IBM Tivoli Access Manager WebSEAL for Linux on zseries. Installation Guide. Version 3.9 GC

Transcription

1 IBM Tioli Access Manager WebSEAL for Linux on zseries Installation Guide Version 3.9 GC

2

3 IBM Tioli Access Manager WebSEAL for Linux on zseries Installation Guide Version 3.9 GC

4 Note Before using this information and the product it supports, read the information in Notices on page 11. Fifth Edition: (April 2002) This edition replaces GC Copyright International Business Machines Corporation All rights resered. US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface Who should read this guide What this guide contains Publications i IBM Tioli Access Manager i Related publications iii Accessing publications online ix Ordering publications x Proiding feedback about publications..... x Accessibility x Contacting customer support x Conentions used in this book xi Typeface conentions xi Chapter 1. Installation requirements.. 1 Supported platforms Disk and memory requirements Installation packages Software prerequisites WebSEAL serer prerequisites WebSEAL ADK prerequisites Limitations for this release Chapter 2. Installing WebSEAL Installing WebSEAL serer Installing WebSEAL ADK Chapter 3. Remoing WebSEAL Appendix. Notices Trademarks Copyright IBM Corp iii

6 i IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

7 Preface Who should read this guide What this guide contains IBM Tioli Access Manager WebSEAL for Linux on zseries is a security manager for Web-based resources. WebSEAL is a high performance, multi-threaded Web serer that applies fine-grained security policy to the protected Web object space. WebSEAL can proide single sign-on solutions and incorporate back-end Web application serer resources into its security policy. Note: IBM Tioli Access Manager is the new name of the preiously released software entitled Tioli SecureWay Policy Director. Also, for users familiar with the Tioli SecureWay Policy Director software and documentation, the term management serer is now referred to as policy serer. The IBM Tioli Access Manager WebSEAL for Linux on zseries Installation Guide explains how to install, configure, and remoe Access Manager WebSEAL software. The target audience for this installation guide includes: Security administrators Network system administrators IT architects Application deelopers Reader s should be familiar with: Internet protocols, including HTTP, TCP/IP, file transfer protocol (FTP), and telnet Deployment and management of Web serers Security management, including authentication and authorization If you are using Secure Sockets Layer (SSL) communication, you also should be familiar with SSL protocol, key exchange (public and priate), digital signatures, cryptographic algorithms, and certificate authorities. This document contains the following chapters: Chapter 1, Installation oeriew Lists the supported platforms and describes the software dependencies on the Policy Director Base. Chapter 2, Installing WebSEAL Describes how to install and configure WebSEAL and the WebSEAL software prerequisites. Chapter 3 Remoing WebSEAL Describes how to unconfigure and remoe WebSEAL. Copyright IBM Corp. 2002

8 Publications This section lists publications in the Access Manager library and any other related documents. It also describes how to access Tioli publications online, how to order Tioli publications, and how to make comments on Tioli publications. IBM Tioli Access Manager The Access Manager library is organized into the following categories: Release information Base information WebSEAL information Web security information Deeloper reference information Supplemental technical information Publications in the product library are included in Portable Document Format (PDF) on the product CD. To access these publications using a Web browser, open the infocenter.html file, which is located in the /doc directory on the product CD. For additional sources of information about Access Manager and related topics, see the following Web sites: Release information IBM Tioli Access Manager for e-business Read Me First GI (am39_readme.pdf) Proides information for installing and getting started using Access Manager. IBM Tioli Access Manager for e-business Release Notes GI (am39_relnotes.pdf) Proides late-breaking information, such as software limitations, workarounds, and documentation updates. Base information IBM Tioli Access Manager Base Installation Guide GC (am39_install.pdf) Explains how to install, configure, and upgrade Access Manager software, including the Web portal manager interface. IBM Tioli Access Manager Base Administrator s Guide GC (am39_admin.pdf) Describes the concepts and procedures for using Access Manager serices. Proides instructions for performing tasks from the Web portal manager interface and by using the pdadmin command. IBM Tioli Access Manager Base for Linux on zseries Installation Guide GC (am39_zinstall.pdf) Explains how to install and configure Access Manager Base for Linux on the zseries platform. WebSEAL information IBM Tioli Access Manager WebSEAL Installation Guide GC (amweb39_install.pdf) Proides installation, configuration, and remoal instructions for the WebSEAL serer and the WebSEAL application deelopment kit. i IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

