IBM(R) Tivoli(R) Security Compliance Manager, Patch 5.1.0-TIV-SCM-FP0029 README
===============================================================================

(C) Copyright International Business Machines Corporation 2006.
    All rights reserved.

U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Friday, 30 June 2006

-------------------------------------------------------------------------------


    CONTENTS

    1.0 ABOUT THIS PATCH
        1.1 Patch contents
        1.2 Architectures
        1.3 Patches superseded
        1.4 Dependencies
    2.0 APARS AND DEFECTS FIXED
        2.1 Problems fixed by patch 5.1.0-TIV-SCM-FP0029
        2.2 Problems fixed by patch 5.1.0-TIV-SCM-LA0028
        2.3 Problems fixed by patch 5.1.0-TIV-SCM-FP0027
        2.4 Problems fixed by patch 5.1.0-TIV-SCM-LA0025
        2.5 Problems fixed by patch 5.1.0-TIV-SCM-FP0024
        2.6 Problems fixed by patch 5.1.0-TIV-SCM-LA0023
        2.7 Problems fixed by patch 5.1.0-TIV-SCM-LA0021
        2.8 Problems fixed by patch 5.1.0-TIV-SCM-FP0020
        2.9 Problems fixed by patch 5.1.0-TIV-SCM-LA0017
        2.10 Problems fixed by patch 5.1.0-TIV-SCM-LA0016
        2.11 Problems fixed by patch 5.1.0-TIV-SCM-FP0015
        2.12 Problems fixed by patch 5.1.0-TIV-SCM-LA0014
        2.13 Problems fixed by patch 5.1.0-TIV-SCM-LA0013
        2.14 Problems fixed by patch 5.1.0-TIV-SCM-FP0012
        2.15 Problems fixed by patch 5.1.0-TIV-SCM-LA0010
    3.0 BEFORE INSTALLING THIS PATCH
        3.1 Review this entire document before installing
        3.2 Patch installation overview
        3.3 Back up the Tivoli Security Compliance Manager Server and database
    4.0 INSTALLING THIS PATCH
        4.1 Installing the patch on the server
        4.2 Installing the patch on the DB2 database server
        4.3 Installing the patch on systems with the administration utilities
            component
        4.4 Manually installing the patch on a client system
        4.5 Installing this patch on a NetWare client
        4.6 Restarting the server
        4.7 Automatically installing the patch on client systems
    5.0 AFTER INSTALLING THIS PATCH
        5.1 Installing collectors included with this patch
        5.2 Collectors not included with this patch
        5.3 Installing additional base components after installing a fix pack
    6.0 DOCUMENTATION UPDATES
        6.1 IBM Tivoli Security Compliance Manager Administration Guide
        6.2 IBM Tivoli Security Compliance Manager Installation Guide: All
            Components
        6.3 IBM Tivoli Security Compliance Manager Administration Guide
        6.4 IBM Tivoli Security Compliance Manager IISSCN Extension Release
            Notes
        6.5 Expiration of the original IBMJCE certificates.
        6.6 win.any.FilePermsV1 collector changes
        6.7 any.any.CleanupClientCores collector
        6.8 win.any.GenericRegistryKeyV1 collector filtering
        6.9 win.any.GenericRegistryKeyV1 reporting of incorrect registry keys
        6.10 win.any.NetStatV1 collector filtering
        6.11 Collectors not getting updated on clients
        6.12 any.any.DisableClientUpdateV1 collector changes
    7.0 SOFTWARE LIMITATIONS
    8.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
        8.1 SQL scripts might produce errors after migration
        8.2 SUSE 9 for  IA32/xSeries startup link missing
        8.3 SUSE 8 for iSeries/pSeries  startup link missing
        8.4 Parameter discrepancies with unix.any.AnonFtpFilePerms
        8.5 Java startup script causes problems on SUSE Linux Enterprise Server 
        8.6 Client service sometimes removed on Windows by patch installation
        8.7 Known collector problems
           8.7.1 win.any.RegPermsV1
    9.0 NOTICES
        9.1 Trademarks


1.0 ABOUT THIS PATCH
--------------------
  This patch package contains fixes for problems in the IBM Tivoli Security
  Compliance Manager software. This patch requires that version 5.1 of IBM
  Tivoli Security Compliance Manager and IBM Tivoli Security Compliance Manager,
  patch 5.1.0-TIV-SCM-FP0009 already be installed on all components to be
  patched.

1.1 Patch contents

 This patch package contains the following files:

  - This README file
  - 5.1.0-TIV-SCM-FP0029.tar
  - scmpatch29_aix
  - scmpatch29_hp11
  - scmpatch29_linux
  - scmpatch29_linux390
  - scmpatch29_linuxppc
  - scmpatch29_solaris
  - scmpatch29_win32.exe
  - scmpatch29.jar
  - nac files located in /nac directory (avplist5_40.txt, server.cer and
    server.pvk)

  The following files are replaced during installation:
  - client.jar
  - clientupdate.jar
  - scmcli.jar
  - server.jar
  - jacgui.jar
  - jacsecurity.jar
  - jacserver (on unix-like systems)
  - jacgui.bat (on Windows systems)

  The following collectors are included:
  - aix.any.BshQueueV1
  - aix.any.SecUserV1
  - any.any.CleanupClientCores
  - any.any.ClientCollectorVersionsV1
  - any.any.InventoryV1
  - com.ibm.jac.server.JACProxy
  - unix.any.AnonFtpFilePermsV1
  - unix.any.AnonFtpPasswdV1
  - unix.any.CronTabPermsV1
  - unix.any.FilePermsV1.
  - unix.any.FileSearchV1
  - unix.any.HomeFSV1
  - unix.any.ResolveConfV1
  - unix.any.SecurityKeysV1
  - unix.any.ShellsV1
  - unix.any.UsersV1
  - unix.any.XserverAclV1
  - unix.multi.FailedLoginV1
  - unix.multi.ShadowV1
  - unix.multi.XinetdV1
  - win.any.AnonFtpIISV1
  - win.any.FailedLoginV1
  - win.any.FileAuditV1
  - win.any.FilePermsV1
  - win.any.GenericRegistryKeyV1
  - win.any.GroupsV1
  - win.any.GroupsV2
  - win.any.LogSizeV1
  - win.any.NavV1
  - win.any.NetAccountsV1
  - win.any.PwExpiryV1
  - win.any.RegPermsV1
  - win.any.ServicesV1
  - win.any.SnmpActiveV1
  - win.any.UserV1
  - win.multi.AuditPolicyV1
  - win.nt.AuditPolicyV1

