Tivoli SecureWay Policy Director WebSEAL. Installation Guide. Version 3.8

Transcription

1 Tivoli SecureWay Policy Director WebSEAL Installation Guide Version 3.8

2

3 Tivoli SecureWay Policy Director WebSEAL Installation Guide Version 3.8

4 Tivoli SecureWay Policy Director WebSEAL Installation Guide Copyright Notice Copyright IBM Corporation All rights reserved. May only be used pursuant to a Tivoli Systems Software License Agreement, an IBM Software License Agreement, or Addendum for Tivoli Products to IBM Customer or License Agreement. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual, or otherwise, without prior written permission of IBM Corporation. IBM Corporation grants you limited permission to make hardcopy or other reproductions of any machine-readable documentation for your own use, provided that each such reproduction shall carry the IBM Corporation copyright notice. No other rights under copyright are granted without prior written permission of IBM Corporation. The document is not intended for production and is furnished as is without warranty of any kind. All warranties on this document are hereby disclaimed, including the warranties of merchantability and fitness for a particular purpose. U.S. Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corporation. Trademarks IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, Cross-Site, NetView, OS/2, Planet Tivoli, RS/6000, Tivoli Certified, Tivoli Enterprise, Tivoli Enterprise Console, Tivoli Ready, and TME are trademarks or registered trademarks of International Business Machines Corporation or Tivoli Systems Inc. in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Notices References in this publication to Tivoli Systems or IBM products, programs, or services do not imply that they will be available in all countries in which Tivoli Systems or IBM operates. Any reference to these products, programs, or services is not intended to imply that only Tivoli Systems or IBM products, programs, or services can be used. Subject to valid intellectual property or other legally protectable right of Tivoli Systems or IBM, any functionally equivalent product, program, or service can be used instead of the referenced product, program, or service. The evaluation and verification of operation in conjunction with other products, except those expressly designated by Tivoli Systems or IBM, are the responsibility of the user. Tivoli Systems or IBM may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to the IBM Director of Licensing, IBM Corporation, North Castle Drive, Armonk, New York , U.S.A. Copyright International Business Machines Corporation All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface... vii Who Should Read This Guide... vii What This Guide Contains... vii Publications... viii Tivoli SecureWay Policy Director WebSEAL Library... viii Prerequisite Publications.... viii Accessing Publications Online... viii Ordering Publications... ix Providing Feedback about Publications... ix Contacting Customer Support... ix Chapter 1. Installation Overview... 1 Supported Platforms... 1 Disk and Memory Requirements... 1 Installation Packages... 2 Software Prerequisites... 3 WebSEAL Server Prerequisites... 3 WebSEAL ADK Prerequisites... 4 Installation Overview... 5 Installing a New WebSEAL Server... 6 Upgrading a WebSEAL Server... 6 Using the Easy Installation Programs Chapter 2. Installing WebSEAL... 9 Installing WebSEAL Server on UNIX Installing WebSEAL Server on Solaris Installing WebSEAL Server on AIX Tivoli SecureWay Policy Director WebSEAL Installation Guide iii

6 Installing WebSEAL Server on HP-UX Configuring WebSEAL Server on UNIX Installing WebSEAL ADK on UNIX Installing WebSEAL ADK on Solaris Installing WebSEAL ADK on AIX Installing WebSEAL ADK on HP-UX Installing WebSEAL Server and WebSEAL ADK on Windows Chapter 3. Upgrading WebSEAL Supported Versions Upgrade Process Overview Preserving the WebSEAL Configuration Data Backing Up Information on the Management Server System Backing Up Information on Other WebSEAL Systems Upgrading WebSEAL on Solaris Upgrading WebSEAL on Windows Upgrading WebSEAL on AIX Upgrading WebSEAL on HP-UX Chapter 4. Removing WebSEAL Removing WebSEAL on Solaris Removing WebSEAL on Windows Removing WebSEAL and WebSEAL ADK Removing WebSEAL ADK Only Removing WebSEAL on AIX Removing WebSEAL on HP-UX Appendix A. Easy Installation Guide WebSEAL Easy Installation Programs iv Version 3.8

7 Using the WebSEAL Easy Installation Program Using the WebSEAL ADK Easy Installation Program Configuring WebSEAL Using the Easy Installation Programs Obtaining Configuration Settings Interactively Obtaining Configuration Settings from Response Files Easy Installation Limitations Tivoli SecureWay Policy Director WebSEAL Installation Guide v

8 vi Version 3.8

9 Preface Tivoli SecureWay Policy Director WebSEAL is a security manager for Web-based resources. WebSEAL is a high performance, multi-threaded Web server that applies fine-grained security policy to the protected Web object space. WebSEAL can provide single sign-on solutions and incorporate back-end Web application server resources into its security policy. Who Should Read This Guide The target audience for this installation guide includes: Security administrators System installation and deployment administrators Network system administrators IT architects Application developers What This Guide Contains This document contains the following chapters: Chapter 1, Installation Overview Lists the supported platforms and describes the software dependencies on the Policy Director Base. Chapter 2, Installing WebSEAL Describes how to install and configure WebSEAL and the WebSEAL software prerequisites on each of the supported operating system platforms. Chapter 3, Upgrading WebSEAL Describes how to upgrade a Version 3.7 WebSEAL server to Version 3.8. Chapter 4 Removing WebSEAL Tivoli SecureWay Policy Director WebSEAL Installation Guide vii

