Date:   December 02, 1999

Patch:  3.6.2-SEC-0001

Component: Tivoli Security Management
           Tivoli Security Management for OS/2, Server
           Tivoli Security Management for AS/400, Server
           Tivoli Security Management for NetWare, Server
           Tivoli Security Management for NetWare, Gateway

General Description:

   This patch provides support for dynamic fine grained roles and
   also support for NetWare 5.0 endpoint.

Problems Fixed:

    75475         Add support for dynamic fine grained roles.
    80321         USER INTEG: security role shouldn't be required.
    80969         Modify ACLs for specific intrinsic methods.
    83262         Adding NW5.0 Support.


Architecture(s): solaris2, hpux10, aix4-r1, w32-ix86

Patches superseded by this patch: None

Dependencies: None


Database Changes: Additional roles added.


Files Replaced or Added by this Patch:

    Tivoli Security Management:

        bin/$INTERP/TME/SECURITYA/SecPro
        bin/$INTERP/TME/SECURITYA/SecProItr
        bin/$INTERP/TME/SECURITYA/SecProGui
        bin/$INTERP/bin/wsecprfcli
        bin/$INTERP/bin/wcrtsec
        bin/$INTERP/bin/wmvsec
        bin/$INTERP/bin/wcpsec
        bin/$INTERP/bin/wdelsec
        bin/$INTERP/bin/wlssec
        bin/$INTERP/bin/wmodsec
        bin/$INTERP/bin/wpopsec
        bin/$INTERP/bin/wsecpropcli
        bin/$INTERP/bin/wlsseceptype
        bin/$INTERP/bin/waddseceptype
        bin/$INTERP/bin/wmodseceptype
        bin/$INTERP/bin/wdelseceptype
        bin/$INTERP/bin/wlssecprop
        bin/$INTERP/bin/waddsecprop
        bin/$INTERP/bin/wmodsecprop
        bin/$INTERP/bin/wdelsecprop
        bin/$INTERP/bin/wlssecrestype
        bin/$INTERP/bin/waddsecrestype
        bin/$INTERP/bin/wmodsecrestype
        bin/$INTERP/bin/wdelsecrestype
        bin/$INTERP/bin/wlssecevtype
        bin/$INTERP/bin/waddsecevtype
        bin/$INTERP/bin/wmodsecevtype
        bin/$INTERP/bin/wdelsecevtype
        bin/$INTERP/bin/wcrtsecact
        bin/$INTERP/bin/wlssecact
        bin/$INTERP/bin/wdelsecact
        bin/$INTERP/bin/wsetsecact
        bin/$INTERP/bin/wcrtsecsubact
        bin/$INTERP/bin/wlssecsubact
        bin/$INTERp/bin/wdelsecsubact
        bin/$INTERP/bin/wlssecperm
        bin/$INTERP/bin/wdelsecperm
        bin/$INTERP/bin/waddsecperm
        bin/$INTERP/bin/wmodsecperm
        msg_cat/C/fgr_msgs.cat

    Tivoli Security Management for NetWare, Gateway:

        bin/lcf_bundle/bin/nw4/TME/SECURITYE/SecEpt

Applying the Patch:


    1)  Extract the patch:

        On a Unix system:

        Extract the contents into a scratch directory. For the purpose
        of this release note, assume that the symbol $PATCH points
        to this directory.

        # cd $PATCH
        # tar xvf 3.6.2-SEC-0001.tar


        On a Windows NT system:

        Extract the contents into a scratch directory. For the purpose
        of this release note, assume that the symbol %PATCH% points
        to this directory.

        > %SystemRoot%\system32\drivers\etc\Tivoli\setup_env
        > X:
          ^-- 'X' is drive letter where %PATCH% is found
        > cd %PATCH%
        > tar xvf 3.6.2-SEC-0001.tar

        NOTE:  If you are extracting the tar image on a Windows NT
        system, you will find an executable for tar in the TME
        installation on Windows NT under bin/w32-ix86/tools/tar.exe.


    2)  If this patch is to be installed on a release level of 3.6 or
        greater, follow these instructions for using Software
        Installation Service (SIS). If not, skip to step 3 below.

