IBM(R) Tivoli(R) Access Manager for Operating Systems, Patch 5.1.0-TIV-PDO-FP0004 README
========================================================================================

(C) Copyright International Business Machines Corporation 2004. All rights reserved.
U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Friday, 1 October 2004
EDITED:  Thursday, 9 December 2004
---------------------------------------------------------------------------------------

    CONTENTS

    1.0 ABOUT THIS PATCH
        1.1 Patch contents
        1.2 Architectures
        1.3 Patches superseded
        1.4 Dependencies
    2.0 APARS AND DEFECTS FIXED
        2.1 Problems fixed by patch 5.1.0-TIV-PDO-FP0004
        2.2 Problems fixed by patch 5.1-PDO-FP02 
        2.3 Problems fixed by patch 5.1-PDO-FP01
    3.0 BEFORE INSTALLING THIS PATCH
        3.1 Back up Tivoli Access Manager for Operating Systems data  
    4.0 INSTALLING THIS PATCH
        4.1 Installing this patch on AIX systems
        4.2 Installing this patch on HP-UX systems
        4.3 Installing this patch on Linux systems
        4.4 Installing this patch on Solaris Operating Environment systems
    5.0 UNINSTALLING THIS PATCH
    6.0 AFTER INSTALLING THIS PATCH
        6.1 Verifying patch level
    7.0 DOCUMENTATION UPDATES
        7.1 Supported Linux kernel drivers (last update: 5.1-PDO-FP02)
        7.2 Incorrect Access-Restrictions example in TAMOS Administration Guide (IY55020) 
        7.3 TAMOS Framework Tasks platforms defined. (IY55809)
        7.4 TAMOS ssh support statement
        7.5 TAMOS system reboot required after fixpack installation
    8.0 SOFTWARE LIMITATIONS
    9.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE 
        9.1 TAMOS interfering with killing processes
        9.2 Startup order of AMOS can affect network policy enforcement
        9.3 Denials occur in audit logs when logging in 
        9.4 Retrusting pdosobjsig when the pdosobjsig command becomes untrusted 
        9.5 ITLM/TAMOS kernel driver conflict installation instructions (IY52090)
        9.6 RedHat Linux - Enterprise Server 3.0 installation on pSeries
        9.7 TAMOS openssh interaction with openssh 3.7p1 or later
        9.8 TAMOS sunssh interaction with solaris patch 113273-04 or later
        9.9 Access Manager certificate expiration
   10.0 NOTICES
        10.1 Trademarks
 

1.0 ABOUT THIS PATCH
--------------------
This patch package contains fixes for problems in Tivoli Access Manager for 
Operating Systems (TAMOS) software. This patch requires that IBM Tivoli Access 
Manager for Operating Systems, Version 5.1 already be installed successfully.
  


1.1 Patch contents

This patch package contains:

- This README file
- Update patch packaging


1.2 Architectures

This patch package applies to the following architectures:

    - IBM AIX(R) 4.3.3, 5.1 and 5.2
    - Sun Solaris Operating Environment 2.7, 2.8 and 2.9
    - HP-UX 11 and 11i
    - SuSE Linux Desktop 1.0 for IA32
    - United Linux 1.0 for IA32
    - United Linux 1.0 for zSeries
    - United Linux 1.0 for iSeries and pSeries
    - RedHat Enterprise Linux 3.0 (RHEL3) for IA32
    - RedHat Enterprise Linux 3.0 (RHEL3) for zSeries (32-bit only) 
    - RedHat Enterprise Linux 3.0 (RHEL3) for iSeries and pSeries 


Notes:
 
       SuSE Linux is one of four partner companies whose products are based on 
       United Linux 1.0; other companies being the SCO Group, Turbolinux, and 
       Conectiva. When SuSe Linux Enterprise Server (SLES) is listed as 
       supported, support for other partner companies' products based on 
       UnitedLinux 1.0 support is implied as well. For more information, 
       consult the United Linux Web site at:  http://www.unitedlinux.com

       New Linux platform support has been added with 5.1-PDO-FP02.  See 
       section 7.1 for a comprehensive list of Linux kernels supported by TAMOS.


1.3 Patches superseded

Patches superseded by this patch:  

   None 


1.4 Dependencies

IBM Tivoli Access Manager for Operating Systems, Version 5.1



2.0 APARS AND DEFECTS FIXED
---------------------------
Because patches are cumulative, this patch corrects all the problems
outlined in the following sections.

