1 GUI console and SCM Server interoperability
    8.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
        8.1 SQL scripts might produce errors after migration
        8.2 Collector authorization management in SCM 5.1.1
        8.3 Rights management in SCM 5.1.1
    9.0 NOTICES
        9.1 Trademarks


1.0 ABOUT THIS PATCH
--------------------
  This patch package contains fixes for problems in the IBM Tivoli Security
  Compliance Manager software. This patch requires that version 5.1.1.1 of IBM
  Tivoli Security Compliance Manager already be installed on all components to
  be patched.

1.1 Patch contents

 This patch package contains the following files:

  - This README file
  - scmserver_fp5_aix
  - scmserver_fp5_hp11
  - scmserver_fp5_linux
  - scmserver_fp5_linux390
  - scmserver_fp5_linuxppc
  - scmserver_fp5_solaris
  - scmserver_fp5_win32.exe
  - scmserver_fp5_install.jar
  - clientUpdate.jar

  The following files are replaced during installation:
  - client.jar
  - scmcli.jar
  - server.jar
  - jacgui.jar

  The following files are modified during installation:
  - server.ini

  Fixes to collectors are included in a separate fixpacks. Please contact L2 to
  obtain collector fixpacks. Since publication of SCM 5.1.1.1 only one collector
  fixpack 5.1.1-TIV-SCM-LA0004 was released.

1.2 Architectures

  This patch package applies to the following architectures. Systems marked with
  (!) are supported on limited, non-defect basis.
  
       Server:
        - IBM AIX(R) 5.1(*), 5.2, 5.3
        - Sun Solaris 8, 9, 10
        - Microsoft Windows(R) 2000 Server, Advanced Server 
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
        - Red Hat Linux(R) Advanced Server for Intel IA32 4.0
        - SUSE Linux Enterprise Server for Intel IA32 8, 9
        
       Client:
        - IBM AIX(R) 5.1(*), 5.2, 5.3
        - HP-UX 11.0, 11.23
        - i5/OS V5R3, V5R4
        - Microsoft Windows(R) NT 4.0 Server, Workstation
        - Microsoft Windows(R) 2000 Professional, Server, Advanced Server
        - Microsoft Windows(R) XP Professional w/SP2
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
        - Novell NetWare(R) 6.5
        - Red Hat Linux(R) Advanced Server for Intel IA32 2.1, 3.0, 4.0
        - Red Hat Linux(R) Advanced Server for iSeries 3.0
        - Red Hat Linux(R) Advanced Server for pSeries 3.0
        - Red Hat Linux(R) Advanced Server for zSeries 3.0
        - Sun Solaris 7, 8, 9, 10
        - SUSE Linux Enterprise Server for Intel IA32 8, 9
        - SUSE Linux Enterprise Server for iSeries 8, 9
        - SUSE Linux Enterprise Server for pSeries 9, 9
        - SUSE Linux Enterprise Server for zSeries 8, 9
        
       Administration console:
        - Microsoft Windows(R) 2000 Professional, Server, Advanced Server
        - Microsoft Windows(R) XP Professional w/SP2
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
       
       Administration command line
        - IBM AIX(R) 5.1(*), 5.2, 5.3
        - HP-UX 11.0, 11.23
        - Microsoft Windows(R) 2000 Professional, Server, Advanced Server
        - Microsoft Windows(R) XP Professional w/SP2
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
        - Sun Solaris 8, 9, 10
        - Red Hat Linux(R) Advanced Server for Intel IA32 3.0, 4.0
        - SUSE Linux Enterprise Server for Intel IA32 8, 9
        - SUSE Linux Enterprise Server for iSeries 8, 9
        - SUSE Linux Enterprise Server for pSeries 9, 9


1.3 Patches superseded

  The following patches are superseded by this patch:

        5.1.1-TIV-SCM-LA0003

1.4 Dependencies

      IBM Tivoli Security Compliance Manager Version 5.1.1.1

2.0  APARS AND DEFECTS FIXED
----------------------------

2.1 Problems fixed by patch 5.1.1-TIV-SCM-FP0005

  APAR IY95309
  Doc APAR: Policy collector icon dissapears after upgrade to 
  5.1.0-TIV-SCM-FP0020 or later on clients using IISSCN extension.