        NOTE: SIS can install Tivoli products on any hardware
              platform supported by Tivoli, but there are some
              hardware platforms on which SIS cannot be run. Please
              check your SIS User's Manual for the list of platforms
              on which SIS can be run.

        NOTE: You must have the install_product and super authorization
              roles to successfully install this patch.

        a)  From the Tivoli Desktop, pull down
            Desktop --> Install --> Software Installation Service.
        b)  SIS will initialize, and bring up the Get Installation
            Password Dialog.  Enter your Installation Password.
        c)  Click the Install Button on the dialog which contains
            the Tivoli image.
        d)  Click the Select Product Button on the Install Spreadsheet
            Dialog.
        e)  Click the Import Product Button on the Select Product
            Dialog.
        f)  Locate the media to 3.6.2-SEC-0001 using the file browser,
             and select the PATCHES.LST file by double-clicking it.
        g)  Select 3.6.2-SEC-0001 in the Import Product Dialog, and
            click the Import Button.
        h)  When the import is complete, click the OK Button on the
            Global Progress Dialog.
        i)  Select the patch you want to install in the Select Product
            Dialog and click the OK Button.
            NOTE: This patch has five installable pieces.
            -Tivoli Security Management Patch 3.6.2-SEC-0001, Server
            -Tivoli Security Management for OS/2 Patch
             3.6.2-SECOS2-0001, Server
            -Tivoli Security Management for AS/400 Patch
             3.6.2-SECOS4-0001, Server
            -Tivoli Security Management for NetWare Patch
             3.6.2-SECNW-0001, Server
            -Tivoli Security Management for NetWare Patch
             3.6.2-SECNWGW-0001, Gateway
        j)  Now click the Select Machine Button on the Install
            Spreadsheet Dialog.
        k)  Select the machine(s) you would like to install
            3.6.2-SEC-0001 to, and click the OK Button.
        l)  Click the apropriate cell(s) in the Install Spreadsheet
            Dialog. (NOTE: This should yield an "X" in the cell(s)
            for the machines you want to install 3.6.2-SEC-0001 to).
        m)  Click the Install Button.
        n)  Select the install algorithm you want to use on the
            Installation Algorithm Dialog, and click OK.
        o)  SIS will perform the installation(s) you designated
            in the Install Spreadsheet Dialog.
        p)  Installation is complete. Check the Additonal
            Installation Instructions section below.


    3)  Use the following steps to install the patch using the old
        Tivoli install mechanism.
        NOTE: You must have the install_product and super
        authorization roles to successfully install this patch.

        a)  Select the "Install -> Install Patch..." option from the
           "Desktop" menu to display the "Install Patch" dialog.

        b)  Press the "Select Media..." button to display the
            "File Browser" dialog.

        c)  Enter the path to the directory containing the patch,
            $PATCH, in the "Path Name:" field.

        d)  Press the "Set Media & Close" button to return to the
            "Install Patch" dialog.

        e)  The patch install list now contains the names of the
            patchs. Select a patch by clicking on it.
            NOTE: This patch has five installable pieces.
            -Tivoli Security Management Patch 3.6.2-SEC-0001, Server
            -Tivoli Security Management for OS/2 Patch
             3.6.2-SECOS2-0001, Server
            -Tivoli Security Management for AS/400 Patch
             3.6.2-SECOS4-0001, Server
            -Tivoli Security Management for NetWare Patch
             3.6.2-SECNW-0001, Server
            -Tivoli Security Management for NetWare Patch
             3.6.2-SECNWGW-0001, Gateway

        f)  Select the clients to install this patch on. This patch
            changes two binaries and needs to be installed on the TME
             server and  on each client.

        g)  Press the "Install" button to install the patch.

Additional Installation Instructions:

        To apply to a NetWare Endpoint:

                Install "Tivoli Security Management for NetWare,
                Gateway Patch 3.6.2-SEC-0001" on the gateway managing
                the NetWare Endpoint. Since the gateway managing an
                Endpoint can be changed dynamically, it  is suggested
                the patch be installed on all gateways.

Known Defects:

     83822  Incorrect roles required for role template populates.

     When doing a role template populate, in addition to the
     "SecMgt_Pop" role the administrator should also be assigned
     "SecMgt_Add_Role" and "SecMgt_Modify_Role" roles.