2.1 Problems fixed by patch 5.1.0-TIV-PDO-FP0004

    APAR IY60457
    Symptom: AIX Only.  When AMOS is installed on a machine that is running JAVA 1.4.1,    java command(s)
             core dump after the AMOS kernel drivers have been loaded.

    APAR IY60538
    Symptom: DOCUMENTATION.   TAMOS 5.1 claims support for openssh.  The version tested was 
             openssh 3.5p1(the current version available at testing time).   When using openssh 3.7p1 and      
             above, TAMOS password and login policies do not work properly.  This is due to an architectural 
             change to openssh.  The next TAMOS 5.1 GA fixpack will support later versions of openssh.  Please
             contact TAMOS Level 2 support for more information.
             
    APAR IY60892
    Symptom: Solaris Only. Multiple inet processes starting in rc.kosseal.

    APAR IY61617  (Sysroute of IY54517)
    Symptom: Unable to kill process due to STREAMS issue.  When a server 
             application generates many threads, each with a listening socket 
             and the state of the socket becomes EAGAIN, the STREAMS driver 
             could miss the T_DISCONN_IND message.

    APAR IY62179
    Symptom: DOCUMENTATION:  The TAMOS 5.1 READMEs do not document that a reboot 
             of your system is required after applying a TAMOS fixpack.  All 5.1 
             fixpacks update kernel drivers.  A system reboot is required.

    APAR IY62666 (Sysroute of IY54321)
    Symptom: More than five logins in a time span of less than a second will cause 
             some logins to fail.

    APAR IY62667 (Sysroute of IY56673)
    Symptom: Solaris 2.9 Only. Error messages on console during boot sequence.

    APAR IY62668 (Sysroute of IY56361)
    Symptom: Multiple processes both killing the same process  group can cause a race 
             condition on Solaris MP systems.   This problem is similar to IY38734, where 
             process 1 and process   2 are both killing the same process, process 1 starts.  
             process  2 performs the kill and process 1 goes to do the action, but  it's 
             no longer there.  IY38784 handled the case where the  pointer was NULL.  
             This APAR handles the case where  the address is not null, but becomes invalid.                     

    APAR IY62669 (Sysroute of IY58505)
    Symptom:  pdosd daemon cores on shutdown.  The msg__pdosd.log file shows 
              the following error message:  " 2004-04-08-19:03:33.678+09:00I----- 0x35A62281 
              pdosd  ERROR oss threads allocator.c 541 0x00000102 An error occurred while  
              locking a mutex: 22: Invalid argument"  


2.2 Problems fixed by patch 5.1-PDO-FP02

    APAR IY58385 (Sysroute of IY47827)
    Symptom: HPUX only.  Change of password on HPUX system with HPUX trusted
             computing enabled displays "AOSLP0129I New password is not allowed 
             because it is a recently used password" error message.  The
             password cannot be changed.

    APAR IY58386 (Sysroute of IY50636)
    Symptom: Wildcard Policy allows a non-pathed symlink to circumvent policy.

    APAR IY58387 (Sysroute of IY54605)
    Symptom:  pdossudo command not finding correct path variables as defined
              in /opt/pdos/etc/pdossudo.conf.  

    APAR IY58388 (Sysroute of IY55720)
    Symptom:  Wildcard Policy allows the touch command to create a file while
              policy denies file creation. 

    Internal CMVC defect 45046
    Symptom: Linux Only. RedHat Enterprise Linux kernel support for x86, s390 
             and ppc.  See Section 7.1 for a list of Linux kernels supported 
             by TAMOS.

    Internal CMVC defect 50064
    Symptom  pdosd cores when garbage characters are defined in NetOutgoing 
             policy.   


2.3 Problems fixed by patch 5.1-PDO-FP01

    APAR IY55172 (Sysroute of IY50260)
    Symptom: AIX only.  pdosd core created when AMOS runs a strlen on a 
             null pointer.

    APAR IY52090
    Symptom: Solaris only.  IBM Tivoli License Manager and TAMOS installed 
             on the same system can cause a system crash, depending on loading 
             order of the kernel drivers.  It is strongly recommended that you 
             install the latest IBM Tivoli License Manager Fixpack and follow
             the instructions in section 9.5.