  APAR IY95471
  Symptom: In the SCM 5.1.1.1 mouse icon does not change to hour glass when
  expanding Snapshots folder on Policies tab.

  APAR IY95561
  Symptom: In the SCM 5.1.1.1 on Clients tab clients and groups are
  alphabetically sorted making them appear interspersed.

  APAR IY96084
  Symptom: In the SCM 5.1.1.1 no clients are listed under All or Inactive group
  on Clients tab, but clients do appear under individual groups.

  internal defect 72244
  Symptom: When importing policy, the collector schedule could be edited, while
  policy collectors does not have their own schedules.

  internal defect 74720
  Symptom: The default expiration date for new suppresion is set to 1st January
  2006 making it immediately expired.

  internal defect 75146
  Symptom: When transfering large amounts of data collected, SCM client throws
  OutOfMemoryException causing JVM to throw javadump and abort data processing.

  internal defect 75243
  Symptom: Information panel Roles on Users tab does not move freely.

  internal defect 75405
  Symptom: New report section 'Compliance Query' was introduced. 
 
  internal defect 75470
  Symptom: SCM GUI throws NullPointerException if no section was chosen during
  snapshot export.
  

2.2 Problems fixed by patch 5.1.1-TIV-SCM-LA0003

  APAR IY92791
  Symptom: In the SCM 5.1.1.x you can deploy on clients and run unathorized
  collector.

  APAR IY92857
  Symptom: User without permissions can view snapshots in SCM 5.1.1.0.

  APAR IY93780
  Symptom: The snapshot generation fails on SCM Server 5.1.0.29 with error: 
  Can't find resource for bundle com.ibm.jac.msg.PolicyMessages.

  APAR IY94458
  Symptom: The user with two roles assigned has no access to the clients in
  groups if both roles have "Database Read Access" permission on the "Default
  Server Object". Related to both SCM 5.1.0 and SCM 5.1.1 lines.
         
  APAR IY94597
  Symptom: The vertical bar separating the left (Policies) and right (Object
  data) panes in policy tab of SCM 5111 GUI cannot be moved freely to the left
  or right.


3.0 BEFORE INSTALLING THIS PATCH
--------------------------------

  Before installing this patch, review the following prerequisites
  and dependencies.

  NOTE: In this README file, <scm_inst_dir> refers to the installation
        location of Tivoli Security Compliance Manager.


3.1 Review this entire document before installing

  It is important to review and understand the steps required 
  to install this patch.


3.2 Patch installation overview

  A Tivoli Security Compliance Manager environment consists of a
  server, database tables, one or more administration consoles, and
  clients.  For purposes of installing this patch, no distinction is made
  between a push client, pull client, DHCP client, proxy relay client 
  or proxy client.

  Applying this patch involves the following steps, which are
  described in detail in later sections of this README file:

     1. Backing up the data associated with the Tivoli Security
        Compliance Manager server and database.

     2. Stopping the server.

     3. Installing the patch on the server.

     4. If the DB2(R) database server is on a different system than the
        Tivoli Security Compliance Manager server, installing the patch
        on the system running the database server.

     5. Installing the patch on each system where the administration
        console and the administration utilities are used.

     6. Restarting the server.

     7. Updating the client software available on the server in order to
        enable the client auto-update processing.


3.3 Back up the Tivoli Security Compliance Manager server and database

  Before applying any maintenance or patch, back up the Tivoli
  Security Compliance Manager server and database.

  NOTE:  There is no patch uninstallation procedure. To remove the
         patch after it is installed, you must restore the database
         and the server to their state prior to installing the patch.