9 IBM Tioli Access Manager WebSEAL Administrator s Guide GC (amweb39_admin.pdf) Proides background material, administratie procedures, and technical reference information for using WebSEAL to manage the resources of your secure Web domain. IBM Tioli Access Manager WebSEAL Deeloper s Reference GC (amweb39_deref.pdf) Proides administration and programming information for the Cross-domain Authentication Serice (CDAS), the Cross-domain Mapping Framework (CDMF), and the Password Strength Module. IBM Tioli Access Manager WebSEAL for Linux on zseries Installation Guide GC (amweb39_zinstall.pdf) Proides installation, configuration, and remoal instructions for WebSEAL serer and the WebSEAL application deelopment kit for Linux on the zseries platform. Web security information IBM Tioli Access Manager for WebSphere Application Serer User s Guide, GC (amwas39_user.pdf) Proides installation, remoal, and administration instructions for Access Manager for IBM WebSphere Application Serer. IBM Tioli Access Manager for WebLogic Serer User s Guide GC (amwls39_user.pdf) Proides installation, remoal, and administration instructions for Access Manager for BEA WebLogic Serer. IBM Tioli Access Manager Plug-in for Edge Serer User s Guide GC (amedge39_user.pdf) Describes how to install, configure, and administer the plug-in for IBM WebSphere Edge Serer. IBM Tioli Access Manager Plug-in for Web Serers User s Guide GC (amws39_user.pdf) Proides installation instructions, administration procedures, and technical reference information for securing your Web domain using the plug-in for Web serers application. Deeloper references IBM Tioli Access Manager Authorization C API Deeloper s Reference, GC (am39_authc_deref.pdf) Proides reference material that describes how to use the Access Manager authorization C API and the Access Manager serice plug-in interface to add Access Manager security to applications. IBM Tioli Access Manager Authorization Jaa Classes Deeloper s Reference GC (am39_authj_deref.pdf) Proides reference information for using the Jaa language implementation of the authorization API to enable an application to use Access Manager security. IBM Tioli Access Manager Administration C API Deeloper s Reference GC (am39_adminc_deref.pdf) Proides reference information about using the administration API to enable an application to perform Access Manager administration tasks. This document describes the C implementation of the administration API. Preface ii

10 IBM Tioli Access Manager Administration Jaa Classes Deeloper s Reference SC (am39_adminj_deref.pdf) Proides reference information for using the Jaa language implementation of the administration API to enable an application to perform Access Manager administration tasks. IBM Tioli Access Manager WebSEAL Deeloper s Reference GC (amweb39_deref.pdf) Proides administration and programming information for the Cross Domain Authentication Serice (CDAS), the Cross Domain Mapping Framework (CDMF), and the Password Strength Module. Technical supplements IBM Tioli Access Manager Performance Tuning Guide GC (am39_perftune.pdf) Proides performance tuning information for an enironment consisting of Access Manager with IBM SecureWay Directory defined as the user registry. IBM Tioli Access Manager Capacity Planning Guide GC (am39_capplan.pdf) Assists planners in determining the number of WebSEAL, LDAP, and backend Web serers needed to achiee a required workload. IBM Tioli Access Manager Error Message Reference SC (am39_error_ref.pdf) Proides explanations and recommended actions for the messages produced by Access Manager. The Tioli Glossary includes definitions for many of the technical terms related to Tioli software. The Tioli Glossary is aailable, in English only, at the following Web site: Related publications This section lists publications related to the Access Manager library. IBM DB2 Uniersal Database IBM DB2 Uniersal Database is required when installing IBM SecureWay Directory, z/os, and OS/390 SecureWay LDAP serers. DB2 information is aailable at the following Web site: IBM Global Security Toolkit Access Manager proides data encryption through the use of IBM Global Security Toolkit (GSKit). GSKit is shipped on the IBM Tioli Access Manager Base CD for your particular platform. The GSKit package installs the ikeyman key management utility (gsk5ikm), which enables you to create key databases, public-priate key pairs, and certificate requests. The following document is aailable in the doc/gskit directory: Secure Sockets Layer Introduction and ikeynan User s Guide (gskikm5c.pdf) Proides information for network or system security administrators who plan to enable SSL communication in their Access Manager secure domain. iii IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

