ff5f5b56ce55bcf0cbe4daa5b412a72e SqlGuard-9.0p530_64-bit.tgz.enc

Transcription

1 Problem Overview ================ Product: Guardium Release: 9.0/9.5 Fix ID#: Guardium v9.0 p530 r78220 Fix Completion Date: Description: Combined Fix Pack for v9.0 GPU 500 (Jun ) MD5Sums/ file names b2c2645d8b78bece3547f73e14a7a1c3 SqlGuard-9.0p530_32-bit.tgz.enc ff5f5b56ce55bcf0cbe4daa5b412a72e SqlGuard-9.0p530_64-bit.tgz.enc Finding the Fix/Patch ============================= This document is intended to provide a reference to the contents of this fix/patch. If applicable, the detailed description of each fix and instructions for applying this fix/patch are contained within the download package. The actual package is available for downloading from the IBM Fix Central web site at Make the following selections on Fix Central: Product Group: Information Management Product: Guardium Installed Version: 9.0/9.5 Platform: UNIX Heading: Appliance Patch (GPU and Ad-hoc) Click "Continue", then select "Browse for fixes" and click "Continue" again. 1

2 The bugs that were fixed in this release: Fix # Ad-hoc patch Bug # Description Update Outlier Detection Tool / Sybase ASE CVE test mechanism enhancements to support Sybase 16 for SP and PL patches. Oracle CVE and patch enhancement for In memory database Add a report that displays error results, ERROR, WARN and INFO status for Classifier results / 47079/ Add Classifier timeout commands. Modify sampling done for each rule in a classifier policy. Remove watch_classifier checks Update nanny process (SPAN traffic) / Classifier - Remove count query for Teradata and introduce timeout for count query in db2. Change datatype from int to long for count storage. Classifier - Add option to match only columns not matched so far for subsequent rules Fix S-TAP verification for GreenPlumDB Fix instance of not being able to add index to Distributed Report Custom Tables Fix instance of Guardium User Activity Audit not reporting activity regarding existing report definitions Add Inspection engine identifier field to GuardAPI command, grdapi create_stap_inspection_engine Enhancement for managing Java-based privilege tests Fix instance where the login message does not appear at all GUI Enhancements for IBM i S-TAP / Correct error message resources to avoid NPE when classification exception appears fix issue of Guardium Classifier Processes being blocked when there is read lock in Teradata 1080 This patch provides the capability to access the Guardium appliance console remotely through SSH to either IMM2 or idrac. See full details on this patch at end of these release notes. 2

3 Fix # Ad-hoc patch Bug # Description Fix instance of Trigger Defined unchecked and grayed out although trigger is created (45274) (47630) Fix instance of S-TAP verification not working. Fix instance of internal table TURBINE_USER_GROUP_ROLE and column TIMESTAMP breaking logic on export_synch_files.tgz script Fix instance of query report returning errors for different action taken Fix instance of queries not working when cloned by saving large queries with many joined tables Fix instance of alert not firing for custom inactive S-TAP correlation alert Fix instance of Change Value Audit not uploading to Guardium system due to dateformat settings in the SQL Server. Use ISO-8601 date format (YYYYMMDD) that is supported by SQL Server. Notes 1. Patch 530 is dependent on GPU 500. Patch 530 includes the capabilities and fixes from Patch 505 so you do not need to explicitly apply patch Patch 530 will automatically restart the GUI. 3. If installing v9.0 p530 using CLI interface, make sure to exit CLI interface before using CLI again. Do this to insure p530 updates are reflected in CLI functionality (Central Manager and Managed Units). 3

4 Follow this installation flow: 1. Backup your system. 2. Retrieve and install the latest health check 9997 on the Central Manager. 3. Install v9.0 GPU 500 on the Central Manager. (For v9.0/9.5 GPU 500 release notes, go to V9.5 patch 500 Detailed Release Notes (March 2015) Install v9.0 p530 on the Central Manager. 5. Then push health check 9997, v9.0 GPU 500 and v9.0 p530 to the Managed Units. 4