10 Publications Describes how to unconfigure and remove WebSEAL from each of the supported operating system platforms. Appendix A, Easy Installation Guide Describes how to use the WebSEAL easy installation program to expedite installation and configuration of WebSEAL. This section lists publications in the Tivoli SecureWay Policy Director WebSEAL library and any other related documents. It also describes how to access Tivoli publications online, how to order Tivoli publications, and how to make comments on Tivoli publications. Tivoli SecureWay Policy Director WebSEAL Library The following documents are available in the Tivoli SecureWay Policy Director WebSEAL library: Tivoli SecureWay Policy Director WebSEAL Installation Guide, GC Tivoli SecureWay Policy Director WebSEAL Administration Guide, GC Prerequisite Publications To be able to use the information in this book effectively, you must have some prerequisite knowledge, which you can get from the following books: Tivoli SecureWay Policy Director Base Installation Guide, GC Tivoli SecureWay Policy Director Base Administration Guide, GC Tivoli SecureWay Policy Director Web Portal Manager Administration Guide, GC Accessing Publications Online You can access many Tivoli publications online at the Tivoli Customer Support Web site: viii Version 3.8

11 These publications are available in PDF or HTML format, or both. Translated documents are also available for some products. Ordering Publications You can order many Tivoli publications online at the following Web site: You can also order by telephone by calling one of these numbers: In the United States: In Canada: In other countries, for a list of telephone numbers, see the following Web site: Providing Feedback about Publications We are very interested in hearing about your experience with Tivoli products and documentation, and we welcome your suggestions for improvements. If you have comments or suggestions about our products and documentation, contact us in one of the following ways: Send an to pubs@tivoli.com. Complete our customer feedback survey at the following Web site: Contacting Customer Support If you have a problem with any Tivoli product, you can contact Tivoli Customer Support. See the Tivoli Customer Support Handbook at the following Web site: Tivoli SecureWay Policy Director WebSEAL Installation Guide ix

12 The handbook provides information about how to contact Tivoli Customer Support, depending on the severity of your problem, and the following information: Registration and eligibility Telephone numbers and addresses, depending on the country you are in What information you should gather before contacting support x Version 3.8

13 1 Installation Overview 1. Installation Overview This chapter lists the WebSEAL installation packages and the WebSEAL software prerequisites. An installation overview section describes how to use the rest of this installation guide to either install a new WebSEAL server or upgrade an existing one. Supported Platforms Tivoli SecureWay Policy Director WebSEAL and the Tivoli SecureWay Policy Director WebSEAL ADK are supported on the following platforms: Solaris 2.7 and Solaris 2.8 AIX v The following patch is required on AIX 4.3.3: bos.rte.libpthreads (or greater) Windows NT 4.0 with Service Pack 6a Windows 2000 Advanced Server HP-UX 11.0 Disk and Memory Requirements WebSEAL has the following hardware requirements: Disk space: 10 MB Tivoli SecureWay Policy Director WebSEAL Installation Guide 1

14 When combined with the prerequisite Tivoli SecureWay Policy Director Runtime Environment (65 MB), the minimum required disk space is 75 MB. It is recommended that you reserve an additional 100 MB of disk space for WebSEAL log files. Memory: 64 MB Minimum. 256 MB Recommended. Note that the 64 MB minimum is in addition to the 64 MB minimum needed by the prerequisite Tivoli SecureWay Policy Director Runtime Environment. Total memory of 256 MB or greater will produce optimum performance results. Installation Packages The WebSEAL CD-ROM contains installation packages for the following WebSEAL software: Tivoli SecureWay Policy Director WebSEAL This package includes the WebSEAL server and configuration files. Tivoli SecureWay Policy Director WebSEAL Application Development Kit (ADK) This package contains development APIs for the Policy Director Cross Domain Authentication Service (CDAS) and the Policy Director Password Strength Module. The WebSEAL CD-ROM also contains the following software prerequisite packages: Tivoli SecureWay Policy Director Runtime Environment IBM SecureWay Directory Client IBM Global Security Toolkit Tivoli SecureWay Policy Director Authorization ADK 2 Version 3.8

15 Software Prerequisites WebSEAL is an application that installs and runs in a Policy Director secure domain. You must first establish a Policy Director secure domain before installing WebSEAL or WebSEAL ADK. The Policy Director secure domain is established when you install the Tivoli SecureWay Policy Director Management Server. This management server is distributed on the Tivoli SecureWay Policy Director Base CD-ROM for your operating system. 1. Installation Overview The following sections discuss the software prerequisites for each of the WebSEAL packages: WebSEAL Server Prerequisites WebSEAL ADK Prerequisites on page 4 WebSEAL Server Prerequisites The following software must be installed and configured on each computer that hosts the WebSEAL server: Tivoli SecureWay Policy Director Runtime Environment IBM SecureWay Directory Client IBM Global Security Toolkit (GSKit) To establish a secure domain, the following software must be installed and configured either on the same computer that hosts the WebSEAL server or on a remote computer: Tivoli SecureWay Policy Director Management Server A supported LDAP server, such as IBM SecureWay Directory Thus, there are two deployment scenarios for the WebSEAL server: 1. On the same computer as the Tivoli SecureWay Policy Director Management Server 2. On a different computer from the Tivoli SecureWay Policy Director Management Server Tivoli SecureWay Policy Director WebSEAL Installation Guide 3

