Pls Remove Subscription. Fw: TME10 Digest, Vol 83, Issue 11

Can you please un-subscribe me from this list?


Regards,   Hope 
 


Hope Ruiz
 11301 BURNET RD, Austin, TX 78758

Community Collaboration Manager
 
Global Tivoli User Community
 
IBM Software Group
 
E-mail:
hruiz-r/[email protected]


Telephone:
+1-720-395-0687


http://www.tivoli-ug.org
 


 
 


 
 



----- Forwarded by Hope Ruiz/Austin/IBM on 03/25/2013 07:49 AM -----

From:   [email protected]
To:     [email protected]
Date:   03/21/2013 07:03 AM
Subject:        TME10 Digest, Vol 83, Issue 11
Sent by:        [email protected]



Send TME10 mailing list submissions to
                 [email protected]

Via Email, send a message with the subject or body 'help' to:
        [email protected]

You can reach the person managing the list at
                 [email protected]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of TME10 digest..."


Today's Topics:

   1. Re: Configuring H_TEMS LDAP (Marcel Booms)
   2. RE: LDAP Key Store Password and GSK7capicmd Password
      (Gregory Mendes)
   3. RE: LDAP Key Store Password and GSK7capicmd Password
      (Dr. Frank Tate)
   4. JazzfSM non-root install (Jared Seaton)


----------------------------------------------------------------------

Message: 1
Date: Thu, 21 Mar 2013 11:01:33 +0100
From: Marcel Booms <marcel.booms-lBZW/[email protected]>
Subject: Re: [TME10] Configuring H_TEMS LDAP
To: "Discussion list for Tivoli product and Tivoli Ready products."
                 <[email protected]>
Message-ID:
 <OF89C084A7.4655F862-ONC1257B35.00343E68-C1257B35.003716B2-lBZW/[email protected]>
Content-Type: text/plain; charset="iso-8859-1"

Skipped content of type multipart/alternative-------------- next part 
--------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 6431 bytes
Desc: not available
Url : 
http://lists.ca.ibm.com/pipermail/tme10/attachments/20130321/bd31b554/attachment-0001.jpe

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 360 bytes
Desc: not available
Url : 
http://lists.ca.ibm.com/pipermail/tme10/attachments/20130321/bd31b554/attachment-0001.gif


------------------------------

Message: 2
Date: Thu, 21 Mar 2013 06:21:57 -0500
From: Gregory Mendes <[email protected]>
Subject: RE: [TME10] LDAP Key Store Password and GSK7capicmd Password
To: <[email protected]>
Message-ID: <[email protected]>
Content-Type: text/plain; charset="iso-8859-1"


Hey Frank, Thanks alot for that great information.  My question is how do 
I use that .cer Public key as the certificate that the hub_TEMS will use 
for user authentication?  Is that possible?  Regards,



Gregory R. Mendes
770-317-8593

 Date: Wed, 20 Mar 2013 23:52:32 -0400
Subject: RE: [TME10] LDAP Key Store Password and GSK7capicmd Password
From: frank.tate-9LkaxTQlAnxWk0Htik3J/[email protected]
To: [email protected]

You can't make a .cer certificate the default because it's NOT  a PRIVATE 
certificate (which is what the error is telling you). That .cer file is 
normally the public key for the CA (so clients can verify that the CA 
signed a certificate). An actual PRIVATE key/certificate will almost 
always be in a .pks file (or similar) and will have a password that's 
needed to import or read it (the .cer file does not require a password 
because it's a PUBLIC certificate). You can have multiple CA public certs 
in a keystore, and that has the effect that any one of those CAs is 
"trusted" to sign certificates that are either atored in this keystore or 
received by the client that is using this keystore. You can also 
(separately) have multiple personal (private) certs in the keystore that 
can be presented by the client rhat is using this keyatore. To tell the 
client exactly which personal/private key to present, tou have to specify 
the label of that certificate as it appears in the keystore. But tou just 
about NEVER have to specify the label of any CA certificate.