5 Overview Enterprise search (also called Quick Search for Enterprise) enables you to use the search interface to search across multiple collectors in a managed environment. (Search is never enabled on aggregators.) Enterprise search uses a new architecture based on the Solr engine and new text indexes, but the transition to these new indices is seamless to you. There are three modes of enterprise search. CM only: This is the default. Enterprise search will be enabled such that search queries can only be submitted from the Central Manager and return search results from all enabled collectors. On CM only mode, search queries can be submitted on Managed Units, but will return only local results while queries submitted on CM will return enterprise-wide results. All machines: This enables users logged into any collector (as well as the CM) to submit search queries and get results from all collectors. Note that this mode may results in slower search results. Local only: If you prefer to have the behavior that the old Quick Search provided, you can specify that search queries submitted from the collector only go against the search indexes in that collector. Use the Guardium API set_enterprise_search_options to set these modes. For more information see set_enterprise_search_options at the end of this release note. Notes: After setup, the Solr engine should be active on all Guardium systems. However, the search box will not be available on the aggregator. 1. After p530 is installed, the Aggregator will default to all_machines mode (should be in cm_only mode, with search box disabled), while the managed collectors are in cm_only mode (collectors will show local results only, while the Central Manager will show enterprise results). 2. Due to this, the search box will display on the aggregator, but search will not work from this aggregator, since other units will reject search requests coming from this aggregator. 3. grdapi set_enterprise_search_options distributed_search=cm_only can be run either on the aggregator to change it to default mode, or can also be run from the Central Manager. This will hide the search box on the aggregator making the setup the way it should be by default. 5

6 Known issues, Quick Search/ Enterprise Search Fix # Bug # Description When using Quick Search and Enterprise Search with a leading wildcard, no results are displayed. Search works correctly when the wildcard is used at the end Violation details are truncated at 30 characters. By default, violation is not included See memory requirements in separate section in this release note When p530 is installed on the Central Manager, Quick Search is disabled on all managed units registered to the Central Manager. Once p530 is installed on the managed units, Quick Search is enabled again. Do not enable Quick Search manually on a p500 managed unit registered to a p530 Central Manager. Similarly, if you register a new p500 managed unit with a p530 Central Manager, Quick Search will be disabled until p530 is installed on the managed unit The message "Quick Search is Enabled" will display on an aggregator and is done to facilitate the Solr analytic engine. However indexing data on the aggregator will not take place Quick Search for Enterprises requires 24 GB of RAM. If trying to install Quick Search for Enterprises on a Guardium system with 16 GB of RAM, the Lucene-based quick search will be enabled, not the newer Solr analytic engine After failover to backup Central Manager, restart the GUI on managed units to get search to resume. 6

7 p530 Memory requirements for using Enterprise Search Central Manager 32-bit Enterprise Search is supported if the following memory requirements are met. 16 GB RAM 4 CPUs or more These memory requirements are enforced; if you do not have this minimum, search will not work. The behavior depends on the type of managed units. If managing 64-bit appliances, Enterprise Search results will be returned to the Central Manager If managing 32-bit appliances, Enterprise Search results will not be returned to the Central Manager 64-bit Enterprise Search is supported if the following memory requirements are met: 24 GB RAM or higher 4 CPUs or more These memory requirements are enforced; if you do not have this minimum, Enterprise Search will not work. Managed Unit Enterprise Search is not supported for 32-bit managed units. To use local quick search with the old indexes, the following are the mandatory memory requirements. 16 GB RAM 4 CPUs or more Enterprise Search is supported if the following memory requirements are met: 24 GB RAM or higher 4 CPUs or more These memory requirements are enforced; if you do not have this minimum, Enterprise Search will not work. (Local Quick Search will work if it is enabled.) Note: 1. On an upgrade from GPU 500, if you have Quick Search enabled, but the requirements for Enterprise Quick Search are not met, you can continue to run with local Quick Search, which will continue to use the old indexing technology. 7

8 Upgrading search indices When upgrading to patch 530, the switch to Enterprise search happens after the Solr search will from the older search engine to new Solr search engine happens for the amount of days defined in the retention period for Quick Search Index Files (default is 3 days). The indexing will be done on both engines until the old indexes are purged and then will switch to the new Solr index solely. In other words, you will can continue to use Quick Search until Enterprise Search takes over completely. Recommendation: Avoid heavy processing during this time. To determine the retention period enter the following CLI command: show purge object age and look for the object Quick Search Index Files. Search results UI changes The following changes were made to the search results to facilitate performance in an enterprise environment: The Object facet results are returned only on demand. Click on the question mark to retrieve the object values. For any facet (except Guardium Appliance facet) that contains more than 10 distinct values, only the top 10 values are returned. Figure 1. Facets in Enterprise Search 8

9 New CLI Commands for Enterprise Search store solr connection_timeout Use this command to set the connection timeout. If Enterprise Search cannot connect to the collector within the timeout value, no results from that collector will be returned. Syntax: store solr connection_timeout <num> <num> is the number in range of 0 and milliseconds. Default is Related show command: show solr connection_timeout store solr so_timeout Use this command to set the socket timeout. Use under direction of IBM Guardium Support. Syntax: store solr so_timeout <num> <num> is the number in range of 0 and milliseconds Default is Related show command: show solr so_timeout store solr time_allowed Use this command to set the amount of time to allow for gathering search results on the collector. When this time is reached, any results gathered to that point will be transmitted to the requesting unit. Syntax: store solr time_allowed <num> <num> is the number in range of 0 and milliseconds Default is Related show command: show solr time_allowed Deep search uses 10x (ten times) the time_allowed. 9

