Install and update IBM Security Directory Server V6.4

Basic guide to install and configure IBM SDS V6.4.

Author(s): Tamas Bures | Created: 06 May 2018 | Last modified: 06 May 2018

Tested on: -

Table of contents

Install and update IBM Security Directory Server V6.4
Install prerequisites packages on RHEL
Installing IBM Installation Manager 1.8.0 (IM)
Upgrading IBM IM to version 1.8.8
Installing IBM Security Directory Server (SDS)
Upgrading IBM SDS
Updating IBM Java
Updating IBM GSKit
Updating SDS binaries
Creating and configuring SDS instance

Install and update IBM Security Directory Server V6.4↑

Note: IBM DB2 installation is not included in this manual, the minimum required DB2 level for SDS: IBM DB2 10.5.0.9

All steps below must be executed as root user!

Install prerequisites packages on RHEL↑

Enable RHEL extra repository

 yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional

Update the repository list with command:
```
 yum clean all
```

Install the required packages with the following command (including 32 and 64 bit packages as well)

 yum install \ 
     xorg-x11-xauth xorg-x11-apps xterm compat-libstdc++-33.i686 compat-libstdc++-33.x86_64 \
     compat-db.x86_64 gtk2.i686 gtk2.x86_64 gtk2-engines.x86_64 libXp.i686 libXp.x86_64 libXmu.i686 \
     libXmu.x86_64 libXtst.i686 libXtst.x86_64 elfutils.x86_64 elfutils-libs.i686 elfutils-libs.x86_64 \
     pam.i686 pam.x86_64 rpm-build.x86_64 libXft.i686 libXft.x86_64 libstdc++.i686 libstdc++.x86_64 \
     ksh.x86_64  libgcc.i686 libgcc.x86_64 libcanberra-gtk2.i686 libcanberra-gtk2.x86_64 \
     PackageKit-gtk3-module PackageKit-gtk3-module.i686

Mounting IBM SDS iso file

 mount -o loop <path to ISO>/sds64-linux-x86-64.iso <path to mount, i.e.: /mnt>

Adjust the RHEL kernel parameters to avoid DB2 errors when creating SDS instance. Add or modify the kernel.shmmax parameter and define a value to 3221225472 in /etc/sysctl.conf file

The complete line should look like: kernel.shmmax=3221225472
Actualize the new setting with this command (without this command, the new setting will be activated on a reboot)
```
 sysctl -w kernel.shmmax=3221225472
```
Create the neccessary directories where the SDS instance and belonging DB2 instance will be stored
```
 mkdir -p /sdsdata/isaminst
 mkdir -p /db2data/isamdb2i
```

Create the neccessary users and groups:

 groupadd idsldap
 useradd isamdb2i
 useradd isamldap

Set the primary groups for both users

 usermod -g idsldap isamdb2i
 usermod -g idsldap isamldap

Set privileges on instance folders

 chown isamdb2i:idsldap /db2data/isamdb2i
 chown isamldap:idsldap /sdsdata/isaminst

Enable X11 forwarding (use your own solution to accomplish this) and test it that works

Issue the xclock command and if the xclock window appears, go on.

Installing IBM Installation Manager 1.8.0 (IM)↑

Navigate to IM installaion package on the mounted ISO file folder (/mnt)
```
 cd /mnt/ibm_im_64bit
```
Start the installer
```
 ./install
```
Follow the on screen instructions to install IBM Installation Manager to directory /opt/IBM/InstallationManager
When installation finished, click Restart Installation Manager button.