    APAR IY55173 (Sysroute of IY53141)
    Symptom: HPUX only.  A system crash can occur if TAMOS Login Policy 
             Manager is disabled, and policy denying Remote Login exists.    
             The cause is a negative spinunlock in the pal_abortProcessHP 
             function.
    
    Internal CMVC defect 45046
    Symptom: Linux Only. SLES8 SP3 kernel support for x86, s390 and ppc.  
             See Section 7.1 for a list of Linux kernels supported by TAMOS.

    Internal CMVC defect 45267
    Symptom: x86 Linux Only.  When TAMOS is installed on United Linux 1.0 with 
             SP2a, TAMOS installation and configuration complete, but TAMOS 
             cannot be started.


3.0 BEFORE INSTALLING THIS PATCH
--------------------------------
Before installing this patch, review the following prerequisites and 
dependencies.


3.1 Back up Tivoli Access Manager for Operating Systems data

Before applying any maintenance, be sure to back up your system.  Use 
the pdosbackup command provided with the TAMOS product to back up TAMOS-
specific data.  Documentation for the pdosbackup command is located in the 
"IBM Tivoli Access Manager for Operating Systems Administration Guide, 
Version 5.1."


4.0 INSTALLING THIS PATCH
-------------------------
Before installing this patch, be sure that you have reviewed the 
prerequisites and have completed the backup procedure in section 3.0, 
"BEFORE INSTALLING THIS PATCH".

This README assumes that $PATCH is the path to your temporary directory. 


4.1 Installing this patch on AIX systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       # uncompress 5.1.0-TIV-PDO-AIX-FP0004.tar.Z
       # tar -xvf 5.1.0-TIV-PDO-AIX-FP0004.tar

  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a.  List all untrusted files    
           # pdosobjsig -l untrusted
  
       b.  Perform validation for untrusted files

       c.  Retrust the untrusted files
           # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 5.1", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:

       # installp -a -g -X -d $PATCH PDOSrte

  6. Restart your system.  

       # shutdown -rF 

  7. Once your system has returned from restart, verify that objects defined in the TAMOS 
     TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted
       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start


4.2 Installing this patch on HP-UX systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       # uncompress 5.1.0-TIV-PDO-HPUX-FP0004.tar.Z
       # tar -xvf 5.1.0-TIV-PDO-HPUX-FP0004.tar

  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a.  List all untrusted files    
           # pdosobjsig -l untrusted
  
       b.  Perform validation for untrusted files

       c.  Retrust the untrusted files
           # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 5.1", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:

       # swinstall -s $PATCH/PDOSRTE000510-04.depot PDOSrte

  6. Restart your system.
  
       # cd /
       # shutdown -r now

  7. Once your system has returned from restart, verify that objects defined in the TAMOS 
     TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted
       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start


4.3 Installing this patch on Linux systems
  
  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       Linux on IA32
      
           # uncompress 5.1.0-TIV-PDO-i386.linux-FP0004.tar.Z
           # tar -xvf 5.1.0-TIV-PDO-i386.linux-FP0004.tar

       Linux on zSeries 
 
           # uncompress 5.1.0-TIV-PDO-s390.linux-FP0004.tar.Z
           # tar -xvf 5.1.0-TIV-PDO-s390.linux-FP0004.tar

       Linux on pSeries(R) and iSeries

           # uncompress 5.1.0-TIV-PDO-ppc.linux-FP0004.tar.Z
           # tar -xvf 5.1.0-TIV-PDO-ppc.linux-FP0004.tar


  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a.  List all untrusted files    
           # pdosobjsig -l untrusted
  
       b.  Perform validation for untrusted files

       c.  Retrust the untrusted files
           # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 5.1", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:


       rpm --freshen <patchname> 
                                     

       where <patchname> is one of the following:

       Linux on IA32 
      
           PDOSrte-PDOSruntime-5.1.0-4.i386.rpm

       Linux on zSeries 
 
           PDOSrte-PDOSruntime-5.1.0-4.s390.rpm

       Linux on pSeries(R) and iSeries

           PDOSrte-PDOSruntime-5.1.0-4.ppc.rpm

  6. Restart your system.

      # shutdown -r now

  7. Once your system has returned from restart, verify that objects defined in the TAMOS 
     TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted

