IBM(R) Tivoli(R) Security Compliance Manager, Patch 5.1.1-TIV-SCM-FP0017 README
===============================================================================

(C) Copyright International Business Machines Corporation 2007.
    All rights reserved.

U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Thursday, 27 March 2008

-------------------------------------------------------------------------------

    CONTENTS

    1.0 ABOUT THIS PATCH
        1.1 Patch contents
        1.2 Architectures
        1.3 Patches superseded
        1.4 Dependencies
    2.0 APARS AND DEFECTS FIXED
        2.1 Problems fixed by patch 5.1.1-TIV-SCM-FP0017
        2.2 Problems fixed by patch 5.1.1-TIV-SCM-FP0015
        2.3 Problems fixed by patch 5.1.1-TIV-SCM-FP0014
        2.4 Problems fixed by patch 5.1.1-TIV-SCM-FP0012
        2.5 Problems fixed by patch 5.1.1-TIV-SCM-FP0010
        2.6 Problems fixed by patch 5.1.1-TIV-SCM-FP0009
        2.7 Problems fixed by patch 5.1.1-TIV-SCM-FP0007
        2.8 Problems fixed by patch 5.1.1-TIV-SCM-FP0005
        2.9 Problems fixed by patch 5.1.1-TIV-SCM-LA0003
    3.0 BEFORE INSTALLING THIS PATCH
        3.1 Review this entire document before installing
        3.2 Patch installation overview
        3.3 Back up the Tivoli Security Compliance Manager Server and database
    4.0 INSTALLING THIS PATCH
        4.1 Prerequisities for installing this patch on system prior to FP07
        4.2 Installing the patch on the server
        4.3 Installing the patch on the DB2 database server
        4.4 Installing the patch on systems with the administration utilities
            component
        4.5 Installing this patch on a NetWare client
        4.6 Restarting the server
        4.7 Automatically installing the patch on client systems
    5.0 AFTER INSTALLING THIS PATCH
        5.1 Adjusting the number of authorizations
        5.2 Updating server.ini if report.sectionsList contains custom reports
        5.3 Installing additional base components after installing a fix pack
        5.4 Enabling data compression in transmission between SCM Client and
            SCM Server
    6.0 DOCUMENTATION UPDATES
        6.1 IBM Tivoli Security Compliance Manager Administration Guide
        6.2 IBM Tivoli Security Compliance Manager Administration Guide - new 
            options in the client.pref
        6.3 IBM Tivoli Security Compliance Manager IISSCN Extension Release 
            Notes
        6.4 IBM Integrated Security Solution for Cisco Networks Deployment Guide
        6.5 Expiration of the original IBMJCE certificates.
        6.6 "Installation Guide: all components" update.
        6.7 "TSCM 5.1.1.1 Release Notes" changes.
        6.8 New server.ini parameters 
    7.0 SOFTWARE LIMITATIONS
        7.1 GUI console or Alphablox Operational Reports vs SCM Server 
            interoperability    
    8.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
        8.1 SQL scripts might produce errors after migration
        8.2 Collector authorization management in SCM 5.1.1
        8.3 Rights management in SCM 5.1.1
        8.4 Changes in platform support for SCM Client
        8.5 Control of the Drag&Drop in SCM GUI Clients Tree
        8.6 Limit distribution of clientupdate.jar package only to clients with
            proper client version (defect 80010)
        8.7 SSL certificate expiration does not impose risk to the SCM Server
            connectivity capabilities (IZ10262)
        8.8 The scmrunpolicycollectors does not take into account subgroups 
            (d81931).    
        8.9 The messages in msgHCV_Collector*.log are not translated.
    9.0 NOTICES
        9.1 Trademarks


1.0 ABOUT THIS PATCH
--------------------
  This patch package contains fixes for problems in the IBM Tivoli Security
  Compliance Manager software. This patch requires that version 5.1.1.1 of IBM
  Tivoli Security Compliance Manager already be installed on all components to
  be patched.

1.1 Patch contents

 This patch package contains the following files:

  - This README file
  - scmserver_fp17_aix
  - scmserver_fp17_hp11
  - scmserver_fp17_linux
  - scmserver_fp17_linux390
  - scmserver_fp17_linuxppc
  - scmserver_fp17_solaris
  - scmserver_fp17_win32.exe
  - scmserver_fp17_install.jar
  - clientUpdate.jar
  - scmclient_fp17.tar
  - scmclient_fp17.zip
  - MR1031075431.README

  The following files are replaced during installation:
  - scmcli.jar
  - server.jar
  - jacgui.jar

  The following files are replaced on SCM client after LiveUpdate:
  - client.jar
  - clientPII.jar
  - ITSCMJ050101.sys

  The following files are modified during installation:
  - server.ini

  Fixes to collectors are included in a separate fixpacks. Please contact L2 to
  obtain collector fixpacks. Since publication of SCM 5.1.1.1 following 
  collector fixpacks were released:
    5.1.1-TIV-SCM-LA0004
    5.1.1-TIV-SCM-LA0008
    5.1.1-TIV-SCM-LA0011

  The FP0017 introduces one change to the database structure - column OS_VERSION
  in JAC_SYS.CLIENTS table is being extended.

1.2 Architectures

  This patch package applies to the following architectures. Systems marked with
  (*) are supported on limited, non-defect basis.
  
       Server:
        - IBM AIX(R) 5.1(*), 5.2, 5.3
        - Sun Solaris 8, 9, 10, 
        - Microsoft Windows(R) 2000 Server, Advanced Server 
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
        - Red Hat Linux(R) Advanced Server for Intel IA32 4.0
        - SUSE Linux Enterprise Server for Intel IA32 8, 9
        
       Client:
        - IBM AIX(R) 5.1(*), 5.2, 5.3
        - HP-UX 11.0, 11.23
        - i5/OS V5R3, V5R4
        - Microsoft Windows(R) NT 4.0 Server, Workstation
        - Microsoft Windows(R) 2000 Professional, Server, Advanced Server
        - Microsoft Windows(R) XP Professional w/SP2
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
        - Red Hat Linux(R) Advanced Server for Intel IA32 2.1, 3.0, 4.0
        - Red Hat Linux(R) Advanced Server for iSeries 3.0
        - Red Hat Linux(R) Advanced Server for pSeries 3.0
        - Red Hat Linux(R) Advanced Server for zSeries 3.0
        - Sun Solaris 7, 8, 9, 10
        - Sun Solaris 10 zones (certified since 5.1.1.1)
        - SUSE Linux Enterprise Server for Intel IA32 8, 9
        - SUSE Linux Enterprise Server for iSeries 8
        - SUSE Linux Enterprise Server for pSeries 8
        - SUSE Linux Enterprise Server for zSeries 8
        
       Administration console:
        - Microsoft Windows(R) 2000 Professional, Server, Advanced Server
        - Microsoft Windows(R) XP Professional w/SP2
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
       