Upgrading IBM IM to version 1.8.8↑

Navigate to directory where you store the update packages (in this manual it is /home/admin/updates)
```
 cd /home/admin/updates
```
Create a directory to store the unzipped file
```
 mkdir -p /home/admin/updates/im_188
```

Extract the IM update file the file to a directory

 unzip /home/admin/updates/agent.installer.linux.gtk.x86_64_1.8.8000.20171130_1105.zip \ 
 -d /home/admin/updates/im_188

Navigate to the extracted files
```
 cd /home/admin/updates/im_188
```
Start the Installation Manager installer
```
 ./install
```
Follow the on screen instructions to update IBM Installation Manager
When installation finished, click Restart Installation Manager button
Once it is restarted, quit the application
Clean up the temp directory

Command: rm -rf /home/admin/updates/im_188

Installing IBM Security Directory Server (SDS)↑

Locate the response file /home/admin/SDSInstall-Response.xml

If you work with different paths, adjust the paths of the mount point (/mnt) in the XML file (edit the file):

 <?xml version='1.0' encoding='UTF-8'?>
 <agent-input>
   <variables>
     <variable name='sharedLocation' value='/opt/IBM/IBMIMShared'/>
   </variables>
   <server>
     <repository location='/mnt/ibm_sds'/>
   </server>
   <profile id='IBM Security Directory Server' installLocation='/opt/ibm/ldap/V6.4'>
     <data key='cic.selector.arch' value='x86_64'/>
     <data key='user.use.existing.db2.installpath,com.ibm.security.directoryserver.v64' value='/opt/ibm/db2/V10.5'/>
     <data key='user.use.existing.db2,com.ibm.security.directoryserver.v64' value='true'/>
     <data key='user.gskit.executable.path,com.ibm.security.directoryserver.v64' value='/mnt/ibm_gskit'/>
     <data key='user.use.existing.gskit,com.ibm.security.directoryserver.v64' value='false'/>
     <data key='user.jdk.executable.path,com.ibm.security.directoryserver.v64' value='/mnt/ibm_jdk/6.0.16.2-ISS-JAVA-LinuxX64-FP0002.tar'/>
   </profile>
   <install>
     <!-- IBM Security Directory Server 6.4.0.0 -->
     <offering profile='IBM Security Directory Server' id='com.ibm.security.directoryserver.v64' version='6.4.0.20150225_0826' features='main.feature.db2,main.feature.gskit,main.feature.jdk,main.feature.javaclient,main.feature.server,main.feature.cclient'/>
   </install>
   <preference name='com.ibm.cic.common.core.preferences.eclipseCache' value='${sharedLocation}'/>
 </agent-input>

Save the file
Navigate to the installed path of Installation Manager
```
 cd /opt/IBM/InstallationManager/eclipse
```

Execute the following command to silently install SDS with the response file

 ./imcl input <path to response file >/SDSInstall-Response.xml -acceptLicense -showProgress

Once the process finished, you have an installed IBM SDS with the following versions:
- IBM Security Directory Server 6.4.0.0
- IBM GSKit 8.0.50.34
- IBM Java 6.0.16.2
You can now umount the ISO file, it will no longer needed.
```
 umount /mnt (or the path where you mounted the iso)
```

Upgrading IBM SDS↑

Updating IBM Java↑

Create a backup of the previous version of Java

 mv /opt/ibm/ldap/V6.4/java /opt/ibm/ldap/V6.4/java_old

Create a temp directory to hold the extracted files
```
 mkdir -p /home/admin/updates/sds_java_fix
```

Extract the Java update package to the newly created directory

 tar -xvf /home/admin/updates/6.0.16.26-ISS-JAVA-LinuxX64-FP0026.tar -C /home/admin/updates/sds_java_fix

Put the extracted files to SDS

 mv /home/admin/updates/sds_java_fix/java/ /opt/ibm/ldap/V6.4/

Verify that new Java is in the correct place:
```
 ls -l /opt/ibm/ldap/V6.4
```
You should have a java folder and a java_old folder as well.