       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start


4.4 Installing this patch on Sun Solaris Operating Environment systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

       # uncompress 5.1.0-TIV-PDO-Solaris-FP0004.tar.Z
       # tar -xvf 5.1.0-TIV-PDO-Solaris-FP0004.tar

  3. Validate files managed by the TAMOS Trusted Computing Base (TCB).  Take
     appropriate action for retrusting the untrusted files.   

       a.  List all untrusted files    
           # pdosobjsig -l untrusted
  
       b.  Perform validation for untrusted files

       c.  Retrust the untrusted files
           # pdosobjsig -s <objname> -u trusted

     See the "IBM Tivoli Access Manager for Operating Systems Administration 
     Guide, Version 5.1", "Managing scheduled upgrades to files registered in 
     the Trusted Computing Base" for further discussion.

  4. Stop the Tivoli Access Manager for Operating Systems processes.

       # rc.osseal stop

  5. At the command prompt, enter the following:

         cd $PATCH
         patchadd PDOSRTE000510-04


  6. Restart your system.

       # init 6
       

  7. Once your system has returned from restart, verify that objects defined in the TAMOS 
     TCB have become untrusted due to fixpack installation

       # pdosobjsig -C
       # pdosobjsig -n -l untrusted
       # pdosobjsig -S trusted
       
  8. Restart the Tivoli Access Manager for Operating Systems processes:

       # rc.osseal start


5.0 UNINSTALLING THIS PATCH
---------------------------


To remove the patch on UNIX systems, perform the following steps.

   1. Log in to the system as root.

   2. Stop the TAMOS processes.

        # rc.osseal stop

   3. At the command prompt, enter the following:

      On AIX, reject the applied patch:

         installp -r PDOSrte

      On HP-UX, remove the patch:

         swremove PDOSrte,r=5.1.0.4

      On Linux, apply the previous patch level:

         rpm -U --oldpackage <old_package>

         where <old_package> is one of the following:

         Linux on ia32 
      
           PDOSrte-PDOSruntime-5.1.0-4.i386.rpm

         Linux on zSeries 
  
           PDOSrte-PDOSruntime-5.1.0-4.s390.rpm  

         Linux on pSeries and iSeries

           PDOSrte-PDOSruntime-5.1.0-4.ppc.rpm

       On Solaris, remove the patch:

         patchrm  PDOSRTE000510-04




6.0 AFTER INSTALLING THE PATCH
------------------------------
Complete the following tasks after you have installed the patch.


6.1 Verifying patch level

To verify the patch level of your Tivoli Access Manager for Operating Systems
installation, do the following.

   On AIX:      lslpp -L PDOS.rte

   On HP-UX:    swlist PDOSRTE000510-04.depot

   On Solaris:  showrev -p

   On Linux:    rpm -q -i PDOSrte


You also can use the "pdosversion" command.


7.0 DOCUMENTATION UPDATES
-------------------------
The product documentation for Tivoli Access Manager for e-business, Version 
5.1, can be found at the following Web address:

http://publib.boulder.ibm.com/tividd/td/AccessManagerforOperatingSystems5.1.html

Updated information related to the documentation is as follows.


7.1  Supported Linux kernel drivers 

With fixpack 5.1-PDO-FP02 and higher, the following Linux kernels
will be supported:


        SuSE SLES8 for x86
	     shipped kernels:
	        k_deflt-2.4.19-120.i586.rpm
	        k_smp-2.4.19-113.i586.rpm
             updated SP2a kernels:
	        k_deflt-2.4.19-304.i586.rpm
  	        k_smp-2.4.19-304.i586.rpm
             updated SP3 kernels:
                k_deflt-2.4.19-340.i586.rpm
                k_deflt-2.4.21-138.i586.rpm
                k_smp-2.4.19-340.i586.rpm
                k_smp-2.4.21-138.i586.rpm
	     updated kernels:
                k_deflt-2.4.21-169.i586.rpm
                k_smp-2.4.21-169.i586.rpm

        SuSE Linux Desktop (SLD) 1.0 for x86
	     shipped kernels:
	        k_deflt-2.4.19-306.i586.rpm
	        k_smp-2.4.19-306.i586.rpm
             updated kernels:
                k_deflt-2.4.19-347.i586.rpm
	        k_smp-2.4.19-347.i586.rpm