11 IBM SecureWay Directory IBM SecureWay Directory, Version 3.2.2, is shipped on the IBM Tioli Access Manager Base CD for your particular platform. If you plan to install the IBM SecureWay Directory serer as your user registry, the following documents are aailable in the /doc/directory path on the IBM Tioli Access Manager Base CD for your particular platform: IBM SecureWay Directory Installation and Configuration Guide SC (aparent.pdf, lparent.pdf, sparent.pdf, wparent.pdf) Proides installation, configuration, and migration information for IBM SecureWay Directory components on AIX, Linux, Solaris, and Microsoft Windows operating systems. IBM SecureWay Directory Release Notes (relnote.pdf) Supplements IBM SecureWay Directory, Version 3.2.2, product documentation and describes features and functions made aailable to you in this release. IBM SecureWay Directory Readme Addendum (addendum322.pdf) Proides information about changes and fixes that occurred after the IBM SecureWay Directory documentation had been translated. This file is in English only. IBM SecureWay Directory Serer Readme (serer.pdf) Proides a description of the IBM SecureWay Directory Serer, Version IBM SecureWay Directory Client Readme (client.pdf) Proides a description of the IBM SecureWay Directory Client SDK, Version This software deelopment kit (SDK) proides LDAP application deelopment support. IBM SecureWay Directory Configuration Schema (scparent.pdf) Describes the directory information tree (DIT) and the attributes that are used to configure the slapd32.conf file. In IBM SecureWay Directory Version 3.2, the directory settings are stored using the LDAP Directory Interchange Format (LDIF) in the slapd32.conf file. IBM SecureWay Directory Tuning Guide (tuning.pdf) Proides performance tuning information for IBM SecureWay Directory. Tuning considerations for directory sizes ranging from a few thousand entries to millions of entries are gien where applicable. For more information about IBM SecureWay Directory, see the following Web site: Accessing publications online Publications in the product libraries are included in Portable Document Format (PDF) on the product CD. To access these publications using a Web browser, open the infocenter.html file, which is located in the /doc directory on the product CD. When IBM publishes an updated ersion of one or more online or hardcopy publications, they are posted to the Tioli Information Center. The Tioli Information Center contains the most recent ersion of the publications in the product library in PDF or HTML format, or both. Translated documents are also aailable for some products. You can access the Tioli Information Center and other sources of technical information from the following Web site: Preface ix

12 Accessibility Information is organized by product, including release notes, installation guides, user s guides, administrator s guides, and deeloper s references. Note: If you print PDF documents on other than letter-sized paper, select the Fit to page check box in the Adobe Acrobat Print dialog (which is aailable when you click File Print) to ensure that the full dimensions of a letter-sized page are printed on the paper that you are using. Ordering publications You can order many Tioli publications online at the following Web site: publications/cgibin/pbi.cgi You can also order by telephone by calling one of these numbers: In the United States: In Canada: In other countries, for a list of telephone numbers, see the following Web site: Proiding feedback about publications We are ery interested in hearing about your experience with Tioli products and documentation, and we welcome your suggestions for improements. If you hae comments or suggestions about our products and documentation, contact us in one of the following ways: Send an to pubs@tioli.com. Contacting customer support Complete our customer feedback surey at the following Web site: Accessibility features help a user who has a physical disability, such as restricted mobility or limited ision, to use software products successfully. With this product, you can use assistie technologies to hear and naigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. If you hae a problem with any Tioli product, you can contact Tioli Customer Support. See the Tioli Customer Support Handbook at the following Web site: The handbook proides information about how to contact Tioli Customer Support, depending on the seerity of your problem, and the following information: Registration and eligibility Telephone numbers and addresses, depending on the country in which you are located x IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