16 In the first scenario, all of the WebSEAL prerequisites are satisfied during the installation and configuration of the management server. Installation of the management server requires installation of the Tivoli SecureWay Policy Director Runtime Environment, the IBM SecureWay Client, and the IBM Global Security Toolkit. When you deploy WebSEAL in this configuration, you can simply install WebSEAL without installing any further prerequisites. In the second scenario, you must first configure the computer into an existing Policy Director secure domain, and then install the WebSEAL server. To configure the computer into the Policy Director secure domain, you must install and configure the following software: Tivoli SecureWay Policy Director Runtime Environment IBM SecureWay Directory Client IBM Global Security Toolkit (GSKit) After you have configured the above prerequisites, you can install and configure WebSEAL. The Tivoli SecureWay Policy Director WebSEAL CD-ROM contains the prerequisite software. This prerequisite software is identical (the exact same version number) to the software contained on the Tivoli SecureWay Policy Director Base CD-ROMs. The copies on the Tivoli SecureWay Policy Director WebSEAL CD-ROM are provided to enable you to complete the Tivoli SecureWay Policy Director WebSEAL installation without having to access the Tivoli SecureWay Policy Director Base CD-ROMs. Note: The WebSEAL server has no dependencies on the Tivoli SecureWay Policy Director Authorization Server. This authorization server is distributed as part of the Tivoli SecureWay Policy Director Base for your operating system. WebSEAL ADK Prerequisites The following software must be installed and configured on the same computer as the WebSEAL ADK: 4 Version 3.8

17 Tivoli SecureWay Policy Director WebSEAL server Tivoli SecureWay Policy Director Authorization Application Development Kit (ADK) Tivoli SecureWay Policy Director Runtime Environment IBM SecureWay Directory Client IBM Global Security Toolkit To install and use the WebSEAL ADK, you must first install and configure a WebSEAL server. This requires that you satisfy the prerequisites described directly above in WebSEAL Server Prerequisites on page Installation Overview In addition, you must install the Tivoli SecureWay Policy Director Authorization ADK. The Authorization ADK is included as a separately installable package on the Tivoli SecureWay Policy Director Base CD-ROM for your operating system. This ADK is also included on the WebSEAL CD-ROM. Complete installation instructions for the Authorization ADK are included in the Tivoli SecureWay Policy Director Base Installation Guide. Summary installation instructions are also included in this WebSEAL installation guide. Note: The Authorization ADK does not require any configuration steps. Thus, installation of the Authorization ADK consists solely of file extraction to the hard disk. Installation Overview This document provides three sets of installation instructions. You can complete a WebSEAL installation by following one of the sets of instructions, as appropriate for your deployment on WebSEAL. The following sections provide a quick summary of each instruction set: Installing a New WebSEAL Server on page 6 Upgrading a WebSEAL Server on page 6 Tivoli SecureWay Policy Director WebSEAL Installation Guide 5

18 Using the Easy Installation Programs on page 7 Installing a New WebSEAL Server To install a new WebSEAL server, complete the instructions in Chapter 3, Installing WebSEAL. This chapter describes how to install and configure the WebSEAL server and the WebSEAL Application Development Kit (ADK). This chapter also includes instructions for installing the software prerequisites for WebSEAL and WebSEAL ADK. The instructions in this chapter describe how to install using the operating system installation utilities, such as pkgadd, SMIT, swinstall, or InstallShield. The instructions for configuring WebSEAL describe how to use the Tivoli SecureWay Policy Director configuration utility. As an alternative to this chapter, you may be able to use the WebSEAL easy installation guide. Easy installation is described in Appendix A, Easy Installation Guide. Upgrading a WebSEAL Server The WebSEAL installation software supports an upgrade of WebSEAL from Version 3.7 to Version 3.8. To complete an upgrade of a WebSEAL server, follow the instructions in Chapter 4, Upgrading WebSEAL. Note: When upgrading a WebSEAL server, you do not need to complete the instructions in Chapter 2, Installing WebSEAL. Also, you cannot use the instructions in Appendix A, Easy Installation Guide. The WebSEAL upgrade process requires upgrading the following prerequisite software: Tivoli SecureWay Policy Director Runtime Environment IBM SecureWay Directory Client IBM Global Security Toolkit 6 Version 3.8

19 The WebSEAL upgrade process is closely tied to the upgrade process for the Tivoli SecureWay Policy Director Management Server. The instructions in Chapter 3, Upgrading WebSEAL must be used in conjunction with the management server upgrade instructions in the Tivoli SecureWay Policy Director Base Installation Guide. Using the Easy Installation Programs WebSEAL provides easy installation programs that you can use to expedite the installation and configuration of the WebSEAL server and the WebSEAL ADK. These programs provide a simple user interface that serves as a wrapper to the operating system installation utilities. These programs are described in Appendix A, Easy Installation Guide. 1. Installation Overview The easy installation programs prompt the user for the necessary configuration information for WebSEAL, WebSEAL ADK, and the software prerequisites. The easy installation programs then automatically install and configure WebSEAL, WebSEAL ADK and the software prerequisites. For many deployments of WebSEAL, you can use the instructions in Appendix A, Easy Installation Guide instead of those in Chapter 2, Installing WebSEAL. You cannot use the easy installation program to upgrade WebSEAL from Version 3.7 to Version 3.8. Tivoli SecureWay Policy Director WebSEAL Installation Guide 7