1.2 Architectures

  This patch package applies to the following architectures:
  
        Server:
        - IBM AIX(R) 5.1, 5.2, 5.3
        - Sun Solaris 2.8, 2.9
        - SUSE Linux Enterprise Server 8 for IA32/xSeries
        - Microsoft Windows(R) 2000 Server
        - Microsoft Windows(R) 2003 Server, Standard Edition, Enterprise Edition

        Client:
        - IBM AIX(R) 5.1, 5.2, 5.3
        - HP-UX 11 and 11i
        - Sun Solaris 2.6, 2.7, 2.8, 2.9, 2.10
        - Microsoft Windows(R) 2000 Server, Advanced Server, Professional
        - Microsoft Windows(R) NT 4.0 Server, 4.0 Workstation
        - Microsoft Windows(R) XP Professional
        - Microsoft Windows(R) 2003  Server, Standard Edition, Enterprise
            Edition
        - Novell NetWare(R) 5.0, 6.0, and 6.5
        - Red Hat Linux 6.2, 7.0, 7.1, 7.2, 7.3, 8.0, 9.0
        - Red Hat Enterprise Linux 2.1 for IA32/xSeries
        - Red Hat Enterprise Linux Advanced Server 2.1 for IA32/xSeries
        - Red Hat Enterprise Linux Advanced Server 3.0 for IA32/xSeries
        - Red Hat Enterprise Linux Advanced Server 4.0 for IA32/xSeries
        - Red Hat Enterprise Linux 3.0 for zSeries
        - Red Hat Enterprise Linux 7.2 for zSeries
        - Red Hat Enterprise Linux 7.2 for iSeries/pSeries
        - SUSE Linux 7.0 IA32/xSeries
        - SUSE Linux Enterprise Server 9 for IA32/xSeries
        - SUSE Linux Enterprise Server 8 for IA32/xSeries
        - SUSE Linux Enterprise Server 8 for zSeries
        - SUSE Linux Enterprise Server 8 for iSeries/pSeries 

        Administration utilities:
        - IBM AIX(R) 5.1, 5.2, 5.3
        - HP-UX 11 and 11i
        - Sun Solaris 2.8, 2.9
        - Microsoft Windows(R) 2000 Server, Advanced Server, Professional
        - Microsoft Windows(R) XP Professional
        - Microsoft Windows(R) 2003 Server, Standard Edition, Enterprise Edition
        - Red Hat Linux 9.0 for IA32/xSeries
        - Red Hat Enterprise Linux Advanced Server 3.0 for IA32/xSeries
        - SUSE Linux Enterprise Server 8 for IA32/xSeries
        - SUSE Linux Enterprise Server 8 for iSeries/pSeries


1.3 Patches superseded

  The following patches are superseded by this patch:

        5.1.0-TIV-SCM-LA0028
        5.1.0-TIV-SCM-FP0027
        5.1.0-TIV-SCM-LA0025
        5.1.0-TIV-SCM-FP0024
        5.1.0-TIV-SCM-LA0023
        5.1.0-TIV-SCM-LA0021
        5.1.0-TIV-SCM-FP0020
        5.1.0-TIV-SCM-LA0017
        5.1.0-TIV-SCM-LA0016
        5.1.0-TIV-SCM-FP0015
        5.1.0-TIV-SCM-LA0014
        5.1.0-TIV-SCM-LA0013
        5.1.0-TIV-SCM-FP0012
        5.1.0-TIV-SCM-LA0010

1.4 Dependencies

      IBM Tivoli Security Compliance Manager Version 5.1
      IBM Tivoli Security Compliance Manager, Patch 5.1.0-TIV-SCM-FP0009

2.0  APARS AND DEFECTS FIXED
----------------------------

2.1 Problems fixed by patch 5.1.0-TIV-SCM-FP0029

         APAR IY85287
         Symptom: The unix.any.ResolvConfV1 version 1 collector throws
         NullPointerException from executeV2() method.

         APAR IY86142
         Symptom: The win.any.GroupsV2 version 5 returns with error 
         "LsaLookupNames rc = The name limit for the local computer network
         adapter card was exceeded.".

         APAR IY85289
         IISSCN Extension documentation error - corrections to the configuration
         procedure for CiscoSecure ACS.

         APAR IY85605
         Symptom: The avplist5.txt file supplied with IISSCN installation 
         doesn't work with CiscoSecure ACS 4.0.

         APAR IY86232
         Symptom: Files related to IISSCN installation (test_ca_cer, server.cer,
         server.pvk) are missing in patch FP0009.

         internal CMVC defect 71938
         Symptom: After installation of JCE 1.2.1 on the Windows system with
         GUI console, GUI hangs during startup.


2.2 Problems fixed by patch 5.1.0-TIV-SCM-LA0028

         APAR IY81338
         Symptom: The unix.UsersV1 version 6 and unix.multi.ShadowV1 version 3
         collectors fail with errors when system files (like passwd, shadow etc)
         being read by this collector, contain non-printable characters.

         APAR IY84460
         Symptom: The win.any.FileAuditV1 version 1 collector throws core dump
         if run on Windows NT system.

         internal CMVC defect 71328
         Symptom: The jacserver startup script ignores jvm.heap.max setting if
         the jvm.heap.init isn't set.   

         internal CMVC defect 71329
         Symptom: The JVM 1.3.1 on AIX throws core dump or series of
         OutOfMemoryException exceptions when trying to use more than 1 GB of
         memory.

         internal CMVC defect 71348
         Symptom: After installation of the win.any.FilePermsV1 version 11
         (supplied with FP0027) over the version installed by the policy,
         the policies which are using this collector fails - the view
         JAC_DATA.WIN_FILE_PERMS_V1 is missing ERRORCODE column.