10 New and changed GuardAPI commands enable_quick_search This command has been extended to include the all parameter and can be used to enable both Quick Search and Enterprise Search. Parameter all extraction_start Description In a Central Management environment, enable search on all managed units Values are true or false. The date by which to start the extraction of audit data for search. If omitted, extraction will start immediately. includeviolations Whether to include violations in the search indexes. Omitting violations can help reduce the size of the search indexes. Values are true or false. schedule_interval Required. When combined with units indicates on what schedule to extract audit data. schedule_start schedule_units api_target host Date on which to start extraction. Required. When combined with schedule_interval, indicates how often to extract audit data. The allowable values are: HOUR MINUTE In a central management configuration only, allows the user to specify a target host where the API will execute. On a Central Manager (CM) the value is the host name or IP of any managed units. On a managed unit it is the host name or IP of the CM. Example: grdapi enable_quick_search schedule_interval=2 schedule_units=minute all=true 10

11 disable_quick_search This API has been extended to disable Enterprise Search. Parameter all api_target host Description In a Central Management environment, disable search on all managed units Values are true or false. In a central management configuration only, allows the user to specify a target host where the API will execute. On a Central Manager (CM) the value is the host name or IP of any managed units. On a managed unit it is the host name or IP of the CM. Example: grdapi disable_quick_search all=true set_enterprise_search_options Use this API to set the Enterprise Search mode. Parameter Description distributed_search Required. Enter one of the following values: cm_only: Search queries can only be submitted from the Central Manager. This is the default. On CM only mode, search queries can be submitted on Managed Units, but will return only local results while queries submitted on CM will return enterprise wide results. local_only: Search queries can only be submitted from individual machines and the scope is only for that machine. all_machines: Search queries can be submitted from any machine and the scope includes all enabled collectors in the managed environment. api_target host In a central management configuration only, allows the user to specify a target host where the API will execute. On a Central Manager (CM) the value is the host name or IP of any managed units. On a managed unit it is the host name or IP of the CM. Example: grdapi set_enterprise_search_options distributed_search=local_only 11

12 Patch 9.0p1080 These fixes included in p530 and will applied if following hardware requirements are met. After installing p530, you can follow the steps for p1080 to get the p1080 functions. Requirements Guardium Appliance version 9.0 Guardium x2000, x3000 Systems based on the Dell R610 or the Lenovo X3550-M4 Description This patch provides the capability to access the Guardium Appliance console remotely through SSH to either IMM2 or idrac. Note: This patch requires a reboot and configuration of the system BIOS in order to operate correctly. Note 2: This provides an additional access for console use. Please make sure you secure your Remote Management Software (IMM2 or idrac) appropriately. Also, these changes also enables access through the physical serial port as well. X3550-M4 eufi (BIOS) SETUPS Based on Default Shipping configurations: BIOS -> System Settings -> Device I/O Ports -> Console Redirection Settings Com Port 1 -> Enable Com Port 2 -> Enable Remote Console -> Enable Serial Port Sharing -> Enable Serial Port Access Mode -> Shared SP Redirection -> Enabled Terminal emulation -> vt100 Legacy Option ROM Display -> Com Port 1 X3550-M4 SSH to verify serial port speed instructions: 1. SSH into your IMM2 remote system 2. Enter portcfg and verify that the speed is If the speed is different, change the speed using portcfg -b

13 X3550-M4 SSH to console instructions: 1. SSH into your IMM2 remote system 2. Type: console 1 3. cli 4. <password> 5. Type: ESC-( to exit back to IMM. Dell R610 BIOS SETUPS Based Default Shipping configurations: BIOS -> Serial Communication Serial Communication = On with Console redirection via COM2 Serial Port Address= Serial Device1=COM2, Serial Device2=COM1 External Serial Connector= Serial Device2 Failsafe Baud Rate= Remore Terminal type= VT100/VT220 Redirection After Boot= Enabled Dell R610 SSH to console instructions: 1. SSH into your idrac remote system 2. Type: console -h com2 3. cli 4. <password> 5. Type: Control-\ to exit back to DRAC July -06 IBM Guardium Licensed Materials - Property of IBM. Copyright IBM Corp U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information ( 13