20 8 Version 3.8

21 2 Installing WebSEAL This chapter provides instructions for installing and configuring the WebSEAL packages. This chapter also provides instructions for installing the software prerequisites for each WebSEAL package. Note: If you are upgrading WebSEAL from a Tivoli SecureWay Policy Director Version 3.7 installation, do not use this chapter. See Upgrading WebSEAL on page 27. The WebSEAL product consists of two packages: WebSEAL Server WebSEAL Application Development Kit (ADK) 2. Installing WebSEAL You can install the WebSEAL server without installing the WebSEAL ADK. If you want to install the WebSEAL ADK, you must install the WebSEAL server as a prerequisite. Both the WebSEAL server and the WebSEAL ADK require that the Tivoli SecureWay Policy Director Runtime Environment is installed and configured. In addition, the WebSEAL ADK requires that the Tivoli SecureWay Policy Director Authorization ADK is installed. The prerequisite packages for both the WebSEAL server and the WebSEAL ADK are included on the WebSEAL CD. The installation instructions in this chapter describe how to install each of the prerequisite packages. Tivoli SecureWay Policy Director WebSEAL Installation Guide 9

22 Note: For complete installation instructions and configuration options for the Tivoli SecureWay Policy Director Runtime Environment and the Tivoli SecureWay Policy Director Authorization ADK, see the Tivoli SecureWay Policy Director Base Installation Guide. This chapter contains separate sections for installing WebSEAL server and WebSEAL ADK on each supported UNIX system. You must complete the UNIX section for installing WebSEAL server before you use the UNIX section for installing WebSEAL ADK. Instructions for installing WebSEAL server and WebSEAL ADK on Windows are included in one section. Note: As an alternative to the instructions in this chapter, you may be able to use the WebSEAL easy installation program. For more information, see Easy Installation Guide on page 57. To install WebSEAL, see the instructions in the appropriate section below: Installing WebSEAL Server on UNIX on page 10 Installing WebSEAL ADK on UNIX on page 19 Installing WebSEAL Server and WebSEAL ADK on Windows on page 22 Installing WebSEAL Server on UNIX This section contains separate instructions for installing WebSEAL server on each supported UNIX platform. This section also contains one section for configuring a WebSEAL server on UNIX. The section for configuring a WebSEAL server applies to all UNIX platforms. To install a WebSEAL server on a UNIX system, complete the instructions in the appropriate section: Installing WebSEAL Server on Solaris on page 11 Installing WebSEAL Server on AIX on page Version 3.8

23 Installing WebSEAL Server on HP-UX on page 15 After you complete the installation instructions in the sections above, configure the WebSEAL server by using the instructions in the following section: Configuring WebSEAL Server on UNIX on page 16 Installing WebSEAL Server on Solaris The WebSEAL installation separates file extraction from package configuration. Use pkgadd to install software packages on Solaris. Then use the Tivoli SecureWay Policy Director configuration utility pdconfig to configure WebSEAL. Note: If you have already installed and configured WebSEAL and need to reinstall it, you must first unconfigure and remove the WebSEAL package. See Removing WebSEAL on page 47. To install a WebSEAL server on Solaris complete the following instructions: 1. Log in as user root. 2. Installing WebSEAL 2. Mount the Tivoli SecureWay Policy Director WebSEAL CD on /cdrom/cdrom0. 3. Change directory to /cdrom/cdrom0/solaris. 4. Verify that this computer has the Tivoli SecureWay Policy Director Runtime Environment configured. The runtime environment will be configured if the Tivoli SecureWay Policy Director Management Server is installed on this computer, or if the computer has previously been added to the Policy Director secure domain. 5. If this computer already has the runtime environment configured, skip this step. Go to the next step. If this computer does not have the Tivoli SecureWay Policy Director Runtime Environment configured, install and configure the necessary software prerequisites by completing the following instructions: Tivoli SecureWay Policy Director WebSEAL Installation Guide 11

24 a. Enter the following command to install the IBM Global Security Toolkit: # pkgadd -d. gsk4bas b. Enter the following command to install the IBM SecureWay Directory Client: # pkgadd -d. IBMldapc c. Enter the following command to install the Tivoli SecureWay Policy Director Runtime Environment: # pkgadd -d. PDRTE d. Enter the following command to configure the Tivoli SecureWay Policy Director Runtime Environment: # pdconfig For further installation and configuration instructions for each of the packages above, see the Tivoli SecureWay Policy Director Base Installation Guide. 6. Enter the following command to install the WebSEAL server package: # pkgadd -d. PDWeb When prompted to continue, type y and press Enter. Files are extracted from the CD-ROM and installed on the hard disk. A message appears indicating that installation of the WebSEAL package was successful. The pkgadd utility exits. 7. Next, configure the WebSEAL server. Go to the following section: Configuring WebSEAL Server on UNIX on page 16. Installing WebSEAL Server on AIX The WebSEAL installation separates file extraction from package configuration. Use SMIT to install software packages on AIX. Then use the Tivoli SecureWay Policy Director configuration utility pdconfig to configure WebSEAL. Note: If you have already installed and configured WebSEAL and need to reinstall it, you must first unconfigure and remove the WebSEAL package. See Removing WebSEAL on page Version 3.8