13 What information to gather before contacting support Conentions used in this book This guide uses seeral conentions for special terms and actions, operating system-dependent commands and paths, and margin graphics. Typeface conentions The following typeface conentions are used in this book: Bold Italic Monospace Command names and options, keywords, and other information that you must use literally appear in bold. Variables, command options, and alues you must proide appear in italics. Titles of publications and special words or phrases that are emphasized also appear in italics. Code examples, command lines, screen output, file and directory names, and system messages appear in monospace font. Preface xi

14 xii IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

15 Chapter 1. Installation requirements Supported platforms This chapter contains the following topics: Supported platforms Disk and memory requirements Installation packages Software prerequisites on page 2 IBM Tioli Access Manager WebSEAL for Linux on zseries and the IBM Tioli Access Manager WebSEAL for Linux on zseries ADK are supported on the following platforms: SuSe Linux Enterprise Serer 7 for s/390 and zseries This is SuSe Linux 7.2 for zseries, kernel 2.4.7, 31-bit. Disk and memory requirements Installation packages WebSEAL has the following hardware requirements: Disk space: 10 MB When combined with the prerequisite IBM Tioli Access Manager runtime enironment (65 MB), the minimum required disk space is 75 MB. It is recommended that you resere an additional 100 MB of disk space for WebSEAL log files. Memory: 128 MB Minimum. 256 MB Recommended. SuSe Linux 7.2 requires a minimum of 128 MB memory. Access Manager WebSEAL does not add additional minimum memory requirements beyond those required by SuSe Linux. The 128 MB minimum includes the 64 MB minimum needed by the prerequisite IBM Tioli Access Manager runtime enironment, as specified in the IBM Tioli Access Manager Base Installation Guide Note that use of total memory of 256 MB or greater will produce optimum performance results. The IBM Tioli Access Manager Web Security for Linux on zseries CD contains installation packages for the following WebSEAL software: IBM Tioli Access Manager WebSEAL This package includes the WebSEAL serer and configuration files. IBM Tioli Access Manager WebSEAL application deelopment kit (ADK) This package contains deelopment APIs for the Access Manager cross domain authentication serice (CDAS) and the Access Manager password strength module. The Web Security CD also contains the following software prerequisite packages: IBM Tioli Access Manager runtime enironment IBM SecureWay Directory Client IBM Global Security Toolkit Copyright IBM Corp

16 IBM Tioli Access Manager ADK Software prerequisites WebSEAL is an application that installs and runs in an Access Manager secure domain. You must first establish an Access Manager secure domain before installing WebSEAL or WebSEAL ADK. The Access Manager secure domain is established when you install the IBM Tioli Access Manager policy serer. This policy serer is distributed on the IBM Tioli Access Manager Base CD for your operating system. The following sections discuss the software prerequisites for each of the WebSEAL packages: WebSEAL serer prerequisites WebSEAL ADK prerequisites on page 3 WebSEAL serer prerequisites The following software must be installed and configured on each computer that hosts the WebSEAL serer: IBM Tioli Access Manager runtime enironment IBM SecureWay Directory Client IBM Global Security Toolkit (GSKit) To establish a secure domain, the following software must be installed and configured either on the same computer that hosts the WebSEAL serer or on a remote computer: IBM Tioli Access Manager policy serer Note: The policy serer replaces the management serer that was used in Version 3.8 and earlier. A supported LDAP serer, such as IBM SecureWay Directory Thus, there are two deployment scenarios for the WebSEAL serer: 1. On the same computer as the IBM Tioli Access Manager policy serer 2. On a different computer from the IBM Tioli Access Manager policy serer In the first scenario, all of the WebSEAL prerequisites are satisfied during the installation and configuration of the policy serer. Installation of the policy serer requires installation of the IBM Tioli Access Manager runtime enironment, the IBM SecureWay Directory Client, and the IBM Global Security Toolkit. When you deploy WebSEAL in this configuration, you can simply install WebSEAL without installing any further prerequisites. In the second scenario, you must first configure the computer into an existing Access Manager secure domain, and then install the WebSEAL serer. To configure the computer into the Access Manager secure domain, you must install and configure the following software: IBM Tioli Access Manager runtime enironment IBM SecureWay Directory Client IBM Global Security Toolkit (GSKit) 2 IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