       Administration command line
        - IBM AIX(R) 5.1(*), 5.2, 5.3
        - HP-UX 11.0, 11.23
        - Microsoft Windows(R) 2000 Professional, Server, Advanced Server
        - Microsoft Windows(R) XP Professional w/SP2
        - Microsoft Windows(R) 2003 Server Standard Edition, Enterprise Edition
        - Sun Solaris 8, 9, 10
        - Red Hat Linux(R) Advanced Server for Intel IA32 3.0, 4.0
        - SUSE Linux Enterprise Server for Intel IA32 8, 9
        - SUSE Linux Enterprise Server for iSeries 8, 9
        - SUSE Linux Enterprise Server for pSeries 8, 9


1.3 Patches superseded

  The following patches are superseded by this patch:

        5.1.1-TIV-SCM-LA0015
        5.1.1-TIV-SCM-FP0014
        5.1.1-TIV-SCM-LA0012
        5.1.1-TIV-SCM-FP0010
        5.1.1-TIV-SCM-LA0009
        5.1.1-TIV-SCM-FP0007
        5.1.1-TIV-SCM-FP0005
        5.1.1-TIV-SCM-LA0003

1.4 Dependencies

      IBM Tivoli Security Compliance Manager Version 5.1.1.1

2.0  APARS AND DEFECTS FIXED
----------------------------

2.1 Problems fixed by patch 5.1.1-TIV-SCM-FP0017

  APAR IZ15443
  Symptom: On all Windows platforms SCM Client (when run as a Win32Service)
  restarts when user is logging out. This issue affects SCM Clients in both
  5.1.0 and 5.1.1 lines.

  internal defect 82053
  Change: The resource bundles containing localized messages used for logging
  errors encountered during collector invocation were not loaded correctly
  in some cases.
 
  internal defect 81539
  Change: SCM Client is able to handle OutOfMemoryError. Error message is 
  correctly transferred to GUI and can be found in client's status log (if 'Run
  collector' action was executed) or in additional dialog (if 'Test collector'
  action was used).

  internal defect 81572
  Change: SCM Client is able to compress data returned by collectors. For 
  detailed description please refer to section 5.4.
  
  internal defect 82068 
  Change: If newer version of SCM is detected during installation, an 
  appropriate message is displayed.
  
  internal defect 82290 (MR1031075431)
  Change: New parameters for CLI command scmcreatesnapshot were added to 
  unify functionality between CLI and Administration Console. Please 
  refer to MR1031075431.README for details.
  
  internal defect 82369
  Change: Several changes to improve GUI/Server performance were introduced
  including faster policy tree expansion, snapshot extraction, choice of 
  suppression algorithm (for more details please refer to section 6.8).
  
  internal defect 82596
  Change: If scmcreatesnapshot command is used with '-file' parameter, exported
  snapshot report has correct UTF-8 encoding in both HTML and TXT format.

2.2 Problems fixed by patch 5.1.1-TIV-SCM-LA0015

  APAR IZ12158
  Symptom: The CLI command scmrunpolicycollectors performed on a group of 
  clients aborts processing if communication error is being encountered for any 
  of the clients from the group.

  APAR IZ13719
  Symptom: The CLI command scmexecutereport aborts with exception if the report
  being generated contains null fields and text format was requested.

  APAR IZ13765
  Symptom: The policies exported from SCM GUI version 5.1.1.12-14 are malformed 
  and does not retain policy parameters if reimported (regardles of the target
  SCM GUI version).
  
  internal defect 81891
  Change: The HTML report generated from CLI command scmexecutereport contained 
  duplicated results table - duplicate removed in 5.1.1.15.

  internal defect 81894
  Change: The *HCV_Server.log contains SQL exception generated during policy 
  import. However, policy was imported correctly and no data was lost and 
  database integrity was preserved. The cause for exeception was removed in 
  SCM 5.1.1.15.


2.3 Problems fixed by patch 5.1.1-TIV-SCM-FP0014

  Doc APAR IZ10262
  Symptom: The SSL certificate used by SCM Server for communication with clients
  and GUI/CLI is created to last 4 years. The Release Notes for SCM 5.1.1.1 were
  supplemented to describe keystore management in SCM 5.1.1 and other 
  information related to expired certificates management. 

  internal defect 75379, 80091	
  Change: Better handling of the NullPointerException from
  setSSLSessionCacheSize() during server start.
	
  internal defect 74654
  Change: Removed false message about Server nullpointer exception during JLOG
  processing.
	
  internal defect 75371
  Change: Following operations will mark client as unsychronized making it 
  eligible for synchronization with next ping/reset:
  - update collector from CLI,
  - update collector while importing policy bundle,
  - authorizing registered collector,
	
  internal defect 80010
  Change: Improved client LiveUpdate feature - now only special client migration
  paths are allowed. This feature helps block distributing incorrect upgrades to
  the clients. For more details see section 8.6 of this README.

  internal defect 72249
  Change: Fixed case when not registered PUSH client receives LiveUpdate 
  package.

  internal defect 72247
  Change: Added new button on Server/Client update panel to remove existing 
  clientupdate.jar from distribution. Change is applicable immediately - no 
  SCM Server restart required.

	
2.4 Problems fixed by patch 5.1.1-TIV-SCM-LA0012

  APAR IZ04588
  Symptom: The Security Index Enablement Package does not handle correctly 
  <obsoletes> tag in patch auditing feed files for Sun Solaris platform causing
  required patches to be obsoleted. This may result in missing patches not being
  reported.

  APAR IZ07513
  Symptom: The GUI console and CLI commands are ignoring SCMRMI_TIMEOUT 
  environment variable setting. Instead, rmi.timeout property from server.ini 
  (on the Server side) must be used to control timeout when connection from 
  GUI/CLI.

  APAR IZ07979
  Symptom: The Security Index Enablement Package sometimes does not handle 
  correctly cases when more than one version of the package is installed on the
  checked system. In this case there is possibility of any but the newest 
  package version being reported, thus raising false violation about missing
  packages in required version. This affects all Unix-like platforms.
  
  internal defect 72036
  Change: In Administration Console, on Proxies panel, the 'Remove path' button
  is now active if there is only one proxy path defined.

  internal defect 78247
  Change: The policy exporting procedure was incorrectly using XML escape
  sequences causing exported policy to be invalid XML bytestream. The procedure
  was stabilized to produce consistent and correct exports.

  internal defect 79088
  Change: The SCM Cient was sending malformed error message in case of 
  OutOfMemoryError happening during collector execution (on the client side).
  The error message causes SQL error during processing on the SCM server side
  and the error message is not saved in JAC_SYS.ERROR_LOG table. 
  To correct this issue, the error message structure was fixed.

  internal defect 79368
  Change: The SQL exceptions during DB2 connection initialization are now logged
  into HCV files.

  internal defect 79488
  Change: The data structure used for keeping info about all active clients is 
  now properly synchronized among threads, including ServerLeaseThread.