25 To install a WebSEAL server on AIX complete the following instructions: 1. Log in as root. 2. Verify that your AIX system has the following patch installed: bos.rte.libpthreads (or greater) 3. Insert the Tivoli SecureWay Policy Director WebSEAL CD into the CD-ROM drive. 4. Determine if this computer already has the Tivoli SecureWay Policy Director Runtime Environment configured. The runtime environment will already be configured if the Tivoli SecureWay Policy Director Management Server is installed on this computer, or if the computer has previously been added to the Policy Director secure domain. 5. If this computer already has the runtime environment configured, skip this step. Go to the Step 5. If this computer does not have the runtime environment configured, install and configure the software prerequisites for the WebSEAL server by completing the following instructions: 2. Installing WebSEAL a. Use the SMIT utility to install the software prerequisites. # smit The SMIT utility starts. b. List the packages available for installation, and select the following: IBM Global Security Toolkit The install package is gskit. The menu description is AIX Certificate and SSL Base Runtime ACME Toolkit. IBM SecureWay Directory Client The installation package is ldap.client Tivoli SecureWay Policy Director Runtime Environment The installation package is PD.RTE Tivoli SecureWay Policy Director WebSEAL Installation Guide 13

26 c. Follow the SMIT menus to install each of the selected packages. d. Use the SMIT menus to configure the Tivoli SecureWay Policy Director Runtime Environment. For further installation and configuration instructions for the software prerequisites, see the Tivoli SecureWay Policy Director Base Installation Guide. 6. Enter the following command at a shell prompt: # smit The SMIT utility starts. 7. Select Software Installation and Maintenance. Select Install and Update Software. Select Install and Update Software from LATEST Available Software. 8. When prompted for input device, enter the location where the CD is mounted. 9. Click the List button for SOFTWARE to install. A Multi-select List window displays the list of Tivoli SecureWay Policy Director software packages. 10. Select the Policy Director WebSEAL package. Click OK. 11. The Install and Update Software from LATEST Available Software dialog box appears. 12. Verify that the default value of yes is present in the field labeled AUTOMATICALLY install requisite software. 13. Set other fields to values appropriate to your installation. In most cases, you can accept the default values. Click OK. 14. A message box appears asking if you are sure you want to install this package. Click OK. The package files are installed. Several status messages are displayed. A final status message indicates success upon completion of file extraction. 15. Click Done. Click Cancel to exit SMIT. 14 Version 3.8

27 16. Next, configure the WebSEAL server. Go to: Configuring WebSEAL Server on UNIX on page 16. Installing WebSEAL Server on HP-UX The WebSEAL installation separates file extraction from package configuration. Use swinstall to install software packages on HP-UX. Then use the Tivoli SecureWay Policy Director configuration utility pdconfig to configure WebSEAL. Note: If you have already installed and configured WebSEAL and need to reinstall it, you must first unconfigure and remove the WebSEAL package. See Removing WebSEAL on page 47. To install a WebSEAL server on HP-UX, complete the following steps: 1. Log in as user root. 2. Insert the Tivoli SecureWay Policy Director WebSEAL CD in the drive. Use the following commands to mount the CD: # nohup /usr/sbin/pfs_mountd & # nohup /usr/sbin/pfsd & # /usr/sbin/pfs_mount <mount-device> <mount-point> 2. Installing WebSEAL For example: # /usr/sbin/pfs_mount/dev/dsk/c0t0d0 /cdrom 3. Change directory to hp. 4. Determine if this computer already has the Tivoli SecureWay Policy Director Runtime Environment configured. The runtime environment will already be configured if the Tivoli SecureWay Policy Director Management Server is installed on this computer, or if the computer has previously been added to the Policy Director secure domain. 5. If this computer already has the runtime environment configured, skip this step. Go to the Step 6. If this computer does not have the runtime environment configured, install and configure the software prerequisites for the WebSEAL server by completing the following instructions: Tivoli SecureWay Policy Director WebSEAL Installation Guide 15

28 a. Enter the following command to install the IBM Global Security Toolkit: # swinstall -s /cdrom/hp gsk4bas b. Enter the following command to install the IBM SecureWay Directory Client: # swinstall -s /cdrom/hp LDAP c. Enter the following command to install the Tivoli SecureWay Policy Director Runtime Environment: # swinstall -s /cdrom/hp PDRTE d. Enter the following command to configure the Tivoli SecureWay Policy Director Runtime Environment: # pdconfig For further installation and configuration instructions for the WebSEAL server prerequisites, see the Tivoli SecureWay Policy Director Base Installation Guide. 6. Enter the following command to install the WebSEAL server package: # swinstall -s /cdrom/hp PDWeb A message appears indicating that the analysis phase has succeeded. Another message appears indicating that the execution phase is beginning. Files are extracted from the CD-ROM and installed on the hard disk. A message appears indicating that the execution phase has succeeded. The swinstall utility exits. 7. Next, configure the WebSEAL server. Go to: Configuring WebSEAL Server on UNIX on page 16. Configuring WebSEAL Server on UNIX Use the Tivoli SecureWay Policy Director configuration utility pdconfig to configure WebSEAL on a UNIX platform. The configuration steps for the WebSEAL server are identical on all UNIX platforms. To configure a WebSEAL server on a UNIX system, complete the following instructions: 16 Version 3.8

29 1. Enter the following command at a UNIX shell prompt: # pdconfig On AIX, you can optionally use SMIT instead of pdconfig to configure WebSEAL. Within SMIT, select Communications Applications and Services, and then select Policy Director. You can then follow the rest of the instructions in this section. The Policy Director Setup Menu appears. 2. Type the menu number for Configure Package. The Policy Director Configuration Menu appears. 3. Type the menu number for Policy Director WebSEAL (PDWeb) Configuration. A prompt appears requesting you to enter the password of the Policy Director Administrator. 4. Enter the password for sec_master. You are prompted to enable SSL communication between the WebSEAL server and the LDAP server. 2. Installing WebSEAL 5. Choose one of the following actions: If you want to enable SSL communication, type y and press Enter. If you do not want to enable SSL communications, type n and press Enter. The current Web server configuration values are displayed. 6. If you disabled SSL communication, go to the next step. If you have enabled SSL communication, provide the following values when prompted: LDAP SSL Client Key Ring File Location SSL Client Certificate Label (optional) The client certificate label is usually not required. This label is needed only when the LDAP server is configured to ask for client-side certificates. Typically, LDAP servers require only Tivoli SecureWay Policy Director WebSEAL Installation Guide 17