17 The IBM Global Security Toolkit contains a utility called gsk5ikm. This utility has dependencies on two additional pieces of software: The SuSE Linux Enterprise Serer Version 7 compat-libstdc++ software installation package. This package is required to proide the legacy C++ support required by GSKit on SuSE Linux Enterprise Serer Version 7. You can obtain the package from the following location on the SuSE Linux Enterprise Serer Version 7 deeloper CD 1: /suse/a1/compat.rpm To use GSKit serices on SuSE Linux Enterprise Serer Version 7, you must set the LD_PRELOADenironment ariable to /usr/lib/libstdc++-libc6.1-2.so.3. export LD_PRELOAD=/usr/lib/libstdc++-libc6.1-2.so.3 Jaa Runtime (JRE) Version You can obtain this product from the IBM Jaa Deeloper Kit for Linux download Web page: Note: The GSKit ikeyman utility does not support JRE Version 1.3. The utility requires JRE Version After you hae configured the aboe prerequisites, you can install and configure WebSEAL. The IBM Tioli Access Manager Web Security CD contains the prerequisite software. This prerequisite software is identical (the exact same ersion number) to the software contained on the IBM Tioli Access Manager Base CDs. The copies on the IBM Tioli Access Manager Web Security CD are proided to enable you to complete the IBM Tioli Access Manager WebSEAL installation without haing to access the IBM Tioli Access Manager Base CDs. Note: The WebSEAL serer has no dependencies on the IBM Tioli Access Manager authorization serer. This authorization serer is distributed as part of the IBM Tioli Access Manager Base for your operating system. WebSEAL ADK prerequisites The following software must be installed and configured on the same computer as the WebSEAL ADK: IBM Tioli Access Manager WebSEAL serer IBM Tioli Access Manager application deelopment kit (ADK) IBM Tioli Access Manager runtime enironment IBM SecureWay Directory Client IBM Global Security Toolkit To install and use the WebSEAL ADK, you must first install and configure a WebSEAL serer. This requires that you satisfy the prerequisites described directly aboe in WebSEAL serer prerequisites on page 2. In addition, you must install the IBM Tioli Access Manager ADK. The ADK is included as a separately installable package on the IBM Tioli Access Manager Base CD for your operating system. This ADK is also included on the Web Security CD. Chapter 1. Installation requirements 3

18 Limitations for this release Complete installation instructions for the ADK are included in the IBM Tioli Access Manager Base Installation Guide. Summary installation instructions are also included in this WebSEAL installation guide. Note: The ADK does not require any configuration. Thus, installation of the ADK consists solely of file extraction to the hard disk. Version 3.9 of IBM Tioli Access Manager WebSEAL for Linux on zseries has the following limitation: Localization support is not aailable. Software and documentation is proided in English language only. Token authentication using SecurID support is not aailable. Wireless Access Protocol (WAP) is not supported. Version 3.9 of WebSEAL for Linux on zseries has a dependency on software packages from Version 3.9 of IBM Tioli Access Manager Base for Linux on zseries. The Access Manager Base has additional limitations for this release. The limitations are described in the IBM Tioli Access Manager Base for Linux on zseries Installation Guide. 4 IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