2.5 Problems fixed by patch 5.1.1-TIV-SCM-FP0010

  APAR IZ00706
  Symptom: After upgrade of any collector to new version, the new fields 
  introduced into result tables are not visible for compliance queries.

  Doc APAR IZ03052
  Problem: The Release Notes for SCM 5.1.1.1 states that SCM Client is supported
  on following platforms SuSE 9 on pSeries, iSeries, zSeries.
  This is incorrect, as ther is no way to install required Java version (1.3.1)
  on those platforms. 

  APAR IZ04020
  Symptom: Change of one collector parameter discards other parameters' values.
  This persists until client contacts server twice (two pings or two resets).

  APAR IZ04022
  Symptom: Registeration of multiple clients using CLI command scmregisterclient
  with CSV input file (containing list of clients) is not reporting errors 
  if there are lines with wrong syntax.
  It is impossible to register a client with '255' as last octet in IP address.

  Doc APAR IZ05320
  Problem: The Release Notes for SCM 5.1.1.1 states that Novell Netware 6.5 is 
  supported platform for SCM Client. This is incorrect, as ther is no way to 
  install required Java version (1.3.1) on Novell Netware 6.5. 

  internal defect 71702
  Change: Fixed not functioning remove toolbar button for multiple client groups
  selected on the Clients/Groups tree.

  internal defects 71714, 78223
  Change: Fixed problem with PULL-type clients turn into inactive state after 
  performing 'Soft reset' action from Adminstration Console.

  internal defect 72231
  Change: Fixed problem with missing 'Tools' menu after upgrade to SCM 5.1.1.1.
  If the 'Tools' menu was not displayed before migration to 5.1.1.x, it 
  would not appear after starting updated Administration Console.

  internal defect 76770
  Change: Fixed problem with the 'collector.debug' key not working (not enabling
  additional debug info) on SCM Clients.

  internal defect 77997
  Change: Sometimes SCM client is unable to start during startup of Novell 
  system if the system is heavily loaded.

  internal defect 78025
  Change: Limit number of exceptions logged during SCM client disconnection from
  server on Novell 6.5 platform (Java 1.4.2 for Novell specyfic). 

  internal defect 78269
  Change: Introduced entry in console configuration file to control activity of
  Drag and Drop in Clients tree.


2.6 Problems fixed by patch 5.1.1-TIV-SCM-LA0009

  APAR IZ02623
  Symptom: The SCM Client version 5.1.0.2 and later does not release connection
  to the server (in PUSH mode) if server is experiencing IO errors on this 
  connection.

2.7 Problems fixed by patch 5.1.1-TIV-SCM-FP0007

  APAR IY97972
  Symptom: In the SCM 5.1.1 SQL statements containing comments cause exceptions

  APAR IY98541
  Symptom: The SCM 5.1.1 fails to import policy with UTFDataFormatException if 
  it contains characters from outside of the ASCII range.

  APAR IY98718
  Symptom: The SCM 5.1.1 fails with StringIndexOutOfBoundsException while
  creating snapshot.

  APAR IY99000
  Symptom: The SCM 5.1.1 does not apply limitations on the data validity from
  the "Expires after (days)" field.

  APAR IZ00056
  Symptom: In the SCM 5.1.1 the policy parameter of single quote (') causes 
  snapshot to fail with StringIndexOutOfBoundsException.

  internal defect 76012
  Change: New client.pref key 'client.debug' was introduced to control debugging
  output from collectors (see 6.3).

  internal defect 76026
  Change: Authorization handling, see section 8.2

  internal defect 76073
  Change: The SCM Server version is now presented on the server's Status panel
  in Administration Console (GUI)
  
  internal defect 76381
  Symptom: While compliance query SQL was containing table name that was not 
  correct (ex. spelling error) that mistake was not reported and might efect in 
  compliace state of evaluated compliance query. 

2.8 Problems fixed by patch 5.1.1-TIV-SCM-FP0005

  Doc APAR IY95309
  Problem: Policy collector icon dissapears after upgrade to 
  5.1.0-TIV-SCM-FP0020 or later on clients using IISSCN extension.

  APAR IY95471
  Symptom: In the SCM 5.1.1.1 mouse icon does not change to hour glass when
  expanding Snapshots folder on Policies tab.

  APAR IY95561
  Symptom: In the SCM 5.1.1.1 on Clients tab clients and groups are
  alphabetically sorted making them appear interspersed.

  APAR IY96084
  Symptom: In the SCM 5.1.1.1 no clients are listed under All or Inactive group
  on Clients tab, but clients do appear under individual groups.

  internal defect 72244
  Symptom: When importing policy, the collector schedule could be edited, while
  policy collectors does not have their own schedules.

  internal defect 74720
  Symptom: The default expiration date for new suppresion is set to 1st January
  2006 making it immediately expired.

  internal defect 75146
  Symptom: When transfering large amounts of data collected, SCM client throws
  OutOfMemoryException causing JVM to throw javadump and abort data processing.

  internal defect 75243
  Symptom: Information panel Roles on Users tab does not move freely.

  internal defect 75405
  Symptom: New report section 'Compliance Query' was introduced. 
 
  internal defect 75470
  Symptom: SCM GUI throws NullPointerException if no section was chosen during
  snapshot export.
  

2.9 Problems fixed by patch 5.1.1-TIV-SCM-LA0003

  APAR IY92791
  Symptom: In the SCM 5.1.1.x you can deploy on clients and run unathorized
  collector.

  APAR IY92857
  Symptom: User without permissions can view snapshots in SCM 5.1.1.0.

  APAR IY93780
  Symptom: The snapshot generation fails on SCM Server 5.1.0.29 with error: 
  Can't find resource for bundle com.ibm.jac.msg.PolicyMessages.

  APAR IY94458
  Symptom: The user with two roles assigned has no access to the clients in
  groups if both roles have "Database Read Access" permission on the "Default
  Server Object". Related to both SCM 5.1.0 and SCM 5.1.1 lines.
         
  APAR IY94597
  Symptom: The vertical bar separating the left (Policies) and right (Object
  data) panes in policy tab of SCM 5111 GUI cannot be moved freely to the left
  or right.


3.0 BEFORE INSTALLING THIS PATCH
--------------------------------

  Before installing this patch, review the following prerequisites
  and dependencies.

  NOTE: In this README file, <scm_inst_dir> refers to the installation
        location of Tivoli Security Compliance Manager.


3.1 Review this entire document before installing

  It is important to review and understand the steps required 
  to install this patch.


3.2 Patch installation overview

  A Tivoli Security Compliance Manager environment consists of a
  server, database tables, one or more administration consoles, and
  clients.  For purposes of installing this patch, no distinction is made
  between a push client, pull client, DHCP client, proxy relay client 
  or proxy client.