Check new Java version

 /opt/ibm/ldap/V6.4/java/bin/java -version

Check the second line of the output, it should match with
Java(TM) SE Runtime Environment (build pxa6460sr16fp26-20160508_01(SR16 FP26))

Clean up the temp directory
```
rm -rf /home/admin/updates/sds_java_fix
```

Updating IBM GSKit↑

Create a temp directory to hold the extracted files
```
 mkdir -p /home/admin/updates/sds_gskit_fix
```

Extract the GSKit update package to the newly created directory

 tar -xvf /home/admin/updates/8.0.50.84-ISS-GSKIT-LinuxX64-FP0084.tar.gz -C /home/admin/updates/sds_gskit_fix

Update 32 bit GSkit packages

 rpm -Uhv /home/admin/updates/sds_gskit_fix/8.0.50.84-ISS-GSKIT-LinuxX64-FP0084/32/*.rpm

Update 64 bit GSKit packages

 rpm -Uhv /home/admin/updates/sds_gskit_fix/8.0.50.84-ISS-GSKIT-LinuxX64-FP0084/64/*.rpm

Check that new version is applied
```
 gsk8ver_64
```
The command will print a lot of information on the screen, pick a block and locate any lines starts with @(#)FileVersion and check the version to match 8.0.50.84

Clean up the temp directory

 rm -rf /home/admin/updates/sds_gskit_fix

Updating SDS binaries↑

Create a temp directory to hold the extracted files
```
 mkdir -p /home/admin/updates/sds_fix
```

Extract the SDS update package to the newly created directory

 tar -xvf /home/admin/updates/6.4.0.15-ISS-ISDS-LinuxX64-IF0015.tar.gz -C /home/admin/updates/sds_fix/

To start the update process, issue the following command from the extracted directory
```
 /home/admin/updates/sds_fix/idsinstall -u -f
```
Once the update is finished, check that the new version is applied
```
 rpm -qa | grep idsldap
```
The command will print a lot of information on the screen, check the first line of the output, and it should match with idsldap-srvbase64bit64-6.4.0-15.x86_64
Clean up the temp directory
```
 rm -rf /home/admin/updates/sds_fix
```

Creating and configuring SDS instance↑

Creating the directory server instance (replace the placeholders with values fulfill your needs - if you are fine with provided values, remove the <> from the command before executing except passwords)
```
 /opt/ibm/ldap/V6.4/sbin/idsicrt \ 
     -I <isamldap> \
     -a <4538> \
     -c <4539> \
     -e <encrypt seed> \
     -g <encrypt salt> \
     -p <1389> \
     -s <1636> \
     -l </sdsdata/isaminst> \
     -r "<SDS instance for ISAM>"
```
Where
- -I name of SDS instance
- -a admin server port
- -c admin server secure port
- -e encryption seed
- -g encryption salt
- -p ldap port
- -s ldap secure port
- -l location where instance configuration will be stored
- -r description of the instance
Configuring database for isamldap SDS instance (replace the placeholders with values fulfill your needs - if you are fine with provided values, remove the <> from the command before executing except passwords)
```
 /opt/ibm/ldap/V6.4/sbin/idscfgdb \
     -n \
     -I isamldap \
     -a isamdb2i \
     -t isamdb2i \
     -w <password> \ 
     -l /db2data/isamdb2i
```
Where
- -n run in no prompt mode (required to -w)
- -I name of SDS instance (must match the value with you used in the previous command)
- -a DB2 admin ID
- -l location where db instance date will be stored
- -t name of the database
- -w password of DB2 admin ID
Configure the primary administrator for isamldap SDS instace
```
 /opt/ibm/ldap/V6.4/sbin/idsdnpw \
     -I <isamldap> \
     -u <cn=root> \
     -p <passford for user cn=root>
```
Where
- -I name of SDS instance (must match the value with you used in the previous command)
- -u the name of the primary instance administrator (best practice to use cn=root)
- -p the password value for user cn=root
Creating the top entry in instance (suffix)
```
 idscfgsuf -I isamldap -s <o=ibm,c=hu>
```
Where
- -I name of SDS instance (must match the value with you used in the previous command)
- -s the suffix string to be added