     1. Logon to the system as a user with administrator or
        root authority.

     2. Stop the Tivoli Security Compliance Manager server.

        AIX, Solaris, Linux:
           scmserver stop

        Windows:
           Stop the service from the Services window of
           the Control Panel or use the following command:
              net stop "SCM Server"

     3. Back up the contents of the server directory by copying the
        files in the server installation directory to another location.
        The default server installation directory is:

        AIX, Solaris, Linux:
           /opt/IBM/SCM

        Windows:
           %systemdrive%\Program Files\IBM\SCM

     4. Open a DB2 command line processing window on your DB2 database
        server system.

        AIX, Solaris, Linux:
           Log in as a user with sufficient DB2 authority to
           access the database, such as the DB2 database
           instance owner.

        Windows:
           Start the DB2 Command Line Processor from the Windows
           desktop: "Start" -> "Programs" ->  "IBM DB2" ->
           "Command Line Processor"
              or
           Set up the DB2 environment by running the db2cmd command.

     5. Back up the contents of the Tivoli Security Compliance Manager
        database.

        From the DB2 command line processor window, enter the following
        command:

           db2 "backup database jac to <backup_directory>"

        where <backup_directory> specifies an existing directory
        with sufficient space for the backup copy of the database.


4.0 INSTALLING THIS PATCH
-------------------------


  Before installing this patch, be sure that you have reviewed the
  prerequisites and have completed the backup procedure in section
  3.0, "BEFORE INSTALLING THIS PATCH".

  The patch is applied in the following order: to the server, to the
  DB2 database server (if the DB2 server is on a separate system), and
  to all systems (other than the server) with the administration utilities
  installed.  Optionally, the patch can be installed to individual client
  systems.  In general, however, the patch does not need to be installed
  to individual client systems, because they can be automatically updated
  by the server.


4.1 Installing the patch on the server

  Installing the patch on the Tivoli Security Compliance Manager server
  system updates the server component, the administration utilities
  component, and, if installed, the client component.

  To install the patch on the server system, do the following:

     1. Logon to the system as a user with administrator or
        root authority.

     2. Stop the server.  Do not restart the server until directed
        to do so in section 4.5 of this README file.

        AIX, Solaris, Linux:
           <scm_inst_dir>/server/scmserver stop

        Windows:
           Stop the service from the Services window of
           the Control Panel or use the following command:
              net stop "SCM Server"

     3. Copy the patch package to the server system.

     4. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.1-TIV-SCM-FP0005.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.1-TIV-SCM-FP0005.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.1-TIV-SCM-FP0005.<platform>.tar file if you only
        want to extract the files for a particular platform.

     5. Run the appropriate command to install the patch on the server:

           AIX system:       scmserver_fp5_aix
           Linux system:     scmserver_fp5_linux
           Solaris system:   scmserver_fp5_solaris
           Windows system:   scmserver_fp5_win32


     Note: We recommend that clients installed on the same system as
           the server have auto-update disabled.   

        The installer for this fix pack does not contain JVM. In case of ISMP
        having problems finding suitable JVM to run the installer, please use
        following syntax:

	scmserver_fp5_<platform> -is:javahome <scm_inst_dir>/_jvm-server


4.2 Installing the patch on the DB2 database server

     NOTE: The FP0005 doeas not introduce any changes to the database structure.
           You can skip this step if you have separate database server.

  If the DB2 database server is on a different system than the
  Tivoli Security Compliance Manager server, you must install the
  patch on the DB2 database server system.

     1. Ensure that the Tivoli Security Compliance Manager server
        is stopped.  Updating the database while the server is
        running might result in the loss of data.

     2. Logon to the DB2 database server system as a DB2
        administrator.

     3. Copy the patch package to the database server system.

     4. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.1-TIV-SCM-FP0005.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.1-TIV-SCM-FP0005.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.1-TIV-SCM-FP0005.<platform>.tar file if you only
        want to extract the files for a particular platform.

     5. Run the following command to install the patch:

        scmserver_fp5_<platform>

          where <platform> is one of the following:
             aix, hp11, linux, linux390, linuxppc, solaris, or win32

     6. Open a DB2 command line processing window.

        AIX, Solaris, Linux:
           Log in as a user with sufficient DB2 authority to
           access the database, such as the DB2 database
           instance owner.