  Applying this patch involves the following steps, which are
  described in detail in later sections of this README file:

     1. Backing up the data associated with the Tivoli Security
        Compliance Manager server and database.

     2. Decreasing to 0 number of signatures required for collectors.

     3. Stopping the server.

     4. Installing the patch on the server.

     5. If the DB2(R) database server is on a different system than the
        Tivoli Security Compliance Manager server, installing the patch
        on the system running the database server.

     6. Installing the patch on each system where the administration
        console and the administration utilities are used.

     7. Restarting the server.

     8. Updating the client software available on the server in order to
        enable the client auto-update processing.
	
     9. Adjusting the number of signatures required for collectors to the
        original value.


3.3 Back up the Tivoli Security Compliance Manager server and database

  Before applying any maintenance or patch, back up the Tivoli
  Security Compliance Manager server and database.

  NOTE:  There is no patch uninstallation procedure. To remove the
         patch after it is installed, you must restore the database
         and the server to their state prior to installing the patch.

     1. Logon to the system as a user with administrator or
        root authority.

     2. Stop the Tivoli Security Compliance Manager server.

        AIX, Solaris, Linux:
           scmserver stop

        Windows:
           Stop the service from the Services window of
           the Control Panel or use the following command:
              net stop "SCM Server"

     3. Back up the contents of the server directory by copying the
        files in the server installation directory to another location.
        The default server installation directory is:

        AIX, Solaris, Linux:
           /opt/IBM/SCM

        Windows:
           %systemdrive%\Program Files\IBM\SCM

     4. Open a DB2 command line processing window on your DB2 database
        server system.

        AIX, Solaris, Linux:
           Log in as a user with sufficient DB2 authority to
           access the database, such as the DB2 database
           instance owner.

        Windows:
           Start the DB2 Command Line Processor from the Windows
           desktop: "Start" -> "Programs" ->  "IBM DB2" ->
           "Command Line Processor"
              or
           Set up the DB2 environment by running the db2cmd command.

     5. Back up the contents of the Tivoli Security Compliance Manager
        database.

        From the DB2 command line processor window, enter the following
        command:

           db2 "backup database jac to <backup_directory>"

        where <backup_directory> specifies an existing directory
        with sufficient space for the backup copy of the database.


4.0 INSTALLING THIS PATCH
-------------------------


  Before installing this patch, be sure that you have reviewed the
  prerequisites and have completed the backup procedure in section
  3.0, "BEFORE INSTALLING THIS PATCH".

  The patch is applied in the following order: to the server, to the
  DB2 database server (if the DB2 server is on a separate system), and
  to all systems (other than the server) with the administration utilities
  installed.  The patch can be installed to individual client systems using 
  LiveUpdate feature (direct update through installer is not supported).  


4.1 Prerequisities for installing this patch on system prior to FP07

  NOTE:     As this fixpack contains all the changes introduced in FP07, you 
            have to apply those changes if you are upgrading from version up to 
            5.1.1.5 (FP05 or earlier). You can skip this step if upgrading from 
            FP07 onwards.

  The FP07 introduces changes to the authorization and registration of the 
  collectors to make them more unified across whole SCM system. To retain 
  coherent system state after FP07 application the SCM Server must have number 
  of signatures required to authorize collector temporarily decreased to 0
  before applying FP07. After successful fixpack installation this number can be
  set back to the required level.
  
  To set the number of signatures required to authorize collector do the
  following:

  1. Logon to the SCM GUI as a user with Administration privileges.
  2. On the Security Tab navigate to the Collectors Panel.
  3. Set the number of "Signatures required" on the Authorizers section to 0.
  4. Commit changes using Apply button.
  5. Close GUI. 


4.2 Installing the patch on the server

  Installing the patch on the Tivoli Security Compliance Manager server
  system updates the server component, the administration utilities
  component, and, if installed, the client component.

  To install the patch on the server system, do the following:

     1. Logon to the system as a user with administrator or
        root authority.

     2. Stop the server.  Do not restart the server until directed
        to do so in section 4.5 of this README file.

        AIX, Solaris, Linux:
           <scm_inst_dir>/server/scmserver stop

        Windows:
           Stop the service from the Services window of
           the Control Panel or use the following command:
              net stop "SCM Server"

     3. Copy the patch package to the server system.

     4. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.1-TIV-SCM-FP0017.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.1-TIV-SCM-FP0017.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.1-TIV-SCM-FP0017.<platform>.tar file if you only
        want to extract the files for a particular platform.

     5. Run the appropriate command to install the patch on the server:

           AIX system:       scmserver_fp17_aix
           Linux system:     scmserver_fp17_linux
           Solaris system:   scmserver_fp17_solaris
           Windows system:   scmserver_fp17_win32


     Note: We recommend that clients installed on the same system as
           the server have auto-update disabled.   

        The installer for this fix pack does not contain JVM. In case of ISMP
        having problems finding suitable JVM to run the installer, please use
        following syntax:

	scmserver_fp17_<platform> -is:javahome <scm_inst_dir>/_jvm-server


4.3 Installing the patch on the DB2 database server

  If the DB2 database server is on a different system than the
  Tivoli Security Compliance Manager server, you must install the
  patch on the DB2 database server system.

     1. Ensure that the Tivoli Security Compliance Manager server
        is stopped.  Updating the database while the server is
        running might result in the loss of data.

     2. Logon to the DB2 database server system as a DB2
        administrator.

     3. Copy the patch package to the database server system.

     4. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.1-TIV-SCM-FP0017.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.1-TIV-SCM-FP0017.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.1-TIV-SCM-FP0017.<platform>.tar file if you only
        want to extract the files for a particular platform.

     5. Run the following command to install the patch:

        scmserver_fp17_<platform>

          where <platform> is one of the following:
             aix, hp11, linux, linux390, linuxppc, solaris, or win32

     6. Open a DB2 command line processing window.

        AIX, Solaris, Linux:
           Log in as a user with sufficient DB2 authority to
           access the database, such as the DB2 database
           instance owner.

        Windows:
           Start the DB2 Command Line Processor from the Windows
           desktop: "Start" -> "Programs" ->  "IBM DB2" ->
           "Command Line Processor"
              or
           Set up the DB2 environment by running the db2cmd command.


     7. Change to the <scm_inst_dir>/sql directory, which contains
        the SQL scripts that are used to update the DB2 database
        tables.

     8. Update the DB2 database tables as follows.
	
	introduced in FP017:
        Extending the JAC_SYS.CLIENTS.OS_VERSION column:

        To run the create snapshot clients script, enter the following 
        command in the DB2 command processing window:

                    db2 -tvf migrate_51114_to_51117.sql

                    Note: This script will make the following change:
                          JAC_SYS.CLIENTS.OS_VERSION column increased to 100
 			  (related to support of new SCM Client platforms)


4.4 Installing the patch on systems with the administration utilities component

  The patch must be applied to every system where the administration
  utilities component is installed.  (The administration utilities component
  on the Tivoli Security Compliance Manager server system has already been
  updated, so there is no need to install the patch again on that system.)