I realize it's confusing, but that's just how it is. You may need to do 
some generic research on SSL, certificates and keystores before you ever 
try to get LDAP involved, since that adsitional layer REQUIRES a REALLY 
firm understanding of PKI.

Frank - from my phone
On Mar 20, 2013 8:35 PM, "Gregory Mendes" <[email protected]> 
wrote:





Hey Toben,
 
Here's the problem.  By default the configuration for LDAP at the hub_TEMS 
creates a CA called IBM_Tivoli_Monitoring_Certificate that is set to the 
default private key CA (!-*).  When I import the CA certificate that the 
customer wants to use, it's listed in the keyfile.kdb but I can make it 
the default.  It give me the error GSKKM_ERR_KEYREC_PRIVATE_KEY_NULL when 
trying to run the gsk7capicmd -cert -setdefault  -db 
/opt/IBM/ITM/keyfiles/keyfile.kdb -label "goes CA".  It's really making me 
want to shoot a round through the screen.  :)

 
Regards,



Gregory R. Mendes
Tivoli Architect/Tools Specialist
Mendes, Inc.
Tivoli Monitoring 6.2.3 Certified
770-317-8593

 

Date: Wed, 20 Mar 2013 18:32:40 -0500
Subject: Re: [TME10] LDAP Key Store Password and GSK7capicmd Password
From: [email protected]
To: [email protected]


Private keys, keystores, password encryption of said keystores and/or 
keys: all interchangable relative to OS.  But I hear you, not apt in the 
perfect sense for Linux
On Mar 20, 2013 4:34 PM, "[email protected]" 
<[email protected]> wrote:


So if you are talking about creating a new keystore, then you can give it 
any password you want and that password has nothing to do with SSL 
encryption at all--it just serves as your credential to open the keystore 
database (*.kdb) file.  Once you have a keystore database opened, you can 
then import/export certificates of types both "personal" and "signer" 
to/from it.  Sometimes these certificates themselves were password 
protected when they were exported, and so to import them into your 
keystore you'll need to have the password used when they were exported.




I know that isn't an explicit answer to the error you're seeing below, but 
I'm just providing enough info to get moving in a progressive direction. 
Also, the attached file, while germane on its surface to MS's IE, has some 
good info int he 7 sections at the beginning that can shed some light on 
the relationships and concepts here.




Toben
 
On Wed, Mar 20, 2013 at 2:07 PM, Gregory Mendes 
<[email protected]> wrote:






Hello All,
 
Are these two passwords the same?
 
So, when I configure the h_tems for LDAP support it asks me for LDAP Key 
store and I give it a password.  Should this password be the IBM61TIV or 
can you make it anything?  Or, does this password need to be the same for 
both the LDAP configuration and the CA certificate install to the 
keyfile.kdb?



 
I get this error in my TEMS logfile:
 
LDAP client is Success.
LDAP SSL initialization (113), SSL failure reason code (102): LDP1_Keyring 
/opt/IBM/ITM/keyfiles, password xxxxxxxx.
 
Any ideas?
 



Regards,



Gregory R. Mendes
Tivoli Architect/Tools Specialist
Mendes, Inc.
Tivoli Monitoring 6.2.3 Certified
770-317-8593

  



_______________________________________________

TME10 mailing list

[email protected]

Unsubscribe:[email protected]




-- 
"Sometimes I think that's the only right thing to do:
To dream. to live in the world of dreams.
But it doesn't last forever--wakefulness always comes to take me back..."