        Windows:
           Start the DB2 Command Line Processor from the Windows
           desktop: "Start" -> "Programs" ->  "IBM DB2" ->
           "Command Line Processor"
              or
           Set up the DB2 environment by running the db2cmd command.


     7. Change to the <scm_inst_dir>/sql directory, which contains
        the SQL scripts that are used to update the DB2 database
        tables.

     8. Update the DB2 database tables as follows.
	
	The FP0005 doeas not introduce any changes to the database structure.


4.3 Installing the patch on systems with the administration utilities component

  The patch must be applied to every system where the administration
  utilities component is installed.  (The administration utilities component
  on the Tivoli Security Compliance Manager server system has already been
  updated, so there is no need to install the patch again on that system.)

     1. Logon to the system as a user with administrator or
        root authority.

     2. Copy the patch package to the system.

     3. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.1-TIV-SCM-FP0005.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.1-TIV-SCM-FP0005.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.1-TIV-SCM-FP0005.<platform>.tar file if you only
        want to extract the files for a particular platform.

     4. Run the following command to install the patch:

        scmserver_fp5_<platform>

          where <platform> is one of the following:
             aix, hp11, linux, linux390, linuxppc, solaris, or win32


4.4 Manually installing the patch on a client system

  This fixpack does not support manual installation on client system. Please
  distribute updates to the client through clientUpdate.jar. See section 4.6
  for further instructions.

4.5 Restarting the server

  After updating the Tivoli Security Compliance Manager server, the
  DB2 database server (if on a separate system), all systems with
  the administration utilities component installed, and those client
  systems that you wish to update manually, you must restart the
  server.

     1. Logon to the system as a user with administrator or
        root authority.

     2. Verify that the <scm_inst_dir>/server/server.ini file
        has the export.port value set to 1955. If not, change the
        value to be 1955:

                export.port=1955

     3. Restart the server.

        AIX, Solaris, Linux:
           <scm_inst_dir>/server/scmserver start

        Windows:
           Start the service from the Services window of
           the Control Panel or use the following command:
              net start "SCM Server"

  Note: As clients communicate with the upgraded server for the first time, they
  automatically download and install the new client software.


4.6 Automatically installing the patch on client systems

     NOTE:  By default, clients are permitted to automatically
            update to the version of the client component software
            provided by the server. If a client system has had
            this automatic capability disabled, use any.any.EnableClientUpdateV1
            collector to change this setting.

  To automatically update the client component on client systems,
  you must make the clientUpdate.jar file provided with this patch
  available on the server.

     1. Logon to the Tivoli Security Compliance Manager administration
        console as a user with the Super Administrator role.

     2. Click the Server tab on the administration console.

     3. Click the Client Code tab.

     4. Click Update Client Code.

     5. Select the clientUpdate.jar file provided with this patch.
        The file is located in the <scm_inst_dir>/updates
        directory.  Click Open.

     6. In the Update Client Code window, click OK to confirm
        the update.

  In general, the update of both push and pull clients should occur
  in about four hours.  However, depending on a variety of factors
  such as the number of clients to update and the network load,
  this time could be considerably more, possibly up to several hours.

  The interval that the client uses for checking for updates is
  determined by the check.interval=14400 setting in the client
  preferences file. The default value of 14400 seconds represents
  a 4 hour interval between update checks. Pull clients tend to
  take longer to upgrade than push clients.  A push client checks
  for an update when the client starts, and at the client update
  interval after that.  A pull client only checks for an update at
  the client update interval. A "soft reset request" from the
  administration console can be directed to a push client system
  that is being slow to update.