     1. Logon to the system as a user with administrator or
        root authority.

     2. Copy the patch package to the system.

     3. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.1-TIV-SCM-FP0017.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.1-TIV-SCM-FP0017.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.1-TIV-SCM-FP0017.<platform>.tar file if you only
        want to extract the files for a particular platform.

     4. Run the following command to install the patch:

        scmserver_fp17_<platform>

          where <platform> is one of the following:
             aix, hp11, linux, linux390, linuxppc, solaris, or win32


4.5 Manually installing the patch on a client system

  This fixpack does not support manual installation on client system with ISMP 
  based installer. Instead we provide two files scmclient_fp17.tar and 
  scmclient_fp17.zip for (respectively) Unix-like and Windows systems.
  Those archives contain all the SCM Client files changed since SCM 5.1.1.1 and 
  could be used to upgrade any SCM Client from version 5.1.1.1 onwards directly 
  to version 5.1.1.17.
  
  The archives contains three files in two directories:
  jars/client.jar
       clientPII.jar
  client/ITSCMJ050101.sys

  To manually upgrade SCM client to version 5.1.1.17:
  
     1. Stop SCM Client.

     2. Backup current content of the $SCM_HOME (%SCM_HOME% on Windows platform)
        directory.

     3. Extract archives (preserving directory structure) to temporary location.

     4. Copy extracted files into respective directories in current SCM Client 
        installation directory. 

     5. Start SCM Client.


4.6 Restarting the server

  After updating the Tivoli Security Compliance Manager server, the
  DB2 database server (if on a separate system), all systems with
  the administration utilities component installed, and those client
  systems that you wish to update manually, you must restart the
  server.

     1. Logon to the system as a user with administrator or
        root authority.

     2. Verify that the <scm_inst_dir>/server/server.ini file
        has the export.port value set to 1955. If not, change the
        value to be 1955:

                export.port=1955

     3. Restart the server.

        AIX, Solaris, Linux:
           <scm_inst_dir>/server/scmserver start

        Windows:
           Start the service from the Services window of
           the Control Panel or use the following command:
              net start "SCM Server"

  Note: As clients communicate with the upgraded server for the first time, they
  automatically download and install the new client software.


4.7 Automatically installing the patch on client systems

     NOTE:  By default, clients are permitted to automatically
            update to the version of the client component software
            provided by the server. If a client system has had
            this automatic capability disabled, use any.any.EnableClientUpdateV1
            collector to change this setting.

     NOTE:  To control remotely eligibility of the SCM Client installation for 
            upgrade you may use any.any.EnableClientUpdateV1 and 
            any.any.DisableClientUpdateV1 collectors. 
            For details of the usage of those collectors please refer to 
            "Collector and Message Reference" chapter Maintenance collectors.

  WARNING:  The clientUpdate.jar distributed with FP17 can be applied only to 
            SCM Client systems from version 5.1.1.1 onward. The upgrade from 
            versions 5.1.0.x is not supported and will break clients.
            To migrate SCM Clients from 5.1.0 line to 5.1.1 please use 
            clientUpdate.jar from release 5.1.1.1.

  To automatically update the client component on client systems,
  you must make the clientUpdate.jar file provided with this patch
  available on the server.

     1. Logon to the Tivoli Security Compliance Manager administration
        console as a user with the Super Administrator role.

     2. Click the Server tab on the administration console.

     3. Click the Client Code tab.

     4. Click Update Client Code.

     5. Select the clientUpdate.jar file provided with this patch.
        The file is located in the <scm_inst_dir>/updates
        directory.  Click Open.

     6. In the Update Client Code window, click OK to confirm
        the update.

  In general, the update of both push and pull clients should occur
  in about four hours.  However, depending on a variety of factors
  such as the number of clients to update and the network load,
  this time could be considerably more, possibly up to several hours.

  The interval that the client uses for checking for updates is
  determined by the check.interval=14400 setting in the client
  preferences file. The default value of 14400 seconds represents
  a 4 hour interval between update checks. Pull clients tend to
  take longer to upgrade than push clients.  A push client checks
  for an update when the client starts, and at the client update
  interval after that.  A pull client only checks for an update at
  the client update interval. A "soft reset request" from the
  administration console can be directed to a push client system
  that is being slow to update.


5.0 AFTER INSTALLING THIS PATCH
-------------------------------

5.1 Adjusting the number of authorizations

  WARNING: As this fixpack contains all the changes introduced in FP07, it is 
           recommended to follow this step in you are upgrading from version up
           to 5.1.1.5 (FP05 or earlier). You can skip this step if upgrading 
           from FP07 onwards.

  It is recommended to adjust number of required signatures for collector
  authorization after successfull installation of the FP07. 

  To set the number of signatures required to authorize collector do the
  following:

  1. Logon to the SCM GUI as a user with Administration privileges.
  2. On the Security Tab navigate to the Collectors Panel.
  3. Set the number of "Signatures required" on the Authorizers section to 
     required level.
  4. Commit changes using Apply button.
  5. The SCM will detect all installed collectors without required number of 
     signatures. Please sign them with required number of signatures and try 
     again the procedure from step 2.
  6. After successful application of changes close GUI. 


5.2 Updating server.ini if report.sectionsList contains custom reports

     NOTE: This step does not apply for upgrades from FP05.

  The FP07 adds one new Report Section - 'Compliance Query' to the SCM reporting
  options. This requires change in the server.ini which is done automatically if
  the 'report.sectionList' option is not modified by user.
  After correct update the option should look like below:

  report.sectionsList=com.ibm.jac.server.report.CompliantSystemSection,com.ibm.jac.server.report.SnapshotDifferenceSection,com.ibm.jac.server.report.SummarySection,com.ibm.jac.server.report.ViolationSection,com.ibm.jac.server.report.ComplianceChecksSection
     
  If the option was modified in any way, installer skips this step and user must
  update this option manually by adding following entry at the end of the list 
  (preceding it with coma without spaces):

     com.ibm.jac.server.report.ComplianceChecksSection


5.3 Installing additional base components after installing a fix pack

  The ISMP installation maintains a file of installed product components.
  This file is called vpd.properties and can be found in the following
  locations:

            Windows:  %SystemRoot%\vpd.properties
            AIX:      /usr/lib/objrepos/vpd.properties
            Linux:    /root/vpd.properties
            HP-UX:    /vpd.properties
            Solaris:  /vpd.properties

  Each time ISMP installs a new component the version is updated. 
  The base installation that originally shipped is expecting a version of
  5.1.1.1.