2.3 Problems fixed by patch 5.1.0-TIV-SCM-FP0027

         APAR IY77982
         Symptom: The win.any.PwExpiryV1 collector (version prior to 6) exits 
         with java.util.NoSuchElementException.

         APAR IY78491
         Symptom: The win.any.GenericRegistryKeyV1 collector version 6, returns
         error: 
         "Error converting characters from multibyte format into wide character
         format" and stops when it encounters the corrupted registry key.

         APAR IY79855
         Symptom: Newly created user with view access to one policy can view 
         compliance objects from another policies.

         APAR IY81340
         Symptom:  Version 10 of the win.any.FilePermsV1 collector is not 
         reporting error conditions correctly. 

         APAR IY81371
         Symptom: Documentation for any.any.DisableClientUpdateV1.jar
         is not precise in regard of possibilities of the collector.

         APAR IY81800
         Symptom: The unix.any.HomeFsV1 collector returns error: "The following
         exception was not handled: java.lang.NumberFormatException." and stops
         if username longer than system supported size limit is used (in 
         particular longer than 8 characters on Solaris 2.6).

         APAR IY82265
         Symptom: The win.any.GroupsV2 and win.any.PwExpiryV1
         collectors using groups.exe exits with the error: 

            "The Groups Executable File returned the Following Error Message:
             NetLocalGroupGetMembers rc = (null) HCVHC0014E Groups"

         APAR IY82335 (AE to IY77661)
         Symptom: The unix.multi.FailedLoginV1 version 3 collector returns 
         error if no failed su attempts were logged in sulog file.

         Internal CMVC defect 69780
         Symptom: Versions 7 and earlier of win.any.UserV1 collector, 
         incorrectly put account expiration date in an EXPIRATION_ACCOUNT 
         column in form of seconds since 1/1/1970.  Documentation requires 
         this column to be filled with number of days left to expiration date.  

         Internal CMVC defect 70094
         Symptom: The unix.any.HomeFsV1 collector, version 7, fails to return 
         any results for following combination of parameters:
              SCAN_LOCAL  = 0 
              SCAN_REMOTE = 1


2.4 Problems fixed by patch 5.1.0-TIV-SCM-LA0025

         APAR IY77515
         Symptom: The collector unix.any.XserverAclv1, version 4, returns the 
         error: " The /usr/bin/X11/xhost command was not found." when  the 
         Xserver is not installed. 


         APAR IY77597
         Symptom:  GetRegistrySubKeys.exe generates a pop up error window
         stating that it encountered a problem and needed to close.

         Problem reported on Windows clients running the following collectors:
             win.any.UserV1 - version 5                 
             win.any.AnonFtpIISV1 - version 5           
             win.any.GenericRegistryKeyV1- version 6    
             win.any.RegPermsV1 - version 4  
             (IY77597 incorrectly reported against version 6 of  
             win.any.RegPermsV1)


         APAR IY77661
         Symptom: The unix.multi.FailedLoginV1 collector is incorrectly
         reporting the count/totals of failed su attempts that it receives
         from the /var/adm/sulog on AIX. This results in missed violations.

         APAR IY79264
         Symptom: The win.any.AnonFtpIISV1 collector always reports only one
         and the same (default) site  regardless of the number of FTP sites and
          "Allow Anonymous FTP" settings.

         APAR IY79743
         Symptom: Editing  Routing table paths from the Security Compliance
         Manager  GUI Proxy Panel, corrupt entries for other proxies.

         APAR IY79359
         Symptom:  The INSTANCE_NAME column for the 
         any.any.ClientCollectorVersions collector is defined as 30 characters
         by default which is too small for many of the policies used.
                                                               
         APAR IY80661
         Symptom:  Version 2 of the win.any.FailedLoginv1  collector misses
         some violations.

         APAR IY80325
         Symptom:  The win.any.RegPermsV1 collector does not return data. 
         Originally this problem was reported to only occur if both the 
         INTERACTIVE and AUTHENTICATED USERS groups have permissions
         set on the top level registry key. This problem is not limited to 
         adding those two permissions and can occur with any registry ACL 
         changes affecting the amount of data that is output by the collectors 
         utility executable.

2.5 Problems fixed by patch 5.1.0-TIV-SCM-FP0024

         APAR  IY79200
         Symptom: Parsing error in main.sch prevents client from starting.
                                              
         APAR IY79552
         Symptom: Snapshot performance problem affecting servers with large 
         amounts of data.

2.6 Problems fixed by patch 5.1.0-TIV-SCM-LA0023

         APAR IY71971
         Symptom: Error editing compliance objects on systems with language
         pack installed. 

         APAR IY74883
         Symptom: Logging on as a new user results in a "Client does not exist"
         error after a client has been deleted from a group assigned to same
         role as user.

         APAR IY77086
         Symptom: The ScmCreateSnapShot command erroneously reports the total 
         violation count higher than the GUI.

         APAR IY78994
         Symptom:  Changes to the snapshot generation methods to improve event 
         handling in the server.jar shipped with  5.1.0-TIV-SCM-FP0020 caused  
         a database contention problem when creating snapshots.


2.7 Problems fixed by patch 5.1.0-TIV-SCM-LA0021

         APAR IY75107
         Symptom: The aix.any.SecUserV1 collector  receiving  
         Java.lang.NullPointerException  when attributes corresponding
         to columns in AIX_SEC_USER_V1 are missing from the default stanza.

         APAR IY74993
         Symptom: Win.Any.UserV1 collector returning incorrect values for 
         reverse encryption field.

         APAR IY77514
         Symptom: The Win.Any.GroupsV2 and win.Any.PwexpiryV1 collectors fail
         with: "The groups executable file returned the following error message:
         NetGroupGetUsers rc=Overlapped I/O Operation is in progress."

         APAR IY75891
         Symptom:  Version 2 of the Any.Any.InventoryV1 collector fails with:
         COM.ibm.db2.jdbc.DB2Exception: SQL0302N The value of a host variable 
         in the EXECUTE or OPEN statement is too large for its corresponding
         use.