19 Chapter 2. Installing WebSEAL Installing WebSEAL serer This chapter proides instructions for installing and configuring the WebSEAL packages. This chapter also proides instructions for installing the software prerequisites for each WebSEAL package. The WebSEAL product consists of two packages: WebSEAL serer WebSEAL application deelopment kit (ADK) You can install the WebSEAL serer without installing the WebSEAL ADK. If you want to install the WebSEAL ADK, you must install the WebSEAL serer as a prerequisite. Both the WebSEAL serer and the WebSEAL ADK require that the IBM Tioli Access Manager runtime enironment is installed and configured. In addition, the WebSEAL ADK requires that the IBM Tioli Access Manager ADK is installed. The prerequisite packages for both the WebSEAL serer and the WebSEAL ADK are included on the Web Security CD. The installation instructions in this chapter describe how to install each of the prerequisite packages. Note: For complete installation instructions and configuration options for the IBM Tioli Access Manager runtime enironment and the IBM Tioli Access Manager ADK, see the IBM Tioli Access Manager Base Installation Guide. This chapter contains separate sections for installing WebSEAL serer and WebSEAL ADK. You must complete the section for installing WebSEAL serer before you use the section for installing WebSEAL ADK. To install WebSEAL, see the instructions in the appropriate section below: Installing WebSEAL serer on page 5 Installing WebSEAL ADK on page 8 The WebSEAL installation separates file extraction from package configuration. Use rpm to install software packages on Linux. Then use the Access Manager configuration utility pdconfig to configure WebSEAL. Note: If you hae already installed and configured WebSEAL and need to reinstall it, you must first unconfigure and remoe the WebSEAL package. See Chapter 3, Remoing WebSEAL on page 9. To install a WebSEAL serer on Linux complete the following instructions: 1. Log in as user root. 2. Obtain access to the Access Manager WebSEAL for Linux on zseries rpm files. Note that Linux for zseries does not support attachment of a CD drie at this time. Use one of the following methods to obtain the necessary files: Load the WebSEAL for Linux for zseries files onto another workstation. Use ftp to transfer the files to a directory on the Linux for zseries machine. Copyright IBM Corp

20 Mount the IBM Tioli Access Manager for Linux on zseries CD on another workstation. Use NFS to access it from the Linux on zseries machine. The WebSEAL files are located on the CD in the following directory: /zseries 3. Verify that this computer has the IBM Tioli Access Manager runtime enironment configured. The runtime enironment will be configured if the IBM Tioli Access Manager policy serer is installed on this computer, or if the computer has preiously been added to the Access Manager secure domain. 4. If this computer already has the runtime enironment configured, skip this step. Go to the next step. If this computer does not hae the IBM Tioli Access Manager runtime enironment configured, install and configure the necessary software prerequisites by completing the following instructions: a. Enter the following command to install the IBM Global Security Toolkit: # rpm -i gsk5bas*.rpm Note: The IBM Global Security Toolkit has dependencies on other software. Before you install GSKit, ensure that you hae met the software prerequisites described in WebSEAL serer prerequisites on page 2. b. Enter the following command to install the IBM SecureWay Directory Client: # rpm -i ldap-client*.rpm Note: If the system already has an LDAP client for another LDAP product, remoe it first. For more information see the IBM Tioli Access Manager Base for Linux on zseries Installation Guide c. Enter the following command to install the IBM Tioli Access Manager runtime enironment: # rpm -i PDRTE*.rpm d. Enter the following command to configure the IBM Tioli Access Manager runtime enironment: # pdconfig For complete installation and configuration instructions for each of the packages aboe, see the IBM Tioli Access Manager Base Installation Guide. 5. Enter the following command to install the WebSEAL serer package: # rpm -i PDWeb-PD s390.rpm Files are extracted from the CD and installed on the hard disk. A message appears indicating that installation of the WebSEAL package was successful. The rpm utility exits. 6. Next, use the IBM Tioli Access Manager configuration utility pdconfig to configure WebSEAL. Enter the following command at a UNIX shell prompt: # pdconfig The Access Manager Setup Menu appears. 7. Type the menu number for Configure Package. The Access Manager Configuration Menu appears. 8. Type the menu number for Access Manager WebSEAL (PDWeb) Configuration. 6 IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