  To allow the base installation to install a new component proceed with
  the following:

           1.  Backup your vpd.properties by copying it to a new location.

           2.  Edit the vpd.properties file by locating the line that 
               corresponds to the line shown in the example.  You can 
               uniquely identify the line by the following string:

               SCMProductName
            
            The example shows a version 5.1.1.5 being changed to 5.1.1.1.
            Each instance of the following separate patterns are changed: 

               5.1.1.5 to 5.1.1.1 

               |5|1|5|1| to |5|1|1|1|


            Note:  This line was split for readability in this document.
            Do not split the line in the vpd.properties file.


IBMTivoliSecurityComplianceManager|5|1|5|1|5.1.1.5|1=SCMProductName|
            IBM Tivoli Security Compliance Manager|
            IBM Tivoli Security Compliance Manager Version 5.1.1.5|
            International Business Machines, Inc.|
            http://www.ibm.com|IBMSCM511000|C:\Program Files\IBM\SCM\SCM|0|0|1|
            IBMTivoliSecurityComplianceManager|5|1|5|1|5.1.1.5|1|0|false|
            "_uninst" "uninstall.jar" "uninstall.dat" ""|true|3|
            IBMTivoliSecurityComplianceManager|5|1|5|1|5.1.1.5|1
            
            The line should be changed to look like the following by
            changing the version number patterns previously described.


IBMTivoliSecurityComplianceManager|5|1|1|1|5.1.1.1|1=SCMProductName|
            IBM Tivoli Security Compliance Manager|
            IBM Tivoli Security Compliance Manager Version 5.1.1.1|
            International Business Machines, Inc.|
            http://www.ibm.com|IBMSCM511000|D:\Program Files\IBM\SCM|0|0|1|
            IBMTivoliSecurityComplianceManager|5|1|1|1|5.1.1.1|1|0|false|
            "_uninst" "uninstall.jar" "uninstall.dat" ""|true|3|
            IBMTivoliSecurityComplianceManager|5|1|1|1|5.1.1.1|1                


        3.  Run the base installation and install the desired component(s).

        4.  Repeat step 2, this time replacing the version number patterns
            with the original values (5.1.1.5 and |5|1|5|1| in this example).  
            Be sure to only change version for the above line at this step. 
            Do not replace the version for newly installed components. 

5.4 Enabling data compression in transmission between SCM Client and SCM Server

  Since version 5.1.1.17 of SCM Client, a new feature is available to limit
  amount of data transferred between SCM Client and Server. Under 'queue' stanza
  new configuration parameter was introduced: 

  compress.message=[true|false]

  By default this parameter is set to 'false'. If set to 'true', data returned
  by collector will be send to server in compressed form. Note, that only SCM
  Server 5.1.1.17 and newer is able to receive this type of message.
  
  SCM Server that supports compressed messages supports also old communication
  type. As only the collector data returned by client is compressed, every 
  control message remains unchanged. In case of accidental switching 
  compress.message parameter to 'true', SCM Client connected to SCM Server 
  older that 5.1.1.17, still remains operational - only data packages will be
  unreadable.
  
  To automatically control messages compression, a collector 
  any.any.MessagesCompressionV1 was created.


6.0 DOCUMENTATION UPDATES
-------------------------

  The following problems with the existing documentation have
  been identified.
  
6.1 IBM Tivoli Security Compliance Manager Administration Guide

  o In Appendix A "Administration command reference"

       These options are only available with fixpack 5.1.0-TIV-SCM-FP0009 and
       later.

       scmimportpolicy  command

             -update   updates existing polices 


       scminstallcollector  command

             -force    ignores collector version number 

  o In Chapter 5 "Managing clients and client groups" in the "Displaying
    unregistered clients" section, add the following note to the beginning
    of the section.

      NOTE: The list of unregistered clients is built up over time and
            cached in the server. When the server is restarted the list is 
            rebuilt over time.

  o  In Chapter 15 "Installing and Using Proxy Relays"

     Note:  It is not recommended to configure a Proxy Relay on a client
     if that client is also a Tivoli Security Compliance Manager server.

6.2 IBM Tivoli Security Compliance Manager Administration Guide - new 
    client.pref options

    1. The internal defects d76012, d76770 (related to IY99409) introduced new 
    way to control debug output in the jacclient.log on the Unix-like platforms.

    There is new key defined in the client.pref called 'collector.debug' in the
    debug stanza, with default value 'false' - turns off logging data from the 
    Logger. If user needs (for diagnostic purposes) to enable logging, then this
    key should be set to 'true'. 

    For Windows platforms additional step is required - SCM client must be run 
    form command line using command jac.bat. To save output for further analysis
    by L2/L3 please redirect output of this command to file, i.e.:
    
    jac.bat > client_stdout.log

    For list of the collectors supporting this debug output and ways to enable 
    this in SCM Client versions prior to SCM 5.1.1.7 please contact L2/L3.

    2. The internal defect d81572 introduced ability to compress collected data
    being sent back from SCM Client to SCM Server:

    [queue]
    compress.message=[true|false]
    
    For more details see section 5.4.


6.3 IBM Tivoli Security Compliance Manager IISSCN Extension Release Notes

  o Replace step 10 & 11 of the ACS configuration guide with following :

    10. Next you need to add the IBM SCM attributes to the ACS. Copy the
        avplist5.txt file that is included with Tivoli Security Compliance
        Manager IISSCN Extension Pack 1 for TCM to the C:\temp directory on
        the ACS server machine.

    11. Add the IBM SCM attributes to ACS by running the following command: 

C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -addavp C:\temp\avplist5.txt 

        where avplist5.txt is a file containing the IBM SCM attribute
        information. On a ACS 4.0 system use the avplist5_40.txt file supplied
        with 5.1.0-TIV-SCM-FP0030. Once the Tivoli Security Compliance Manager
        Policy Version and Violation Count attributes are added to the ACS 
        server, they can be used along with the other Cisco posture attributes
        to build ACS local rules and a policy

  o Add following note in the 'Installation of Tivoli Security Compliance
    Manager Fix Pack 5.1.0-TIV-SCM-0020' section:

    WARNING: The 5.1.0-TIV-SCM-FP0020 will break existing functionality of 
             IISSCN for TPM (IISSCN extensions pack 1). To restore it's
             functionality with regard to Cisco NAC you must install IISSCN 
             extension 2 (for TCM) and new versions of IISSCN policies.

6.4 IBM Integrated Security Solution for Cisco Networks Deployment Guide

  o Add following note in the 'Installing and configuring the Tivoli Security
    Compliance Manager components' section, step 2 'Install fix pack 
    5.1.0-TIV-SCM-FP0009 on the server':
  
    ATTENTION: The IISSCN Extension for TPM requires SCM server to stay at most
    on 5.1.0-TIV-SCM-FP15. The FP20 changes handling of connection with 
    Cisco NAC subsystem and requires 'IISSCN Extensions for TCM' along with new 
    IISSCN policies  v2.0 to be installed.