         APAR IY77893
         Symptom:   The Win.Any.FailedLoginV1 collector is missing some failed
         login attempts in the event log.

         APAR IY76501
         Symptom: The Administration Guide does not explain store.locally
         parameter.  (See  Section 4.1 The store.locally parameter)

         APAR IY75132
         Symptom: The ScmCreateSnapShot command fails with the error message
         "The log manager cannot start a log command server" error when running
          multiple commands from a script.  (See Section 4.2 IBM Tivoli Security
          Compliance Manager command line utilities.)



2.8 Problems fixed by patch 5.1.0-TIV-SCM-FP0020

        APAR IY68523
        Symptom: Security hole in SCM client in regards to Cisco NAC interface:
        There is a section in master schedule file in the client subdir where 
        security parameters of collectors have required values defined in 
        plain text.  This is a potential security hole as anyone can edit these
        with a text editor.

        APAR IY70709
        Symptom: Collectors pushed to active clients do not get loaded.
        This is often caused by attempting to update while the previous 
        version of the collector is still running. This results in a
        mismatch of the collector jar file and files stored in the script
        directory.

        APAR IY75969
        Symptom: The scmremoveuser CLI Command fails with the following error: 
        HCVCL0005E An unexpected error occurred. The message returned 
        was: Can't find resource bundle com.ibm.jac.msg.ScmcliMessages, key 
        HCVCL0122II.              


2.9 Problems fixed by patch 5.1.0-TIV-SCM-LA0017

        APAR IY71342
        Symptom:  The following collectors fail with a Dr. Watson error
        thrown by GetRegistrySubKey.exe on Windows NT:

              win.any.AnonFtpIIsV1   Version 3          
              win.any.GenericRegistryKeyV1   Version 3  
              win.any.LogSizeV1   Version 2       
              win.any.NavV1   Version 3           
              win.any.ServicesV1   Version 3      
              win.any.UserV1   Version 3          

        APAR IY72718 
        Symptom: Version 3 of the win.any.AnonFtpIISV1 collector gives the
        following error:  "Unexpected output was returned by:
        scripts\win.any.AnonFtpIISV1\FilePerms.exe E:".

        APAR IY73222
        Symptom: The win.any.FilePermsV1 collector is failing to return data 
        for certain files on Windows 2003.  This occurs with existing files
        and valid permissions in most cases.  This is often caused by the
        file's ACL's containing a security identifier (sid) from an unknown
        user or domain. 

        APAR IY74096
        Symptom: The win.any.GroupsV2 collector, version 2 fails on many systems
        Test Collector returns the following error information: 
        win.any.GroupsV2  com.ibm.jac.msg.CollectorMessages HCVHC0014E Groups

        APAR IY74098
        Symptom: Version 4 of the win.any.PwExpiryV1 collector fails with
        a Dr.Watson error thrown by groups.exe on Windows NT.

        APAR IY74104
        Symptom: IBM Tivoli Security Compliance Manager clients on Windows
        platform (especially Domain Controllers and other systems with  
        lots of users, groups, files) create javacores and heapdumps    
        continually filling up the entire file system.                  

        APAR IY74247
        Symptom: The win.any.FilePermsV1 collector fails with unexpected data.
        Problem similar to but different from APAR IY71242.

        APAR IY74251
        Symptom: The win.any.FilePermsV1 collector results in the following 
        errors:
        a)  win.any.FilePermsV1 collector encountered a Null pointer exception
        in the executeV2() method.  
        b) The FilePerms.exe fails with the error:  instruction at 0x69c03757 
        referenced memory at 0x00000000.  Memory could not be "read".

        APAR IY74552
        Symptom: The unix.any.HomeFsV1 collector returning home directories 
        in remote file systems even with remote Scan parameter set to FALSE (0).


2.10 Problems fixed by patch 5.1.0-TIV-SCM-LA0016

        APAR IY72100
        Symptom:  The  auto registration feature of DHCP clients fails to work
        if the language pack is installed. If the language pack is not  
        installed on these same systems the feature works fine.      

        APAR IY72093
        Symptom:  The  server.log file does not get created if the language 
        pack is installed. This happens regardless of the debug settings
        in server.ini file.  If the language pack is not  
        installed on these same systems the feature works fine.      

        APAR IY73617
        Symptom:  Collectors containing embedded quotes in the description
        fail to update.  

2.11 Problems fixed by patch 5.1.0-TIV-SCM-FP0015

        APAR IY72863
        Symptom:  The aix.any.SecUserV1 collector fails when 
        /etc/security/lastlog contains incomplete entries such as:
        "unsuccessful_login_count ="

        APAR IY72880
        Symptom:  The win.any.FilePermsV1 collector fails with a
        NullPointer exception at:
        win.any.FilePermsV1.executeV2(FilePermsV1.java:793) 

        Internal CMVC defect 62206
        Symptom:  The unix.any.FilePermsV1 collector hangs when 
        examining the mount table while an NFS host is unavailable.


2.12 Problems fixed by patch 5.1.0-TIV-SCM-LA0014

        APAR IY69549
        Symptom:  Performance problem for unix.any.FilePermsV1 collector.
        Problems can occur when remote mounts become unavailable due to the
        collector's use of the df command.

        APAR IY69840
        Symptom:  Performance problem for unix.any.HomeFSV1 collector
        Problems can occur when remote mounts become unavailable due to the
        collector's use of the df command.

        APAR IY71242
        Symptom: The win.any.FilepermsV1  collector may fail with an
        unhandled null pointer exception or unexpected data errors.

        APAR IY71241
        Symptom: The aix.any.SecUserV1 collector fails when a user entry       
        in /etc/security/lastlog is empty.

        APAR IY71244
        Symptom:  The win.any.GroupsV1 collector could not be updated.

        APAR IY71595
        Symptom:  The group.exe fails with the error HCVHC0014E, causing 
        Version 3 of the win.any.PwExpiryV1 to fail.

        APAR IY70794
        Symptom: The win.any.NavV1 collector returns wrong version.
        For example, if you are using version 9.0.3.1000 the version
        returned in SCM is 9.0.1000.