21 A prompt appears requesting you to enter the password of the Access Manager Administrator. 9. Enter the password for sec_master. You are prompted to enable SSL communication between the WebSEAL serer and the LDAP serer. 10. Choose one of the following actions: If you want to enable SSL communication, type y and press Enter. If you do not want to enable SSL communications, type n and press Enter. The current Web serer configuration alues are displayed. 11. If you disabled SSL communication, go to the next step. If you hae enabled SSL communication, proide the following alues when prompted: LDAP SSL Client Key Ring File Location SSL Client Certificate Label (optional) The client certificate label is usually not required. This label is needed only when the LDAP serer is configured to ask for client-side certificates. Typically, LDAP serers require only serer-side certificates. If your LDAP serer does not require client-side certificates, you can just press Enter at this prompt. SSL Client Key File Password LDAP Serer SSL port number. The default port is 636. The SSL configuration is now complete. The current Web serer configuration alues are displayed. 12. Check the Web serer configuration alues. Modify any that need to be changed. In most cases, you can accept the default alues. The following screen dialog appears: Please checkweb Serer configuration: 1. Enable TCP HTTP? Yes 2. HTTP Port Enable HTTPS? Yes 4. HTTPS Port Web document root directory /opt/pdweb/www/docs a. Accept configuration and continue with installation x. Exit installation Select item to change: Note: If you are running any other Web serers on this computer, erify that the TCP HTTP port for the other serers does not conflict with the WebSEAL TCP HTTP port. 13. When you are satisfied that the configuration is correct, type the letter a to accept the configuration and continue the installation. Press Enter. Seeral status messages appear as the WebSEAL serer is configured. When the configuration is complete, a status message indicates that the WebSEAL serer is starting. When the WebSEAL serer is running, a final message appears indicating that the configuration of the WebSEAL serer package was successful. 14. Press Enter to continue. The Access Manager Configuration Menu appears. 15. Press Enter to select the default choice of x to exit the utility. Chapter 2. Installing WebSEAL 7

22 Installing WebSEAL ADK Note: Access Manager WebSEAL supports multiple instances of WebSEAL serers on each host computer. See the IBM Tioli Access Manager WebSEAL Administrator s Guide for information on configuring multiple instances of WebSEAL serers. To install the WebSEAL ADK, complete the following instructions: 1. Verify that the WebSEAL serer package has been installed and configured. If the WebSEAL serer has not been installed, complete the instructions in Installing WebSEAL serer on page Verify the following information: You are logged in as root You can access the rpm packages from the IBM Tioli Access Manager Web Security for Linux on zseries CD. Note that this CD cannot be mounted on the Linux for zseries machine. For access instructions, see Installing WebSEAL serer on page 5. The installation packages are located in the /zseries directory on the CD. 3. Enter the following command to install the IBM Tioli Access Manager ADK: # rpm -i PDAuthADK*.rpm When prompted to continue, type y and press Enter. Files are extracted from the CD and installed on the hard disk. A status message appears indicating that installation of the IBM Tioli Access Manager ADK package was successful. The rpm utility exits. 4. Enter the following command to install the WebSEAL ADK: # rpm -i PDWebADK-PD s390.rpm Files are extracted from the CD and installed on the hard disk. A status message appears indicating that installation of the WebSEAL ADK package was successful. The rpm utility exits. The WebSEAL ADK does not require any configuration. Installation of the WebSEAL ADK is now complete. 8 IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