        SuSE SLES8 for zSeries 31-bit:
             shipped kernel:
	        k_deflt-2.4.19-32.s390.rpm
             updated SP2 kernel:
                k_deflt-2.4.19-79.s390.rpm
	     updated SP3 kernel:
                k_deflt-2.4.21-83.s390.rpm
	  
        SuSE SLES8 for zSeries 64-bit with 31-bit compat:
             shipped kernels:
	        k_deflt-2.4.19-34.s390x.rpm
             updated SP2 kernel:
	        k_deflt-2.4.19-80.s390x.rpm
	     updated SP3 kernel:
	        k_deflt-2.4.21-75.s390x.rpm
	  
        SuSE SLES8 for iSeries and pSeries 64-bit kernel:
             shipped kernels:
	        kernel-iseries64-2.4.19-104.ppc.rpm
	        kernel-ppc64-2.4.19-108.ppc.rpm
	     updated SP1 kernels:
	        kernel-iseries64-2.4.19-194.ppc.rpm
	        kernel-ppc64-2.4.19-186.ppc.rpm
  	     updated SP3 kernels:
	        kernel-iseries64-2.4.21-111.ppc.rpm
	        kernel-ppc64-2.4.21-111.ppc.rpm

        Red Hat RHEL3 for x86
             shipped kernels:
                kernel-2.4.21-4.EL.i686.rpm
                kernel-smp-2.4.21-4.EL.i686.rpm
	     update 1 kernels:
                kernel-2.4.21-9.EL.i686.rpm
                kernel-smp-2.4.21-9.EL.i686.rpm

        Red Hat RHEL3 for iSeries and pSeries 
             shipped kernels:
	        kernel-2.4.21-4.EL.ppc64iseries.rpm
	        kernel-2.4.21-4.EL.ppc64pseries.rpm
	     update 1 kernels:
                kernel-2.4.21-9.EL.ppc64iseries.rpm
                kernel-2.4.21-9.EL.ppc64pseries.rpm

        Red Hat RHEL3 for zSeries (64-bit NOT supported)
             shipped kernels:
                 kernel-2.4.21-4.EL.s390.rpm
	     update 1 kernels:
	         kernel-2.4.21-9.EL.s390.rpm

    Notes: 

          Unless otherwise specified in a future 5.1 fixpack README,
          no other linux kernels are supported.

          The SuSE kernel drivers listed above are followed by the
          output of "rpm -qa|grep k_ ".  When reporting a problem with
          a SuSE kernel driver, please report the output of the rpm command.

          RHEL3 for zSeries:  64-bit is not supported by RedHat.  Support
          is anticipated by RedHat Update 3, due in 3rd quarter of 2004.


7.2  Incorrect Access-Restrictions example in TAMOS Administration Guide (IY55020) 
    
When creating an Access-Restriction, as described on physical page 18 and 19
of the Tivoli Access Manager for Operating Systems Administration Guide, the
syntax shows spaces between values.  Using spaces will cause the Access-Restriction
to not be evaluated.  Error messages will appear in the /var/pdos/log/msg__pdosd.log.

For example:
The following pdadmin command on page 19, Section 2, part a is incorrect.
pdadmin> acl modify remote-login set attribute \
     Access-Restrictions "permit : group sys-admin : L : *"

The correct pdadmin command is:
pdadmin> acl modify remote-login set attribute \
     Access-Restrictions "permit:group sys-admin:L:*"


7.3 TAMOS Framework (PDOS) tasks platforms defined. (IY55809)

TAMOS documentation does not explicitly define the platforms which  
PDOS Tasks can be installed.  

- AIX
- Solaris 
- HPUX
- Windows

PDOS Tasks CANNOT be installed on a Linux-managed Node. 

Note:  PDOS Tasks can be executed on any supported TAMOS platform that is 
running a supported Framework oserv or lcf daemon.


7.4 TAMOS openssh support statement

Changes to the TAMOS Administrator Guide, physical page 33, Table 10.

The "Solaris platform" states that /usr/local/sbin/sshd (freeware) is supported.  
This text is being modified to state that /usr/local/sbin/sshd (freeware) version 3.5p1 
and below are supported.  