_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]   

_______________________________________________

TME10 mailing list

[email protected]

Unsubscribe:[email protected]




_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: 
http://lists.ca.ibm.com/pipermail/tme10/attachments/20130321/4c4bb707/attachment-0001.html


------------------------------

Message: 3
Date: Thu, 21 Mar 2013 07:47:04 -0400
From: "Dr. Frank Tate" <frank.tate-9LkaxTQlAnxWk0Htik3J/[email protected]>
Subject: RE: [TME10] LDAP Key Store Password and GSK7capicmd Password
To: "Discussion list for Tivoli product and Tivoli Ready products."
                 <[email protected]>
Message-ID:
 <CAOprv-=UVs7im4G_KrxnkVPL5u=du3WrMCf4F1DbwGptrz2tiw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
Content-Type: text/plain; charset="iso-8859-1"

The way Marcel says in your other question. The CA cert just needs to be 
in
the keystore as a "root" or "signer" certificate.

Frank - from my phone
On Mar 21, 2013 7:24 AM, "Gregory Mendes" <[email protected]>
wrote:

>  Hey Frank,
>
> Thanks alot for that great information.  My question is how do I use 
that
> .cer Public key as the certificate that the hub_TEMS will use for user
> authentication?  Is that possible?
>
>
> Regards,
>
> Gregory R. Mendes
> 770-317-8593
>
>
> ------------------------------
> Date: Wed, 20 Mar 2013 23:52:32 -0400
> Subject: RE: [TME10] LDAP Key Store Password and GSK7capicmd Password
> From: frank.tate-9LkaxTQlAnxWk0Htik3J/[email protected]
> To: [email protected]
>
> You can't make a .cer certificate the default because it's NOT  a 
PRIVATE
> certificate (which is what the error is telling you). That .cer file is
> normally the public key for the CA (so clients can verify that the CA
> signed a certificate). An actual PRIVATE key/certificate will almost 
always
> be in a .pks file (or similar) and will have a password that's needed to
> import or read it (the .cer file does not require a password because 
it's a
> PUBLIC certificate). You can have multiple CA public certs in a 
keystore,
> and that has the effect that any one of those CAs is "trusted" to sign
> certificates that are either atored in this keystore or received by the
> client that is using this keystore. You can also (separately) have 
multiple
> personal (private) certs in the keystore that can be presented by the
> client rhat is using this keyatore. To tell the client exactly which
> personal/private key to present, tou have to specify the label of that
> certificate as it appears in the keystore. But tou just about NEVER have 
to
> specify the label of any CA certificate.
>
> I realize it's confusing, but that's just how it is. You may need to do
> some generic research on SSL, certificates and keystores before you ever
> try to get LDAP involved, since that adsitional layer REQUIRES a REALLY
> firm understanding of PKI.
>
> Frank - from my phone
> On Mar 20, 2013 8:35 PM, "Gregory Mendes" <[email protected]>
> wrote:
>
>  Hey Toben,
>
> Here's the problem.  By default the configuration for LDAP at the 
hub_TEMS
> creates a CA called IBM_Tivoli_Monitoring_Certificate that is set to the
> default private key CA (!-*).  When I import the CA certificate that the
> customer wants to use, it's listed in the keyfile.kdb but I can make it 
the
> default.  It give me the error GSKKM_ERR_KEYREC_PRIVATE_KEY_NULL when
> trying to run the gsk7capicmd -cert -setdefault  -db
> /opt/IBM/ITM/keyfiles/keyfile.kdb -label "goes CA".  It's really making 
me
> want to shoot a round through the screen.  :)
>
> Regards,
>
> Gregory R. Mendes
> Tivoli Architect/Tools Specialist
> Mendes, Inc.
> Tivoli Monitoring 6.2.3 Certified
> 770-317-8593
>
>
> ------------------------------
> Date: Wed, 20 Mar 2013 18:32:40 -0500
> Subject: Re: [TME10] LDAP Key Store Password and GSK7capicmd Password
> From: [email protected]
> To: [email protected]
>
> Private keys, keystores, password encryption of said keystores and/or
> keys: all interchangable relative to OS.  But I hear you, not apt in the
> perfect sense for Linux
> On Mar 20, 2013 4:34 PM, "[email protected]" <
> [email protected]> wrote:
>
> So if you are talking about creating a new keystore, then you can give 
it
> any password you want and that password has nothing to do with SSL
> encryption at all--it just serves as your credential to open the 
keystore
> database (*.kdb) file.  Once you have a keystore database opened, you 
can
> then import/export certificates of types both "personal" and "signer"
> to/from it.  Sometimes these certificates themselves were password
> protected when they were exported, and so to import them into your 
keystore
> you'll need to have the password used when they were exported.
>
> I know that isn't an explicit answer to the error you're seeing below, 
but
> I'm just providing enough info to get moving in a progressive direction.
> Also, the attached file, while germane on its surface to MS's IE, has 
some
> good info int he 7 sections at the beginning that can shed some light on
> the relationships and concepts here.
>
> Toben
>
> On Wed, Mar 20, 2013 at 2:07 PM, Gregory Mendes <
> [email protected]> wrote:
>
>  Hello All,
>
> Are these two passwords the same?
>
> So, when I configure the h_tems for LDAP support it asks me for LDAP Key
> store and I give it a password.  Should this password be the IBM61TIV or
> can you make it anything?  Or, does this password need to be the same 
for
> both the LDAP configuration and the CA certificate install to the
> keyfile.kdb?
>
> I get this error in my TEMS logfile:
>
> LDAP client is Success.
> LDAP SSL initialization (113), SSL failure reason code (102):
> LDP1_Keyring /opt/IBM/ITM/keyfiles, password xxxxxxxx.
>
> Any ideas?
>
> Regards,
>
> Gregory R. Mendes
> Tivoli Architect/Tools Specialist
> Mendes, Inc.
> Tivoli Monitoring 6.2.3 Certified
> 770-317-8593
>
>
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]
>
>
>
>
> --
> "Sometimes I think that's the only right thing to do:
> To dream. to live in the world of dreams.
> But it doesn't last forever--wakefulness always comes to take me 
back..."
>
>
> _______________________________________________ TME10 mailing list
> [email protected] Unsubscribe:[email protected]
>
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]
>
>
> _______________________________________________ TME10 mailing list
> [email protected] Unsubscribe:[email protected]
>
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: 
http://lists.ca.ibm.com/pipermail/tme10/attachments/20130321/808b5bf2/attachment-0001.html