5.0 AFTER INSTALLING THIS PATCH
-------------------------------

5.1 Updating server.ini if report.sectionsList contains custom reports

     The FP05 adds one new Report Section - 'Compliance Query' to the SCM 
     reporting options. This requires change in the server.ini which is done
     automatically if the 'report.sectionList' option is not modified by user.
     After correct update the option should look like below:

     report.sectionsList=com.ibm.jac.server.report.CompliantSystemSection,com.ibm.jac.server.report.SnapshotDifferenceSection,com.ibm.jac.server.report.SummarySection,com.ibm.jac.server.report.ViolationSection,com.ibm.jac.server.report.ComplianceChecksSection
     
     If the option was modified in any way, installer skips this step and user
     must update this option manually by adding following entry at the end of
     the list (preceeding it with coma without spaces):

     com.ibm.jac.server.report.ComplianceChecksSection


5.2 Installing additional base components after installing a fix pack

     The ISMP installation maintains a file of installed product components.
     This file is called vpd.properties and can be found in the following
     locations:

            Windows:  %SystemRoot%\vpd.properties
            AIX:      /usr/lib/objrepos/vpd.properties
            Linux:    /root/vpd.properties
            HP-UX:    /vpd.properties
            Solaris:  /vpd.properties

     Each time ISMP installs a new component the version is updated. 
     The base installation that originally shipped is expecting a version of
     5.1.1.1.

     To allow the base installation to install a new component proceed with
     the following:

           1.  Backup your vpd.properties by copying it to a new location.

           2.  Edit the vpd.properties file by locating the line that 
               corresponds to the line shown in the example.  You can 
               uniquely identify the line by the following string:

               SCMProductName
            
            The example shows a version 5.1.1.5 being changed to 5.1.1.1.
            Each instance of the following separate patterns are changed: 

               5.1.1.5 to 5.1.1.1 

               |5|1|5|1| to |5|1|1|1|


            Note:  This line was split for readability in this document.
            Do not split the line in the vpd.properties file.


IBMTivoliSecurityComplianceManager|5|1|5|1|5.1.1.5|1=SCMProductName|
            IBM Tivoli Security Compliance Manager|
            IBM Tivoli Security Compliance Manager Version 5.1.1.5|
            International Business Machines, Inc.|
            http://www.ibm.com|IBMSCM511000|C:\Program Files\IBM\SCM\SCM|0|0|1|
            IBMTivoliSecurityComplianceManager|5|1|5|1|5.1.1.5|1|0|false|
            "_uninst" "uninstall.jar" "uninstall.dat" ""|true|3|
            IBMTivoliSecurityComplianceManager|5|1|5|1|5.1.1.5|1
            
            The line should be changed to look like the following by
            changing the version number patterns previously described.


IBMTivoliSecurityComplianceManager|5|1|1|1|5.1.1.1|1=SCMProductName|
            IBM Tivoli Security Compliance Manager|
            IBM Tivoli Security Compliance Manager Version 5.1.1.1|
            International Business Machines, Inc.|
            http://www.ibm.com|IBMSCM511000|D:\Program Files\IBM\SCM|0|0|1|
            IBMTivoliSecurityComplianceManager|5|1|1|1|5.1.1.1|1|0|false|
            "_uninst" "uninstall.jar" "uninstall.dat" ""|true|3|
            IBMTivoliSecurityComplianceManager|5|1|1|1|5.1.1.1|1                


        3.  Run the base installation and install the desired component(s).

        4.  Repeat step 2, this time replacing the version number patterns
            with the original values (5.1.1.5 and |5|1|5|1| in this example).  
            Be sure to only change version for the above line at this step. 
            Do not replace the version for newly installed components. 



6.0 DOCUMENTATION UPDATES
-------------------------

  The following problems with the existing documentation have
  been identified.
  
6.1 IBM Tivoli Security Compliance Manager Administration Guide

  o In Appendix A "Administration command reference"

       These options are only available with fixpack 5.1.0-TIV-SCM-FP0009 and
       later.

       scmimportpolicy  command

             -update   updates existing polices 


       scminstallcollector  command

             -force    ignores collector version number 


6.2 IBM Tivoli Security Compliance Manager Administration Guide

  o In Chapter 5 "Managing clients and client groups" in the "Displaying
    unregistered clients" section, add the following note to the beginning
    of the section.

      NOTE: The list of unregistered clients is built up over time and
      cached in the server. When the server is restarted the list is 
      rebuilt over time.

  o  In Chapter 15 "Installing and Using Proxy Relays"

     Note:  It is not recommended to configure a Proxy Relay on a client
     if that client is also a Tivoli Security Compliance Manager server.