Also, this section states that /usr/lib/ssh/sshd (Solaris) is supported.  This text is being modified to state
that /usr/lib/ssh/sshd (Solaris) with patch 113273-01 is supported.

Tivoli intends to certify updates to openssh/sunssh and update future TAMOS 5.1 fixpack
READMEs with extended version support.  Please check future AMOS 5.1 fixpack READMEs or contact 
TAMOS L2 support for assistance.  


7.5 TAMOS system reboot required after fixpack installation

Changes to Section 4, "INSTALLING THIS PATCH" of this README.

All subsections of section 4 have added an instruction requiring a restart of your system.  Restart is necessary
TAMOS kernel drivers have been previously loaded.


8.0 SOFTWARE LIMITATIONS
------------------------
None


9.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
------------------------------------------------

9.1  TAMOS interfering with killing processes

There are some occasions where applications, running on a system, where 
TAMOS is also running, cannot be killed.  A potential workaround
for this problem is to define the application as an Immune-Program in the TCB.


9.2  Startup order of AMOS can affect network policy enforcement

If an application starts prior to loading the TAMOS kernel drivers,
TAMOS network policy may not be enforced on the application.  The AMOS 
kernel driver does not have a mechanism to discover previously loaded 
applications and their open communication sockets.  The workaround is to 
load AMOS prior to starting the application.


9.3 Denials occur in audit logs when logging in 

Denials can occur in the audit log when running the login program.         
A change in policy fixes this problem.                                     

The following example is an audit event that should not be denied.         

Timestamp                               Tue Jan 14 09:01:13 2003 
Audit Event                             An authorization decision was made.
Audit View                              Deny
Audit Reason                            Global Audit
Audit Resource Type                     File
Accessor Name                           harry
Accessor Effective Name                 root
Audit Action                            Check Access
Audit Permissions                       readdir
Audit Qualifier                         Checking Access-Restrictions associated
Audit Qualifier                         Checking Access-Restrictions associated
                                        with resource access control policy.

                                        Policy Branch name orion27                 
Protected Object Name                   File/var/pdos/login 
System Resource Name                    /var/pdos/login/
Accessor Process ID                     711
Running Program Protected Name          /usr/bin/login
Running Program System Resource Name    /usr/bin/login
Audit Outcome                           Success
Audit Uniqifier                         2


Use the following instructions to fix the incorrect audit log denials  

1) Run pdadmin

   pdadmin -a <pdadmin admin user ID> -p <password> -d <domain> 

2) Modify the acl osseal-var-lpm 

   pdadmin> acl modify osseal-var-lpm set any-other T[OSSEAL]Ndlorw       
   pdadmin> acl modify osseal-var-lpm set unauthenticated T[OSSEAL]Ndlorw 

3) List the access restriction attribute.  Write down what is listed.  

   pdadmin> acl show osseal-var-lpm attribute Access-Restrictions               

4) Delete the existing access restriction on the acl osseal-var-lpm        

   pdadmin> acl modify osseal-var-lpm delete Access-Restrictions               

5) Modify access restrictions on the acl osseal-var-lpm.  Add /usr/bin/login
and /usr/sbin/login to your what was listed in step 3.                   

   An example:                                                         
    pdadmin> acl modify osseal-var-lpm set attribute Access-Restrictions \      
      "any-other:Ndlorw:/opt/pdos/bin/pdos_pwdrestrict /usr/bin/passwd   \      
      /usr/bin/login /usr/sbin/login"                                         
    pdadmin> acl modify osseal-var-lpm set attribute Access-Restrictions \      
      "unauthenticated:Ndlorw:/opt/pdos/bin/pdos_pwdrestrict             \      
      /usr/bin/passwd /usr/bin/login /usr/sbin/login"                        

pdadmin> quit                                                            

6) Take steps dependent on your Access Manager for e-business setup         
to propagate the Access Manager database.                                
                                                                                
                                                                                
9.4 Retrusting pdosobjsig when the pdosobjsig command becomes untrusted

Open two sessions. Ensure that both sessions are opened
by users with administrative privileges.              