23 Chapter 3. Remoing WebSEAL This chapter describes how to unconfigure and remoe WebSEAL and the WebSEAL ADK. Note: Unconfiguring of WebSEAL remoes all information from the WebSEAL junctions database. Ensure that this information is no longer needed before remoing it. WebSEAL depends on the IBM Tioli Access Manager runtime enironment. This chapter does not describe how to remoe the runtime enironment. To remoe the runtime enironment, follow the instructions in the IBM Tioli Access Manager Base Installation Guide. Remoal of WebSEAL is a two part process. Use the pdconfig tool to unconfigure the WebSEAL package. Then use rpm to remoe the files for each package. 1. Log in as root. 2. Start the IBM Tioli Access Manager configuration utility: # pdconfig The Access Manager Setup Menu appears. 3. Type the menu number for Access Manager Unconfiguration. The Access Manager Unconfiguration Menu appears. 4. Type the menu number for Access Manager WebSEAL. A prompt appears requesting the password for the IBM Tioli Access Manager Administrator. 5. Enter the password for sec_master. A series of status messages appear. These messages indicate that the serer is being unconfigured, that log files are being cleaned up, and that outgoing endpoints are being reclaimed. The WebSEAL serer is stopped, and a final status message indicates that the unconfiguration was successful. The unconfiguration is complete. 6. Exit the pdconfig utility. 7. Choose one of the following commands: To remoe WebSEAL, enter the following command: # rpm -e PDWeb-PD To remoe the WebSEAL ADK, enter the following command: # rpm -e PDWebADK-PD To remoe both WebSEAL and the WebSEAL ADK, enter the following command: # rpm -e PDWeb-PD PDWebADK-PD A prompt appears asking you to confirm the remoal of the selected package. 8. Enter the letter y. A status message lists each file as it is remoed. After the postremoe script runs, a status message indicates that the remoal of the software package was successful. The rpm utility exits. Copyright IBM Corp

24 Remoal of the selected packages is complete. If you want to remoe the IBM Tioli Access Manager runtime enironment, follow the instructions in the IBM Tioli Access Manager Base Installation Guide. 10 IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

25 Appendix. Notices This information was deeloped for products and serices offered in the U.S.A. IBM may not offer the products, serices, or features discussed in this document in other countries. Consult your local IBM representatie for information on the products and serices currently aailable in your area. Any reference to an IBM product, program, or serice is not intended to state or imply that only that IBM product, program, or serice may be used. Any functionally equialent product, program, or serice that does not infringe any IBM intellectual property right may be used instead. Howeer, it is the user s responsibility to ealuate and erify the operation of any non-ibm product, program, or serice. IBM may hae patents or pending patent applications coering subject matter described in this document. The furnishing of this document does not gie you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation 500 Columbus Aenue Thornwood, NY U.S.A For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo 106, Japan The following paragraph does not apply to the United Kingdom or any other country where such proisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are proided for conenience only and do not in any manner sere as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it beliees appropriate without incurring any obligation to you. Copyright IBM Corp

26 Licensees of this program who wish to hae information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/ Burnet Road Austin, TX USA Such information may be aailable, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this information and all licensed material aailable for it are proided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equialent agreement between us. Any performance data contained herein was determined in a controlled enironment. Therefore, the results obtained in other operating enironments may ary significantly. Some measurements may hae been made on deelopment-leel systems and there is no guarantee that these measurements will be the same on generally aailable systems. Furthermore, some measurement may hae been estimated through extrapolation. Actual results may ary. Users of this document should erify the applicable data for their specific enironment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly aailable sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM s future direction or intent are subject to change or withdrawal without notice, and represent goals and objecties only. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of indiiduals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrates programming techniques on arious operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of deeloping, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples hae not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, sericeability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of deeloping, using, marketing, or distributing application programs conforming to IBM s application programming interfaces. 12 IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

27 Each copy or any portion of these sample programs or any deriatie work, must include a copyright notice as follows: (your company name) (year). Portions of this code are deried from IBM Corp. Sample Programs. Copyright IBM Corp. _enter the year or years_. All rights resered. If you are iewing this information softcopy, the photographs and color illustrations may not appear. Trademarks The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both: AIX DB2 IBM IBM logo SecureWay Tioli Tioli logo Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Jaa and all Jaa-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. UNIX is a registered trademark of The Open Group in the United States and other countries. Other company, product, and serice names may be trademarks or serice marks of others. Appendix. Notices 13

28 14 IBM Tioli Access Manager WebSEAL for Linux on zseries: Installation Guide

29

30 GC Printed in the United States of America on recycled paper containing 10% recoered post-consumer fiber.