6.3 IBM Tivoli Security Compliance Manager IISSCN Extension Release Notes

  o Replace step 10 & 11 of the ACS configuration guide with following :

    10. Next you need to add the IBM SCM attributes to the ACS. Copy the
        avplist5.txt file that is included with Tivoli Security Compliance
        Manager IISSCN Extension Pack 1 for TCM to the C:\temp directory on
        the ACS server machine.

    11. Add the IBM SCM attributes to ACS by running the following command: 

C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -addavp C:\temp\avplist5.txt 

        where avplist5.txt is a file containing the IBM SCM attribute
        information. On a ACS 4.0 system use the avplist5_40.txt file supplied
        with FP0030. Once the Tivoli Security Compliance Manager Policy Version
        and Violation Count attributes are added to the ACS server, they can be
        used along with the other Cisco posture attributes to build ACS local
        rules and a policy

  o Add following note in the 'Installation of Tivoli Security Compliance
    Manager Fix Pack 0020' section:

    WARNING: The FP0020 will break existing functionality of IISSCN for TPM
    (IISSCN extensions pack 1). To restore it's functionality with regard to 
    Cisco NAC you must install IISSCN extension 2 (for TCM) and new versions of
    IISSCN policies.

6.4 IBM Integrated Security Solution for Cisco Networks Deployment Guide

  o Add following note in the 'Installing and configuring the Tivoli Security
    Compliance Manager components' section, step 2 'Install fix pack 
    5.1.0-TIV-SCM-FP0009 on the server':
  
    ATTENTION: The IISSCN Extension for TPM requires SCM server to stay at most
    on 5.1.0-TIV-SCM-FP15. The FP20 changes handling of connection with 
    Cisco NAC subsystem and requires 'IISSCN Extensions for TCM' along with new 
    IISSCN policies  v2.0 to be installed.


6.5 Expiration of the original IBMJCE certificates.

    The JCE shipped with the SCM 5.1.1.1 contains certificates which expired on
    May 18th 2006. Although SCM itself wasn't affected by this, some of the
    collectors developed by a third party vendors uses them on. Expiration of
    the above mentioned certificates causes components relying on JCE to stop
    working. In this case we reccomend upgrade of the JCE on the SCM client to
    the version 1.2.1. The separate bundle containing JCE 1.2.1 and the
    installation instructions was prepared and is available on the SCM
    Utilities page. 

    http://www-1.ibm.com/support/docview.wss?rs=0&q1=compliance&uid=swg24007082&loc=en_US&cs=utf-8&cc=us&lang=en

    NOTE:  The SCM server uses JVM 1.4.2 which is free of this problem. 

6.6 "Installation Guide: all components" update.
    The guide does not mention requirement to have "User can login" setting
    enabled for DB2 instance owner. This is required to connect through JDBC
    from SCM Server. This requirement is valid for both local and remote
    database systems.

    Following point was added to the "Before you begin" section in "Using the
    Tivoli Security Compliance Manager database utilities" chapter:
   
    o The DB2 Instance ID must have "User can login" setting enabled.


7.0 SOFTWARE LIMITATIONS
------------------------

7.1 GUI console and SCM Server interoperability

    Due to changes implemented to fix IY92791 (collector authorization), the
    interface between GUI and server has changed. This means it is not backward
    compatible - you must use GUI 5.1.1.3 or later to connect to 5.1.1.3 or
    5.1.1.5 SCM Server and you won't be able to connect to SCM Server 5.1.1.1
    from GUI patched to 5.1.1.3 or later.



8.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
------------------------------------------------

8.1  SQL scripts might produce errors after migration

    You might see one or more errors indicating a duplicate name or that no row
    was found. These messages can be ignored.