        APAR IY71679
        Symptom: scminstallcollector command hangs in some environments.
        (See APAR IY70446)

        APAR IY69086
        Symptom: Unable to tell when unix.any.FileSearchV1 runs. 
        Collector may fail with null pointer exception or return nothing at all
        when search string not found or embedded in a comment.

        APAR IY71452
        Symptom:  The command line interface scmregisterclient fails when
        the -list option is used with clients that contain a zero as part of 
        their network address.  For example:  10.0.25.9.


2.13 Problems fixed by patch 5.1.0-TIV-SCM-LA0013

        APAR IY67730
        Symptom: win.any.FilePermsV1 collector fails on multiple systems 
        but works on many others using the same parameters.


        APAR IY68053
        Symptom: The win.any.GenericRegistryKeyV1 collector fails to return
        data for any of the requested registry keys if one or more of the keys 
        has restricted permissions.

        APAR IY68872
        Symptom: Version 1 of the win.any.PwExpiryV1 collector does not run 
        correctly and returns the following error:
           {1}.                                        
           win.any.PwExpiryV1                          
           com.ibm.jac.msg.CollectorMessages           
           HCVHC0014E                                  
           Insert0 = Groups                            
           Insert1 = <blank>


        APAR IY68877
        Symptom:  Version 1 of the win.any.GroupsV1 collector fails with a
        number format exception and a Dr. Watson error on Windows NT. 

        APAR IY68879
        Symptom: Versions 1 and 3 of the unix.any.FilePermsV1 collector fail 
        with null pointer exceptions and number format exceptions. 

        APAR IY70210
        Symptom: Version 4 of win.any.FilePermsV1 returns the wrong permissions.
        This collector returns incorrect permissions when %SystemDrive% 
        is specified as FILENAME parameter. Instead of returning the 
        permissions on system drive (C: or D:), the collector is
        returning the permissions for the SCM_CLIENT_INST_DIR directory.

        APAR IY70259
        Symptom:  Version 8 of the com.ibm.jac.server.JACProxy  collector
        is not reliable. Connections close unexpectedly.

        APAR IY70261
        Symptom: Attempting to run scminstallcollector on the server to
        update the com.ibm.jac.server.JACProxy  collector results
        in an error stating that the collector is already installed.
                                                                
        APAR IY70446
        Symptom: scminstallcollector command hangs when upgrading certain   
        collectors such as unix.any.AnonFtpFilePermsV1.

        APAR IY70791
        Symptom: Version 3 of the collector unix.any.XserverAclV1 
        fails on many clients and returns null values. 



2.14 Problems fixed by patch 5.1.0-TIV-SCM-FP0012

        APAR IY66644
        Symptom: Error installing a Tivoli Security Compliance Manager 
        component at base level 5.1.0.0 if some other newer component exists 
        on the same system.

        APAR IY66645
        Symptom:  Error removing multiple resources from policy resource tab
        during role editing.

        APAR IY66854
        Symptom: Collector parameters are lost when you "stop sharing collector"
        or "share from a collector".

        APAR IY67181
        Symptom: Modifying Routing path of one proxy and changing the order of 
        paths seems to affect the routing paths of other proxies.

        APAR IY67185
        Symptom: After applying patch 5.1.0-TIV-SCM-FP0009, you get an error 
        when choosing the change password option from the administration
        console.

        APAR IY67385
        Symptom:   Collector Unix.multi.XinetdV1 does not parse file correctly. 
        Hashes in arguments or attribute names are lost.

        APAR IY67733
        Symptom:  Suppression date year is incremented when saved.

        APAR IY67823
        Symptom:  After applying fix pack 5.1.0-TIV-SCM-FP0009 the show 
        unregistered clients function, no longer works.
        (See section 6.4)

        APAR IY68028
        Symptom: AIX.ANY.SECUSERV1 collector throws null pointer exception.

        APAR IY68163 
        Symptom:  Installation guide does not contain clear instructions for 
        setting up a  Tivoli Security Compliance Manager server using a remote 
        DB2 database.  (See section 6.2)

        APAR IY68696
        Symptom:  Collector com.ibm.jac.server.JACProxy  fails after getting 
        numerous java.util.ConcurrentModificationException  exceptions.

2.15 Problems fixed by patch 5.1.0-TIV-SCM-LA0010


        APAR IY66041   
        Symptom: AIX, Solaris, HP-UX and Linux clients won't start after reboot.
        Problem occurs with clients updated from 5.1.0-TIV-SCM-IF0001 and 
        5.1.0-TIV-SCM-FP0009.

        APAR IY66648 
        Symptom: OS information not getting populated for Windows 2003.

        APAR IY66863
        Symptom:  Unable to delete snapshots restricted to groups that have 
        been deleted.

        APAR IY67383
        Symptom: AIX.ANY.BSHQUEUEV1 collector returns data too long.

        APAR IY67720
        Symptom: The administration utility scmpolicyimport, fails to import
        certain policies.

        APAR IY68156
        Symptom:  The win.multi.AuditPolicyV1 version 3 collector does not
        run on Windows 2003.

        APAR IY68171
        Symptom: Outbound connections from a proxy using  multiple IP's fail 
        to bind IP matching inbound connection. Instead, default IP is used
        causing connection to fail.

        APAR IY68172
        Symptom: Exceptions during push communications results in server's 
        push thread not returning to available queue.

        Internal CMVC defect  55177/55362
        Symptom: Policy compliance queries for unrestricted snapshots examine 
        data for clients in the database. However policy compliance queries 
        should only examine data from clients which have the policy defined.

        Internal CMVC defect   57097
        Symptom: The jacclient script should not use /usr/ucb commands on 
        Solaris.

        Internal CMVC defect   56181
        Symptom: NetWare clients fail to restart after an auto-update.



3.0 BEFORE INSTALLING THIS PATCH
--------------------------------

  Before installing this patch, review the following prerequisites
  and dependencies.

  NOTE: In this README file, <scm_inst_dir> refers to the installation
        location of Tivoli Security Compliance Manager.