------------------------------

Message: 4
Date: Thu, 21 Mar 2013 08:01:16 -0400
From: Jared Seaton <[email protected]>
Subject: [TME10] JazzfSM non-root install
To: "Discussion list for Tivoli product and Tivoli Ready products."
                 <[email protected]>
Message-ID:
 <CACoTKf+Z4=BKy6N6J2BAABbHXcWtA=wjSmEmiibt3ztcHM3b1g-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
Content-Type: text/plain; charset="utf-8"

I asked this on INUG, but thought there may be some value in asking the
same question here, since there may be a different audience.

Has anyone successfully deployed JazzfSM as a non-root user, not using the
users home directory as the install base (really IBM?)...?  Any lessons
learned to share?

I'm planning a single server custom install to test with at the moment.
 Possibly having the DB2 instance on a separate server.

I'm just reading through the documentation, and verifying prereq's and it
looks like this will be quite the exercise in patience, to say the least.
 I almost shed a tear when I saw the section labeled "Installing
Installation Manager".


------
Jared Seaton

twitter.com/jmseaton
-------------- next part --------------
An HTML attachment was scrubbed...
URL: 
http://lists.ca.ibm.com/pipermail/tme10/attachments/20130321/defaf4e2/attachment.html


------------------------------

_______________________________________________
TME10 mailing list
[email protected]
http://lists.ca.ibm.com/mailman/listinfo/tme10

End of TME10 Digest, Vol 83, Issue 11
*************************************

_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]