6.5 Expiration of the original IBMJCE certificates.

    The JCE shipped with the SCM 5.1.1.1 contains certificates which expired on
    May 18th 2006. Although SCM itself wasn't affected by this, some of the
    collectors developed by a third party vendors uses them on. Expiration of
    the above mentioned certificates causes components relying on JCE to stop
    working. In this case we recommend upgrade of the JCE on the SCM client to
    the version 1.2.1. The separate bundle containing JCE 1.2.1 and the
    installation instructions was prepared and is available on the SCM
    Utilities page. 

    http://www-1.ibm.com/support/docview.wss?rs=0&q1=compliance&uid=swg24007082&loc=en_US&cs=utf-8&cc=us&lang=en

    NOTE:  The SCM server 5.1.1.x uses JVM 1.4.2 which is free of this problem. 

6.6 "Installation Guide: all components" update.

    The guide does not mention requirement to have "User can login" setting
    enabled for DB2 instance owner. This is required to connect through JDBC
    from SCM Server. This requirement is valid for both local and remote
    database systems.

    Following point was added to the "Before you begin" section in "Using the
    Tivoli Security Compliance Manager database utilities" chapter:
   
    o The DB2 Instance ID must have "User can login" setting enabled.

6.7 "TSCM 5.1.1.1 Release Notes" changes.

  WARNING: The new version v2.2 of the "TSCM 5.1.1.1 Release Notes" containing 
           all below mentioned changes is available on the Information center 
           web site:

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?toc=/com.ibm.itscm.doc_5.1/toc.xml

    1. Supported Operating Systems (Chapter 2)
       
       Following systems were incorrectly claimed as supported in the SCM Client
       section:

       SuSE Linux 9 for pSeries
       SuSE Linux 9 for iSeries
       SuSE Linux 9 for zSeries(*)
       Novell NetWare 6.5(*)
 
       (*) - for those systems there is workaround available (install SCM Client
       using Java 1.4.2). For more details please contact L2 support. 

    2. New installation - Novell NetWare client component support (Chapter 2)

       This section was adjusted to provide description of the installation 
       process using Java 1.4.2.

    3. Upgrade of the Tivoli SCM Server, Administration utilities, and Database
       utilities (Chapter 2)

       Added reference to upgrade instructions on remote database systems.

    4. Database Was not properly migrated when upgrading from SCM 5.1 to 5.1.1.1
       (Chapter 5)

       Added Unix command: 
       db2 -tvf sql/migrate_51027_to_5110.sql > migrate.log


6.8 New server.ini parameters 

  In 5.1.1-TIV-SCM-FP0017 new configuration parameter was introduced to 
  server.ini to control suppressions handling:
 
  suppressions.use510=[true|false]

  If set to 'false' suppressions calculations works as in 5.1.1.1 (default 
  setting).
  If set to 'true' suppressions calculations works as in 5.1.0.x line.  



7.0 SOFTWARE LIMITATIONS
------------------------

7.1 GUI console or Alphablox Operational Reports vs SCM Server interoperability

    Due to changes implemented to fix:
    - IY92791 and d76026 (collector authorization), LA03, FP05
    - IZ07513 (SCMRMI_TIMEOUT), LA012 

    the interface between GUI and SCM Server has changed and it is not 
    compatible between all the releases since 5.1.1.1 versions. 

    The changes also affects Alphablox Operational Reports - the *.war file 
    deployed must be synchronized with SCM Server version. If the *.war version 
    is not synchronized, problems/errors may arise when logging into the 
    Operational Reports console.   

    Current compatibility matrix for SCM looks like below:

                  +-------------------------------------+
                  |                  SCM                |
                  +---------+---------+-------+---------+
                  | 5.1.1.1 |LA03-FP05|FP07-10|LA12-FP17|
    +---+---------+---------+---------+-------+---------+
    |   | 5.1.1.1 |    ok   |         |       |         |
    |   |---------+---------+---------+-------+---------+
    |GUI|LA03-FP05|         |    ok   |       |         |
    |   |---------+---------+---------+-------+---------+
    |AOR| FP07-10 |         |         |   ok  |         |
    |   |---------+---------+---------+-------+---------+
    |   |LA12-FP17|         |         |       |    ok   |
    +---+---------+---------+---------+-------+---------+



8.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
------------------------------------------------

8.1  SQL scripts might produce errors after migration

    You might see one or more errors indicating a duplicate name or that no row
    was found. These messages can be ignored.

8.2 Collector authorization management in SCM 5.1.1

    While fixing IY92791 (5.1.1 DID NOT AUTHORIZE COLLECTOR BUT STILL CAN 
    INSTALL IT AND RUN) we have found, that this was side effect of merging
    authorization and registration step of the collector lifecycle introduced
    in SCM 5.1.1.1. The fix distributed restores authorization check, but at
    the same time we have found some additional possible problems caused by this
    change. In this situation we have decided to treat fix to IY92791 as
    a temporary solution and restore authorization and registration 
    functionality in Q2 fixpack.
	
    Installation remarks 
	
    Before starting installation of FP07 it is required to set to zero 
    requirements of signatures for both collectors' providers and authorizers. 
    This can be done on Security panel in Administration Console (see 4.1). 
    If above change is not done, installer will ask user for performing those
    actions and allow fix pack package to update installation to SCM 5.1.1.7. 
    After installation we recommend to change back numbers of signatures to 
    desired values (see 5.1).

    Behaviour of SCM 5.1.1.7 in the authorization scope
	
    Restored authorization and registration functionality allows administrator
    to use additional key to sign collectors before deployment on SCM clients. 
	
    1. In 5.1.1.7 collector is automatically registered/unregistered based on
    its signatures and current security settings. Unregistered collector cannot
    be deployed on client or assigned to client groups. It can be only used in
    policies but policy will remain unusable (no deployment, no snapshot
    functionality) until its all collectors will be registered.
	
    2. Policy that contains unregistered collectors can be exported from SCM
    both to '.pol' or '.xml' file. During policy import process SCM will try to 
    register collectors. Those which will not fulfill security requirements will
    remain unregistered. 
	
    3. Policy without all collectors registered will be indicated by question 
    mark icon in the policy tree on Policy panel. Such a policy will not appear
    in 'Add policy' dialog box on Clients panel. Administrator will not be able 
    to create new snapshot on this policy - dialog box with 'Invalid
    prerequisites' message will appear.
	
    4. Administrator can change signatures of collectors that are part of policy.
    If one of policy's collector that was deployed on clients (assigned to 
    client group) becomes 'unregistered', policy IS NOT REMOVED from client
    group. It (policy) only becomes 'invalid' (icon with question mark). After 
    collector registration policy reverts back to 'valid' state.
	