3.1 Review this entire document before installing

  It is important to review and understand the steps required 
  to install this patch.


3.2 Patch installation overview

  A Tivoli Security Compliance Manager environment consists of a
  server, database tables, one or more administration consoles, and
  clients.  For purposes of installing this patch, no distinction is made
  between a push client, pull client, DHCP client, proxy relay client 
  or  proxy client.

  Applying this patch involves the following steps, which are
  described in detail in later sections of this README file:

     1. Backing up the data associated with the Tivoli Security
        Compliance Manager server and database.

     2. Stopping the server.

     3. Installing the patch on the server.

     4. If the DB2(R) database server is on a different system than the
        Tivoli Security Compliance Manager server, installing the patch
        on the system running the database server.

     5. Installing the patch on each system where the administration
        console and the administration utilities are used.

     6. Optionally, installing the patch on any client where you want to
        do a manual installation.  This step is not necessary if you have
        not disabled the client auto-update facility for some or all clients.

     7. Restarting the server.

     8. Updating the client software available on the server in order to
        enable the client auto-update processing.

     Note:  The patch installation will make several database changes.
     This may take considerable amount of time to complete.  The amount of 
     time required will primarily depend  on the number of suppressed 
     violations that exist in the database.

     For example: 4.5m violations and 1.2m suppressed violations may require 
     15 minutes or more.

3.3 Back up the Tivoli Security Compliance Manager server and database

  Before applying any maintenance or patch, back up the Tivoli
  Security Compliance Manager server and database.

  NOTE:  There is no patch uninstallation procedure. To remove the
         patch after it is installed, you must restore the database
         and the server to their state prior to installing the patch.

     1. Logon to the system as a user with administrator or
        root authority.

     2. Stop the Tivoli Security Compliance Manager server.

        AIX, Solaris, Linux:
           scmserver stop

        Windows:
           Stop the service from the Services window of
           the Control Panel or use the following command:
              net stop "SCM Server"

     3. Back up the contents of the server directory by copying the
        files in the server installation directory to another location.
        The default server installation directory is:

        AIX, Solaris, Linux:
           /opt/IBM/SCM

        Windows:
           %systemdrive%\Program Files\IBM\SCM

     4. Open a DB2 command line processing window on your DB2 database
        server system.

        AIX, Solaris, Linux:
           Log in as a user with sufficient DB2 authority to
           access the database, such as the DB2 database
           instance owner.

        Windows:
           Start the DB2 Command Line Processor from the Windows
           desktop: "Start" -> "Programs" ->  "IBM DB2" ->
           "Command Line Processor"
              or
           Set up the DB2 environment by running the db2cmd command.

     5. Back up the contents of the Tivoli Security Compliance Manager
        database.

        From the DB2 command line processor window, enter the following
        command:

           db2 "backup database jac to <backup_directory>"

        where <backup_directory> specifies an existing directory
        with sufficient space for the backup copy of the database.


4.0 INSTALLING THIS PATCH
-------------------------


  Before installing this patch, be sure that you have reviewed the
  prerequisites and have completed the backup procedure in section
  3.0, "BEFORE INSTALLING THIS PATCH".

  The patch is applied in the following order: to the server, to the
  DB2 database server (if the DB2 server is on a separate system), and
  to all systems (other than the server) with the administration utilities
  installed.  Optionally, the patch can be installed to individual client
  systems.  In general, however, the patch does not need to be installed
  to individual client systems, because they can be automatically updated
  by the server.


4.1 Installing the patch on the server

  Installing the patch on the Tivoli Security Compliance Manager server
  system updates the server component, the administration utilities
  component, and, if installed, the client component.

  To install the patch on the server system, do the following:

     1. Logon to the system as a user with administrator or
        root authority.

     2. Stop the server.  Do not restart the server until directed
        to do so in section 4.5 of this README file.

        AIX, Solaris, Linux:
           <scm_inst_dir>/server/scmserver stop

        Windows:
           Stop the service from the Services window of
           the Control Panel or use the following command:
              net stop "SCM Server"

     3. Copy the patch package to the server system.

     4. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.0-TIV-SCM-FP0029.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.0-TIV-SCM-FP0029.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.0-TIV-SCM-FP0029.<platform>.tar file if you only
        want to extract the files for a particular platform.

     5. Run the appropriate command to install the patch on the server:

           AIX system:       scmpatch29_aix
           Linux system:     scmpatch29_linux
           Solaris system:   scmpatch29_solaris
           Windows system:   scmpatch29_win32


     Note: We recommend that clients installed on the same system as
           the server have auto-update disabled.   

           (See any.any.DisableClientUpdateV1.jar in the collector reference or
           6.9 for details about clients running on the same machine as server)

     If both the server and client components are installed on the
     system, the installation program might erroneously report that
     the following files are newer than the ones being installed as
     part of the patch:

            jacsecurity.jar

     This is caused by the files having the wrong date. Click Yes
     to replace the file.



4.2 Installing the patch on the DB2 database server

     NOTE: If the collector any.any.ClientCollectorVersions is currently 
           installed then you should run the scmCCVersionUpgrade.sql script
           as descibed in step 8 below.  This step is a manual process 
           regardless of the use of remote or local databases.

     NOTE: If the DB2 database server is on the same system as the
           Tivoli Security Compliance Manager server, this step is not
           necessary and you can continue with section 4.3.

  If the DB2 database server is on a different system than the
  Tivoli Security Compliance Manager server, you must install the
  patch on the DB2 database server system.

     1. Ensure that the Tivoli Security Compliance Manager server
        is stopped.  Updating the database while the server is
        running might result in the loss of data.

     2. Logon to the DB2 database server system as a DB2
        administrator.

     3. Copy the patch package to the database server system.

     4. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.0-TIV-SCM-FP0029.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.0-TIV-SCM-FP0029.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.0-TIV-SCM-FP0029.<platform>.tar file if you only
        want to extract the files for a particular platform.

     5. Run the following command to install the patch:

        scmpatch29_<platform>

          where <platform> is one of the following:
             aix, hp11, linux, linux390, linuxppc, solaris, or win32

     6. Open a DB2 command line processing window.

        AIX, Solaris, Linux:
           Log in as a user with sufficient DB2 authority to
           access the database, such as the DB2 database
           instance owner.