In one session, restart AMOS                           
# rc.osseal start                                      

Run 'pdosobjsig -l untrusted'                          

If pdosobjsig returns with an 'unable to execute' error
message, use your second session to kill pdosd.        
# ps -ef | grep pdosd <= remember the PID              
# kill <PID of pdosd>

Run 'pdosobjsig -l untrusted'.  Review the files that are
untrusted.                                               

Retrust your untrusted TCB objects.                      
# pdosobjsig -S trusted                                  

start pdosd                                              
# rc.osseal start                                        


9.5 ITLM/TAMOS kernel driver conflict installation instructions (IY52090) 

If TAMOS has already been installed and configured on Solaris, and ITLM has already been installed 
and configured on the same system, follow these instructions:

1) Apply 5.1-PDO-FP01 FIRST.  You will also need 1.1.1-TLM-0006LA or higher (ask ITLM support for the
test supported fixpack containing their fix)

2) If TAMOS autostart is on, turn it off
# pdoscfg -autostart off

3) Shutdown TAMOS.
# rc.osseal stop

4) Stop ITLM
# /etc/init.d/tlm stop

5) Apply this fixpack
# patchadd PDOSRTE000510-01

6) Restart your system
# init 6

When the system returns, apply 1.1.1-TLM-00006LA according to the
recommended installation

7) Start ITLM 
# /etc/init.d/tlm start

8) Start TAMOS
# rc.osseal start

9) If you had TAMOS configured for autostart, turn autostart on
# pdoscfg -autostart on

                                                                     
9.6 RedHat Linux - Enterprise Server 3.0 installation on pSeries 

Fixed in fixpack 5.1.0-TIV-PDO-ppc.linux-FP0004 and later.  This problem is no longer
exists.

9.7 TAMOS openssh interaction with openssh 3.7p1 or later

When TAMOS 5.1 is running openssh 3.7p1 (all Solaris versions), login and password policies 
do not function properly.  The problem is due to architectural changes in the openssh/sunssh code.

The TAMOS support and development teams are working a solution for these versions of ssh.  We anticipate
a release date of December 17, 2004.  Contact TAMOS L2 for more information about ssh support on Solaris.


9.8 TAMOS sunssh interaction with solaris patch 113273-04 or later

When TAMOS 5.1 is running sunssh on Solaris 9 and Solaris 9 patch 113273-04 or greater is installed,
login and password policies do not function properly.  The problem is due to architectural changes 
in the sunssh code.

The TAMOS support and development teams are working a solution for these versions of ssh.  We anticipate
a release date of December 17, 2004.  Contact TAMOS L2 for more information about ssh support on Solaris.


9.9 Access Manager certificate expiration

The pd_ldapkey.kdb  and ssl certificate provided by Access Manager Runtime 4.1 has a 365 day expiration.
Systems running AMOS with an expired certificate will run in isolation mode.   This problem occurs because 
pdosd.kdb contains the ssl certificate that was taken from the pd_ldapkey.kdb.

A utility is provided in TAMOS 5.1 to the current certificate, /opt/pdos/sbin/cert_test.sh.  Please note the 
expiration date and plan accordingly to update your certificates.
# /opt/pdos/sbin/cert_test.sh /path/to/current/cert/certname.b64   ldap_server_name

To correct this problem, create a new pd_ldapkey.kdb and ldap ssl certificate.  The LDAP server and each 
AMOS client will have to be configured to use the new key.   

Instructions for configuring an AMOS client to use the new certificate:
# rc.osseal stop
# pdoscfg -ssl_ldap_cacert /path/to/new/cert
# rc.osseal start

A utility is provided in TAMOS 5.1 to the current certificate, /opt/pdos/sbin/cert_test.sh.  Please note the 
expiration date and plan accordingly to update your certificates.
# /opt/pdos/sbin/cert_test.sh /path/to/current/cert/certname.b64   ldap_server_name

Please consult Access Manager L2 support for further help with certificates issues.



10.0 NOTICES
------------
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.


10.1 Trademarks

The following terms are trademarks or registered trademarks of International
Business Machines Corporation in the United States, other countries, or both:

AIX
IBM
IBM logo
iSeries
pSeries
S/390
Tivoli
Tivoli logo
xSeries
zSeries

Java and all Java-based trademarks and logos are trademarks of Sun Microsystems, Inc. 
in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft 
Corporation in the United States, other countries, or both. 

UNIX is a registered trademark of The Open Group in the United States and
other countries.

Other company, product, and service names may be trademarks or service marks
of others.



End of IBM Tivoli Access Manager for Operating Systems, Patch 5.1-PDO-FP01 README