    5. If a single collector is deployed on a client (or assigned to a client
    group) and administrator removes its signatures, this will result in placing
    collector in unregistered state and collector instance IS REMOVED from
    deployed client.

    6. While removing signature from collector (Collector panel) dialog box
    listing collector usage in SCM (policy, client, client groups assignment)
    is displayed.
	
    Collector in unregistered state after update
	
    Collector without signatures that was in unregistered state before 
    installation of FP07 will remain unregistered after update even if
    signatures requirements are set to zero. This is the only situation when
    SCM administrator is obliged to sign this collector with additional key just
    to allow SCM to perform registration check and register collector.


8.3 Rights management in SCM 5.1.1

    The SCM 5.1.1 inherited rights management (with small changes) from previous
    version. While some new defects were found in SCM 5.1.1, the foundations
    weren't changed. The defect IY92857 fixed the problems with rights to view
    snapshot in a following way:
    
    View snapshot requires the following authority:
    - "view snapshot" on the policy allows viewing of any snapshot
    - "view" on a group/client allows viewing any snapshot which was restricted 
      to that group/client

    Additionally we have changed permissions for exporting/sending snapshots.
    So far these actions required 'View snapshots' permission. We changed it to
    export require 'Manage snapshots' to disable snapshot exporting from users
    allowed to view only.


8.4 Changes in platform support for SCM Client

    The SCM 5.1.1.1 incorrectly claims support for following platforms, which 
    was corrected in two DOC APARs (IZ03052 and IZ05320). For two of those 
    platforms (SuSE 9 on zSeries, Novell NetWare 6.5) there are workarounds 
    idetified - the clients can be run on those platforms using Java 1.4.2.
    However, as the Java 1.4.2 is not officially supported by SCM Client, 
    installations based on JVM 1.4.2 are not supported.
    For more details regarding workarounds please contact L2.

8.5 Control of the Drag&Drop in SCM GUI Clients Tree (internal defect 78629)

    The SCM 5.1.1.10 introduces new configuration setting to control Drag'n'Drop
    feature in GUI, Clients Tree. Due to Globalization problems this option is 
    not available through GUI Preferences window. 
    You must edit this setting directly under 'clientsdnd' key, '[display]' 
    stanza in the GUI preferences file (located in %USERPROFILE%\SAM\sam.pref). 
    Value 'true' is default and means Drag'n'Drop enabled, change it to 'false' 
    to disable it.


8.6 Limit distribution of clientupdate.jar package only to clients with proper 
    client version (internal defect 80010)

    The SCM 5.1.1.14 introduces new functionality that controls client update 
    process. To avoid distribution of wrong update packages to the endpoint,
    a set of migration rules was defined:

    +---+------------+-------------------------------------+
    |   | client ver | allowed update                      |
    +---+------------+-------------------------------------+ 
    | A | unknown    | 5.1.0.1                             |
    | B | 5.1.0.1    | 5.1.0.1-2                           |
    | C | 5.1.0.2    | 5.1.0.27-29;5.1.0.31-32             |
    | D | 5.1.0.27   | 5.1.0.27-29;5.1.0.31-32;5.1.1.1     | 
    | E | 5.1.1.0    | 5.1.1.1 and above                   |
    +---+------------+-------------------------------------+

    SCM client that has version 'client ver' can migrate only within these 
    rules. 
    SCM Server controls distribution and does not allow downloading of wrong 
    bundle to the endpoint. 
    For example - rule C - if client SCM 5.1.0.2 is connecting server and asking
    for update, and the clientupdate package on the server is 5.1.0.28, update
    is allowed. Was it clientupdate.jar for version 5.1.1.1, the update would be
    disabled.
    If client version is not listed in second column, ex. 5.1.0.15, rule for 
    closest lower version is used - here Rule C.
    To update non-unified SCM environment to latest release, the SA must load 
    every client update bundle (according to migration table) and allow clients 
    to download packages and perform update. 

    Note: Versions of all clients connected to SCM server can be seen on 
    Server/Client Code panel in Administration Console. 


8.7 SSL certificate expiration does not impose risk to the SCM Server
    connectivity capabilities (IZ10262)

    The SSL Certificate used for communications with clients and CLI/GUI is 
    created with SCM Server installation and expiration date is set to 4 years
    since creation. 
    The expiration of the certificate does not break communication with the 
    clients nor CLI/GUI. 

    Currently SCM support team offers solution (in form of collector 
    any.any.PurgeSSLCertificateV1) allowing seamless migration of the SCM 
    systems to new certificate.
    

8.8 The scmrunpolicycollectors does not take into account subgroups (d81931).

    In the SCM system there are two possible ways to run all collectors deployed 
    as a part of policy - you can either run them via GUI or by 
    scmrunpolicycollectors CLI command.

    When GUI is used and the group containing subgroup(s) is chosen, the clients 
    being members of the subgroup(s) are being taken into account and collectors 
    are executed on them.

    The CLI command differs from that behaviour. When group containing subgroups
    is being provided (via -group argument) to scmrunpolicycollectors, members 
    of the subgroup(s) are not considered and collectors are not executed on 
    them. To run collectors on the clients being members of the subgroup(s) you 
    have to execute additional scmrunpolicycollectors command(s) with 
    subgroup(s) stated explicitly as a -group argument (one at a time).

    If the group does not contain subgroups, both ways (GUI and CLI) produce the
    same results - collectors are being run on the same set of clients.

8.9 The messages in msgHCV_Collector*.log are not translated.

    The SCM collectors executed on SCM Client save various messages in the 
    msgHCV_Collector*.log files. Those messages should be translated to 
    according to the system locales, but are always saved in English.


9.0 NOTICES
------------
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Customers are responsible for ensuring their own compliance with various
laws such as the Graham-Leach-Bliley Act, the Sarbanes-Oxley Act, and the
Health Insurance Portability and Accountability Act.  It is the customer's
sole responsibility to obtain advice of competent legal counsel as to the
identification and interpretation of any relevant laws that may affect the
customer's business and any actions the customer may need to take to comply
with such laws. IBM does not provide legal, accounting or auditing advice,
or represent or warrant that its products or services will ensure that customer
is in compliance with any law.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.


9.1 Trademarks

The following terms are trademarks or registered trademarks of International
Business Machines Corporation in the United States, other countries, or both:

AIX
DB2
IBM
IBM logo
iSeries
pSeries
Tivoli
Tivoli logo
xSeries
zSeries

Java and all Java-based trademarks and logos are trademarks of Sun
Microsystems, Inc.
in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft
Corporation in the United States, other countries, or both.

Linux is a trademark of Linus Torvalds in the United States, other countries,
or both.

UNIX is a registered trademark of The Open Group in the United States and
other countries.

Other company, product, and service names may be trademarks or service marks
of others.


End of IBM Tivoli Security Compliance Manager, Patch 5.1.1-TIV-SCM-FP0017 README