8.2 Collector authorization management in SCM 5.1.1

    While fixing IY92791 (5.1.1 DID NOT AUTHORIZE COLLECTOR BUT STILL CAN 
    INSTALL IT AND RUN) we have found, that this was side effect of merging
    authorization and registration step of the collector lifecycle introduced
    in SCM 5.1.1.1. The fix distributed restores authorization check, but at
    the same time we have found some additional possible problems caused by this
    change. In this situation we have decided to treat fix to IY92791 as
    a temporary solution and fully restore authorization and registration
    functionality as it was in SCM 5.1.0. 
    The target date for this activity is quarterly fixpack for Q2'07.
    Here is a list of possible problems caused by fix to IY92791: 

    1. The collector installed on a system without any signatures required is 
    accessible and could be fully utilized. However in this case you won't be
    able to change system to require signatures (the system detects registered
    collector without signatures and doesn't allow such a change). There are two
    ways to solve this problem:
    - remove unsigned collector, add required signatures, install collector
    - add signatures but do not make them required, manually sign collector, 
      make signatures required (advantage - retained collector history and
      client deployment set)

    2. If you manually remove signature from signed and registered collector, it
    will remain registered and still could be fully utilized. It will be still 
    visible and active on the client it was deployed.

    3. Policy import on system without signatures required ends in collectors
    not signed and not usable. They are visible on Collectors panel. You must
    sign them (with any signature even if none are required) to register them.

    4. Policy import of policy with new versions of already registered
    collectors ends with new collectors registered but without signatures from
    previous version (consistent with SCM 5.1.0). Unfortunately they are fully
    usable in the system and doesn't get removed from clients (inconsistent with
    SCM 5.1.0)

    5. Policy icon in Policies tree on Policies tab doesn't get refreshed
    automatically if the policy has unregistered collectors. The icon is
    refreshed only after policy selection.

    6. Exporting policy which uses collectors that are not registered in system
    is not possible and ends with exception error.

    7. Import of the policy with signed collectors to the system with the same 
    signature defined results in all its collectors unregistered. There is no 
    way to sign them again using the same signature. Different (i.e. newly 
    created) signature must be used for signing.
	
    Other behaviours consistent with SCM 5.1.0:

    1. Policy with unregistered collectors could be managed (assigned to the 
    clients/groups). But the collectors are not downloaded by the clients.

    2. Collectors upgrade remove signatures assigned to old version.


8.3 Rights management in SCM 5.1.1

    The SCM 5.1.1 inherited rights management (with small changes) from previous
    version. While some new defects were found in SCM 5.1.1, the foundations
    weren't changed. The defect IY92857 fixed the problems with rights to view
    snapshot in a following way:
    
    View snapshot requires the following authority:
    - "view snapshot" on the policy allows viewing of any snapshot
    - "view" on a group/client allows viewing any snapshot which was restricted 
      to that group/client

    Additionally we have changed permissions for exporting/sending snapshots.
    So far these actions required 'View snapshots' permission. We changed it to
    export require 'Manage snapshots' to disable snapshot exporting from users
    allowed to view only.


9.0 NOTICES
------------
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Customers are responsible for ensuring their own compliance with various
laws such as the Graham-Leach-Bliley Act, the Sarbanes-Oxley Act, and the
Health Insurance Portability and Accountability Act.  It is the customer's
sole responsibility to obtain advice of competent legal counsel as to the
identification and interpretation of any relevant laws that may affect the
customer's business and any actions the customer may need to take to comply
with such laws. IBM does not provide legal, accounting or auditing advice,
or represent or warrant that its products or services will ensure that customer
is in compliance with any law.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.


9.1 Trademarks

The following terms are trademarks or registered trademarks of International
Business Machines Corporation in the United States, other countries, or both:

AIX
DB2
IBM
IBM logo
iSeries
pSeries
Tivoli
Tivoli logo
xSeries
zSeries

Java and all Java-based trademarks and logos are trademarks of Sun
Microsystems, Inc.
in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft
Corporation in the United States, other countries, or both.

Linux is a trademark of Linus Torvalds in the United States, other countries,
or both.

UNIX is a registered trademark of The Open Group in the United States and
other countries.

Other company, product, and service names may be trademarks or service marks
of others.


End of IBM Tivoli Security Compliance Manager, Patch 5.1.1-TIV-SCM-FP0005 README