30 server-side certificates. If your LDAP server does not require client-side certificates, you can just press Enter at this prompt. SSL Client Key File Password LDAP Server SSL port number. The default port is 636. The SSL configuration is now complete. The current Web server configuration values are displayed. 7. Check the Web server configuration values. Modify any that need to be changed. In most cases, you can accept the default values. The following screen dialog appears: Please check Web Server configuration: 1. Enable TCP HTTP? Yes 2. HTTP Port80 3. Enable HTTPS? Yes 4. HTTPS Port Web documentrootdirectory /opt/pdweb/www/docs a. Accept configuration and continue with installation x. Exit installation Select item to change: Note: If you are running any other Web servers on this computer, verify that the TCP HTTP port for the other servers does not conflict with the WebSEAL TCP HTTP port. 8. When you are satisfied that the configuration is correct, type the letter a to accept the configuration and continue the installation. Press Enter. Several status messages appear as the WebSEAL server is configured. When the configuration is complete, a status message indicates that the WebSEAL server is starting. When the WebSEAL server is running, a final message appears indicating that the configuration of the WebSEAL server package was successful. 9. Press Enter to continue. The Policy Director Configuration Menu appears. 10. Press Enter to select the default choice of x to exit the utility. 18 Version 3.8

31 Installing WebSEAL ADK on UNIX This section contains instructions for installing the WebSEAL ADK on each of the supported UNIX platforms. Note: The WebSEAL ADK has a prerequisite on the WebSEAL server. If you have not yet installed a WebSEAL server, go to Installing WebSEAL Server on UNIX on page 10 To install the WebSEAL ADK, follow the instructions in the appropriate section: Installing WebSEAL ADK on Solaris Installing WebSEAL ADK on AIX on page 20 Installing WebSEAL ADK on HP-UX on page 21 Installing WebSEAL ADK on Solaris To install the WebSEAL ADK on Solaris, complete the following instructions: 1. Verify that the WebSEAL server package has been installed and configured. If the WebSEAL server has not been installed, complete the instructions in Installing WebSEAL Server on Solaris on page Installing WebSEAL 2. Verify the following information: You are logged in as root The Tivoli SecureWay PolicyDirector WebSEAL CD-ROM is mounted on /cdrom/cdrom0 The current directory is /cdrom/cdrom0/solaris. 3. Enter the following command to install the Tivoli SecureWay Policy Director Authorization ADK: # pkgadd -d. PDAuthADK When prompted to continue, type y and press Enter. Files are extracted from the CD-ROM and installed on the hard disk. A status message appears indicating that installation of the Tivoli Tivoli SecureWay Policy Director WebSEAL Installation Guide 19

32 SecureWay Policy Director Authorization ADK package was successful. The pkgadd utility exits. 4. Enter the following command to install the WebSEAL ADK: # pkgadd -d. PDWebADK When prompted to continue, type y and press Enter. Files are extracted from the CD-ROM and installed on the hard disk. A status message appears indicating that installation of the WebSEAL ADK package was successful. The pkgadd utility exits. The WebSEAL ADK does not require any configuration. Installation of the WebSEAL ADK is now complete. Installing WebSEAL ADK on AIX To install the WebSEAL ADK on AIX, complete the following instructions: 1. Verify that the WebSEAL server package has been installed and configured. If the WebSEAL server has not been installed, complete the instructions in Installing WebSEAL Server on AIX on page Verify that you are logged in as root and that the Tivoli SecureWay PolicyDirector WebSEAL CD-ROM is in the CD-ROM drive. 3. Enter the following command at a shell prompt: # smit The SMIT utility starts. 4. Select Software Installation and Maintenance. Select Install and Update Software. Select Install and Update Software from LATEST Available Software. 5. When prompted for input device, enter the location where the CD is mounted. 6. Click the List button for SOFTWARE to install. 20 Version 3.8

33 A Multi-select List window displays the list of Tivoli SecureWay Policy Director software packages. 7. Select the following packages: Policy Director WebSEAL ADK Policy Director Authorization ADK Click OK. 8. The Install and Update Software from LATEST Available Software dialog box appears. 9. Verify that the default value of yes is present in the field labeled AUTOMATICALLY install requisite software. 10. Set other fields to values appropriate to your installation. In most cases, you can accept the default values. Click OK. 11. A message box appears asking if you are sure you want to install these packages. Click OK. The package files are installed. Several status messages are displayed. A final status message indicates success upon completion of file extraction. 2. Installing WebSEAL 12. Click Done. Click Cancel to exit SMIT. The WebSEAL ADK does not require any configuration. Installation of the WebSEAL ADK is now complete. Installing WebSEAL ADK on HP-UX To install the WebSEAL ADK on HP-UX, complete the following instructions: 1. Verify that the WebSEAL server package has been installed and configured. If a WebSEAL server has not been installed, complete the instructions in Installing WebSEAL Server on HP-UX on page Verify the following information: You are logged in as root Tivoli SecureWay Policy Director WebSEAL Installation Guide 21