        Windows:
           Start the DB2 Command Line Processor from the Windows
           desktop: "Start" -> "Programs" ->  "IBM DB2" ->
           "Command Line Processor"
              or
           Set up the DB2 environment by running the db2cmd command.


     7. Change to the <scm_inst_dir>/sql directory, which contains
        the SQL scripts that are used to update the DB2 database
        tables.

     8. Update the DB2 database tables as follows.

            Creating the SNAPSHOT_CLIENTS table:

            To run the create snapshot clients script, enter the following 
            command in the DB2 command processing window:

                    db2 -tvf create_snapshot_clients.sql

            To update the existing tables, enter the following commands in 
            the DB2 command processing window:

                    db2 -tvf scmbatch.sql

                    Note: This script will make the following changes:
                         CLIENT table  OS_NAME column increased to 40
                         COLLECTOR table  DESCRIPTION column increased to 500
                         COMPLIANCE_SQL table  DESCRIPTION column increased to
                         1000

                    db2 -tvf scmCCVersionUpgrade.sql

                    Note: This script will make the following change:
                          JAC_IDATA.CLIENT_COL_VERSIONS table INSTANCE_NAME
                          column increased from 30 to 100 (related to APAR
                          IY79359)
                    Note: The scmCCVersionUpgrade.sql script is necessary
                          because the tables used by the collector
                          any.any.ClientCollectorVersions cannot be updated
                          using scminstallcollector. 

                    db2 -tvf viewUpdateFilePermsV1v11.sql

                    Note: This script will make the following change:
                          Adds ERRORCODE column in the view
                          JAC_DATA.WIN_FILE_PERMS_V1. This column was added in
                          version 11 of the win.any.FilePermsV1 collector. 
                          If you have installed this collector over the old
                          version supplied with the policy, the view associated
                          with this table won't be upgraded automatically.
            
            Only if you are updating from version prior to FP24 please run the 
            following script:

                    db2 -tvf migrate_51020_to_51024.sql

                    Note: This script will make the following changes:
                         VIOLATIONS table  SUPPRESS column added
                         The suppress column is updated based on values from
                         the VIOLATION_SUPPRESSION table.


4.3 Installing the patch on systems with the administration utilities component

  The patch must be applied to every system where the administration
  utilities component is installed.  (The administration utilities component
  on the Tivoli Security Compliance Manager server system has already been
  updated, so there is no need to install the patch again on that system.)

     1. Logon to the system as a user with administrator or
        root authority.

     2. Copy the patch package to the system.

     3. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.0-TIV-SCM-FP0029.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.0-TIV-SCM-FP0029.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.0-TIV-SCM-FP0029.<platform>.tar file if you only
        want to extract the files for a particular platform.

     4. Run the following command to install the patch:

        scmpatch29_<platform>

          where <platform> is one of the following:
             aix, hp11, linux, linux390, linuxppc, solaris, or win32


4.4 Manually installing the patch on a client system

     NOTE:  Only use this procedure if you wish to manually update the
            client component on selected systems.  The automatic
            updating of client systems is described in section 4.7 and is
            performed after the server is restarted.

            Before upgrading the client component on a SUSE Linux
            Enterprise Server 8 for pSeries system, the client component
            must be explicitly stopped using the "jacclient stop" command
            due to a problem with the InstallShield MultiPlatform program.

  The patch can be installed on a specific client system. This method
  must be used on systems where the automatic update capability of
  the client has been explicitly disabled.

  In general, the procedure in section 4.6 is used to update client systems.

  To manually install the patch on a client system:

     1. Logon to the client system as a user with administrator or
        root authority.

     2. Copy the patch package to the client system.

     3. Change to a temporary directory and unpack the patch
        package.  On UNIX or Linux systems, the tar command
        can be used, for example:

           cd /tmp/scm
           tar -xvf 5.1.0-TIV-SCM-FP0029.tar

        On Microsoft Windows systems, unpack the patch package
        using a file extraction utility that supports tar files,
        such as pkunzip or WinZip.

        The 5.1.0-TIV-SCM-FP0029.tar file contains files for all
        operating system platforms supported by this patch. Use
        the 5.1.0-TIV-SCM-FP0029.<platform>.tar file if you only
        want to extract the files for a particular platform.

     4. Run the following command to install the patch:

        scmpatch29_<platform>

          where <platform> is one of the following:
             aix, hp11, linux, linux390, linuxppc, solaris, or win32

4.5 Installing this patch on a NetWare client

    On a Microsoft Windows system, unpack the patch package
    using a file extraction utility that supports tar files,
    such as pkunzip or WinZip.

    Note: These steps are not required if you applied patch 5.1.0-TIV-SCM-LA0010
    on the NetWare client and auto-update is enabled.

       1. The client component must be explicitly stopped on a NetWare system 
          before updating the component. Enter the following command to
          stop the client: NetWare_Install_Dir\client\jacclient stop

       2. Mount the NetWare volume where the Tivoli Security Compliance Manager 
          client is installed, typically SYS:. to your Windows client.

          User must have the proper authorities to be able to mount 
          and copy files to this volume.  
   
       3. Copy the client.jar and jacsecurity.jar file to the installation's 
          jars directory.  Typically SYS:\opt\IBM\SCM\jars.   
   
                copy client.jar  NetWare_Install_Dir\jars
                copy jacsecurity.jar NetWare_Install_Dir\jars

       4. Then start the client. Enter the following command to
          start the client: NetWare_Install_Dir\client\jacclient start


4.6 Restarting the server

  After updating the Tivoli Security Compliance Manager server, the
  DB2 database server (if on a separate system), all systems with
  the administration utilities component installed, and those client
  systems that you wish to update manually, you must restart the
  server.