34 The Tivoli SecureWay Policy Director WebSEAL CD is mounted. If the CD is not mounted, enter the following commands: # nohup /usr/sbin/pfs_mountd & # nohup /usr/sbin/pfsd & # /usr/sbin/pfs_mount <mount-device> <mount-point> For example: # /usr/sbin/pfs_mount/dev/dsk/c0t0d0 /cdrom The current working directory is /cdrom/hp. 3. Enter the following command to install the Tivoli SecureWay Policy Director Authorization ADK: # swinstall -s /cdrom/hp PDAuthADK When prompted to continue, type y and press Enter. Files are extracted from the CD-ROM and installed on the hard disk. A status message appears indicating that installation of the Tivoli SecureWay Policy Director Authorization ADK package was successful. The swinstall utility exits. 4. Enter the following command to install the WebSEAL ADK: # swinstall -s /cdrom/hp PDWebADK When prompted to continue, type y and press Enter. Files are extracted from the CD-ROM and installed on the hard disk. A status message appears indicating that installation of the Tivoli SecureWay Policy Director WebSEAL ADK package was successful. The swinstall utility exits. The WebSEAL ADK does not require any configuration. Installation of the WebSEAL ADK is now complete. Installing WebSEAL Server and WebSEAL ADK on Windows The WebSEAL installation separates file extraction from package configuration. Use an InstallShield setup.exe to install the WebSEAL files. Next, use the Tivoli SecureWay Policy Director configuration utility to configure the WebSEAL server. 22 Version 3.8

35 Note: If you have already installed and configured WebSEAL and need to reinstall it, you must first unconfigure and remove the WebSEAL package. See Removing WebSEAL on page 47. To install and configure WebSEAL on Windows complete the following instructions: 1. Log in to the Windows domain as a user with Windows administrator privileges. 2. Insert the Tivoli SecureWay Policy Director WebSEAL CD into the CD-ROM drive. 3. Verify that this computer has the Tivoli SecureWay Policy Director Runtime Environment configured. The runtime environment will be configured if the Tivoli SecureWay Policy Director Management Server is installed on this computer, or if the computer has previously been added to the Policy Director secure domain. 4. If this computer has the runtime environment configured, skip this step. Go to Step 5. If this computer does not have the runtime environment configured, install and configure the software prerequisites for the WebSEAL server by completing the following instructions: 2. Installing WebSEAL a. Run the IBM Global Security Toolkit setup program: (where the letter E: in the following command represents the CD-ROM drive): E: \Windows\gskit\setup.exe b. Run the IBM SecureWay Directory Client setup program: E:\Windows\Directory\setup.exe c. Run the Tivoli SecureWay Policy Director Runtime Environment setup program: E:\Windows\PolicyDirector\Disk Images\Disk1\ Pdrte\Disk Images\Disk1\setup.exe d. Use the Tivoli SecureWay Policy Director configuration utility to configure the runtime environment. Select Start > Programs > Policy Director > Configuration. Tivoli SecureWay Policy Director WebSEAL Installation Guide 23

36 For complete instructions on how to configure the runtime environment, see the Tivoli SecureWay Policy Director Base Installation Guide. e. If you want to install the WebSEAL ADK, you must install the prerequisite Tivoli SecureWay Policy Director Authorization ADK. Run the Authorization ADK setup program: E:\Windows\PolicyDirector\PDAuthADK\ Disk Images\Disk1\setup.exe The Tivoli SecureWay Policy Director Authorization ADK does not require any configuration. 5. Run the WebSEAL InstallShield setup program by double-clicking on the following file (where the letter E: in the following command represents the CD-ROM drive): E:\Windows\PolicyDirector\Disk Images\Disk1\ WebSEAL\Disk Images\Disk 1\setup.exe The Choose Setup Language dialog box appears. 6. Select the appropriate language and click OK. The InstallShield program starts and the Welcome dialog box appears. 7. Click Next. The License Agreement dialog box appears. 8. Click Yes to accept the License Agreement. The Choose Destination Location dialog box appears. 9. Accept the default or specify an alternative location. Click Next. The Select Components dialog box appears. 10. Select the check box for each package that you want to install: PDWeb This package contains the WebSEAL server and utilities. PDWebADKs 24 Version 3.8

37 This package contains WebSEAL Application Development Kits (ADKs). You must install PDWeb when you install PDWebADKs. The files for the selected packages are extracted to the disk. A message appears indicating that the packages have been installed. 11. Click Finish to exit the setup program. 12. Select Start > Programs > Policy Director > Configuration. The Policy Director Configuration dialog box appears. Note: The WebSEAL ADK does not require any configuration. 13. Select Policy Director WebSEAL (PDWeb). Click Configure. The HTTP properties dialog box appears. 14. Select or deselect the Allow unsecure TCP HTTP access check box. If you allowed unsecure TCP HTTP access, specify the port number. In most cases, you can accept the default port number of Installing WebSEAL Note: If you are running any other Web servers on this computer, verify that the TCP HTTP port for the other servers does not conflict with the WebSEAL TCP HTTP port. 15. Select or deselect the Allow HTTPS access check box. If you allowed HTTPS access, specify the port number. In most cases, you can accept the default port number of 443. Click OK. The Policy Director Administrator Password dialog box appears. 16. Enter the password for sec_master. The status message Configuring Policy Director WebSEAL appears. When configuration completes, a status message states that the configuration was successful. The Policy Director Configuration dialog box appears. 17. Click Close to exit the configuration utility. Tivoli SecureWay Policy Director WebSEAL Installation Guide 25

38 Installation and configuration of WebSEAL on Windows is now complete. 26 Version 3.8

39 3 Upgrading WebSEAL Tivoli SecureWay Policy Director supports an upgrade of WebSEAL from Version 3.7 to Version 3.8. This chapter describes how to preserve the Version 3.7 WebSEAL information and how to use that information to upgrade a WebSEAL server to Version 3.8. Note: If you are installing a new WebSEAL server, do not use this chapter. See Installing WebSEAL on page 9. Supported Versions Upgrade of WebSEAL is supported from Version 3.7 or Version to Version 3.8. Upgrade of prior versions of WebSEAL to Version 3.8 is not supported. The instructions in this chapter will refer to Version 3.7. These instructions apply to Version 3.7 and point releases such as Version Upgrade Process Overview The WebSEAL upgrade process consists of the following steps: 1. Preserve Version 3.7 configuration information 2. Uninstall Version 3.7 files 3. Install Version 3.8 files 4. Restore Version 3.7 configuration onto Version 3.8 servers 3. Upgrading WebSEAL Tivoli SecureWay Policy Director WebSEAL Installation Guide 27

40 The preservation of Version 3.7 WebSEAL information is partly accomplished during the upgrade of the Tivoli SecureWay Policy Director Management Server. Additional steps are needed outside of the management server upgrade, to preserve WebSEAL junction databases and WebSEAL configuration information on computers that do not run the management server. To use this chapter, first complete the data preservation steps in the section: Preserving the WebSEAL Configuration Data on page 28. The rest of the steps -- uninstall, install, and restore -- are described together in one section per each supported operating system type. The restore step is automated, with the exception of one manual step needed on the AIX platform only. The sections are: After you preserve the WebSEAL configuration data, complete the upgrade steps in the section appropriate for your operating system: Upgrading WebSEAL on Solaris on page 33 Upgrading WebSEAL on Windows on page 36 Upgrading WebSEAL on AIX on page 39 Upgrading WebSEAL on HP-UX on page 42 Preserving the WebSEAL Configuration Data When you want to upgrade WebSEAL from Version 3.7 to Version 3.8, you must backup information for both Tivoli SecureWay Policy Director Management Server and the WebSEAL server. If your deployment consists of only one Policy Director computer which hosts both the management server and WebSEAL, you can perform all backup steps on one computer. If your deployment consists of more than one computer, and a WebSEAL server is located on a different host than the management server, you need to perform backup steps on both the management 28 Version 3.8

41 server and on each WebSEAL server. You will perform backup steps on the management server first, and then perform backup steps on each WebSEAL server. The WebSEAL backup process consists of the following steps: 1. Performing a backup on the management server system. Complete the steps in Backing Up Information on the Management Server System. 2. Performing a backup on each WebSEAL system that is not on the same computer as the management server system. Complete the steps in Backing Up Information on Other WebSEAL Systems on page 32. Backing Up Information on the Management Server System This following instructions review the backup steps for the management server, and describe the specific backup steps that are needed by WebSEAL Server. Read these instructions before beginning a backup of the Management Server, so that you understand where in the backup process for the Management Server that WebSEAL data is preserved. Do not, however, use these steps to perform the management server upgrade steps that are not specific to WebSEAL. Instead, follow the complete instructions for both backup and restore of the management server in the Tivoli SecureWay Policy Director Base Installation Guide. The following steps summarize the backup process on the Tivoli SecureWay Policy Director Management Server: 1. You will need to copy the necessary files from the directory on the Tivoli SecureWay Policy Director Base CD for your platform onto the system hard disk. These files include the utilities migrate37, migrate38, and pdupgrade, plus the configuration file migrate.conf. You will need to edit migrate.conf to configure it for your secure domain. 3. Upgrading WebSEAL Tivoli SecureWay Policy Director WebSEAL Installation Guide 29

42 If you have a WebSEAL server running on a computer that does not host the management server, you will need to, at a later step, copy this file to the WebSEAL server. For complete information on using these utilities, and for information on editing migrate.conf, see the Tivoli SecureWay Policy Director Base Installation Guide. 2. Next, you will need to back up management server system data by calling migrate37 several times to preserve information such as access control lists (ACLs), objects, protected object policies (pops), users, and server configuration information. For example, the following command backups up ACLs on a UNIX system that has migrate.conf located in /tmp: # migrate -t backup -s acls -f <output xml file> -r /opt/policydirector/ivmgrd/lib/ivmgrd.conf -e <error file> -l /tmp/migrate.conf -d <registry type> The management server maintains ACL information that is specific to WebSEAL, such as the default-webseal ACL. This information is included in an ACL database that contains ACL information for the entire secure domain. You will need to issue a number of other migrate backup commands as part of the Management Server upgrade. The other commands are not specific to WebSEAL. For complete instructions on the necessary migrate commands, see the Tivoli SecureWay Policy Director Base Installation Guide. 3. Backup the WebSEAL junction database. Attention: This step is specific to WebSEAL and must be performed on the management server system during the management server upgrade. The standard management server backup commands do not preserve WebSEAL junction database information. Enter the following command: migrate -t backup -s webseal -f <TEMP>jct_backup.xml -r <Install path>/ivmgrd/lib/ivmgrd.conf -l /tmp/migrate.conf -e <error file> -d <registry type> 30 Version 3.8