     1. Logon to the system as a user with administrator or
        root authority.

     2. Verify that the <scm_inst_dir>/server/server.ini file
        has the export.port value set to 1955. If not, change the
        value to be 1955:

                export.port=1955

     3. Restart the server.

        AIX, Solaris, Linux:
           <scm_inst_dir>/server/scmserver start

        Windows:
           Start the service from the Services window of
           the Control Panel or use the following command:
              net start "SCM Server"

  Note: As clients communicate with the upgraded server for the first time, they
  automatically download and install the new client software.

4.7 Automatically installing the patch on client systems
     NOTE:  The installation of the clientupdate.jar released with FP29 is
            not critical for customers migrating from FP24 or later. We highly
            reccomend instalation of the updated client component for version
            synchronization purposes, but it could be deferred to best suiting
            timeframe.
            For customers migrating from pre-FP24 systems this step
            is obligatory and they should distribute new version of client
            component as a part of the patch installation process.
     
     NOTE:  By default, clients are permitted to automatically
            update to the version of the client component software
            provided by the server. If a client system has had
            this automatic capability disabled, use the procedure in 
            section 4.4 to update the client system manually.

  To automatically update the client component on client systems,
  you must make the clientupdate.jar file provided with this patch
  available on the server.

     1. Logon to the Tivoli Security Compliance Manager administration
        console as a user with the Super Administrator role.

     2. Click the Server tab on the administration console.

     3. Click the Client Code tab.

     4. Click Update Client Code.

     5. Select the clientupdate.jar file provided with this patch.
        The file is located in the <scm_inst_dir>/updates
        directory.  Click Open.

     6. In the Update Client Code window, click OK to confirm
        the update.

  In general, the update of both push and pull clients should occur
  in about four hours.  However, depending on a variety of factors
  such as the number of clients to update and the network load,
  this time could be considerably more, possibly up to several hours.

  The interval that the client uses for checking for updates is
  determined by the check.interval=14400 setting in the client
  preferences file. The default value of 14400 seconds represents
  a 4 hour interval between update checks. Pull clients tend to
  take longer to upgrade than push clients.  A push client checks
  for an update when the client starts, and at the client update
  interval after that.  A pull client only checks for an update at
  the client update interval. A "soft reset request" from the
  administration console can be directed to a push client system
  that is being slow to update.


5.0 AFTER INSTALLING THIS PATCH
-------------------------------


5.1 Installing collectors included with this patch


   For more information on installing collectors, see the 
   IBM Tivoli Security Compliance Manager 5.1 Administration Guide.

   As noted in section 7.1, the scminstallcollector  command now 
   has a "-force" option.  This option can be used to force the installation
   to override an existing collector if you encounter any collectors that 
   currently have the same  version as one you are attempting to install.

   Example installation using command line interface:

       scminstallcollector -user  scmadmin  -server  myserver.us.ibm.com \
       -force -file aix.any.BshQueueV1.jar  

  Note: The server portion of the patch should be installed prior to 
  using scminstallcollector to install any collectors.

   Collector versions included in this patch (+ indicates changes to last FP27):

       aix.any.BshQueueV1.jar              - Version  2
       aix.any.SecUserV1.jar               - Version  6
       any.any.CleanupClientCores.jar      - Version  1
       any.any.ClientCollectorVersions.jar - Version  2
       any.any.InventoryV1.jar             - Version  3
       com.ibm.jac.server.JACProxy.jar     - Version  9
       unix.any.AnonFtpFilePermsV1.jar     - Version  6
       unix.any.AnonFtpPasswdV1.jar        - Version  5
       unix.any.CronTabPermsV1.jar         - Version  4
       unix.any.FilePermsV1.jar            - Version  7
       unix.any.FileSearchV1.jar           - Version  3
       unix.any.HomeFsV1.jar               - Version  8
      +unix.any.ResolvConfV1.jar           - Version  2
       unix.any.SecurityKeysV1.jar         - Version  3
       unix.any.ShellsV1.jar               - Version  4
      +unix.any.UsersV1.jar                - Version  7
       unix.any.XserverAclV1.jar           - Version  5
       unix.multi.FailedLoginV1.jar        - Version  4
      +unix.multi.ShadowV1.jar             - Version  4
       unix.multi.XinetdV1.jar             - Version  2
       win.any.AnonFtpIISV1.jar            - Version  6
       win.any.FailedLoginV1.jar           - Version  5
      +win.any.FileAuditV1.jar             - Version  2
       win.any.FilePermsV1.jar             - Version 11
       win.any.GenericRegistryKeyV1.jar    - Version  8
       win.any.GroupsV1.jar                - Version  2
      +win.any.GroupsV2.jar                - Version  6
       win.any.LogSizeV1.jar               - Version  5
       win.any.NavV1.jar                   - Version  9
       win.any.NetAccountsV1.jar           - Version  6
      +win.any.PwExpiryV1.jar              - Version  8
       win.any.RegPermsV1.jar              - Version  6
       win.any.ServicesV1.jar              - Version  7
       win.any.SnmpActiveV1.jar            - Version  5
       win.any.UserV1.jar                  - Version  8
       win.multi.AuditPolicyV1.jar         - Version  7
       win.nt.AuditPolicyV1.jar            - Version  6

5.2 Collectors not included with this patch

    The following collectors were not reported in APAR IY82265 but found
    to be affected by the changes to the Groups.exe executable fixed 
    in IY82265 and IY86142.  

                win.any.DB2BkupDirPermsV1
                win.any.DB2DbDirPermsV1
                win.any.DB2LogDirPermsV1
                win.any.DB2UserGroupAuthV1

    These collectors will require additional testing and be released at a later
    date.

5.3 Installing additional base components after installing a fix pack

     The ISMP installation maintains a file of installed product components.
     This file is called vpd.properties and can be found in the following
     locations:

            Windows:  %SystemRoot%\vpd.properties
            AIX:      /usr/lib/objrepos/vpd.properties
            Linux:    /root/vpd.properties
            HP-UX:    /vpd.properties
            Solaris:  /vpd.properties

     Each time ISMP installs a new component the version is updated. 
     The base installation that originally shipped is expecting a version of
     5.1.0.0.

     To allow the base installation to install a new component proceed with
     the following:

           1.  Backup your vpd.properties by copying it to a new location.

           2.  Edit the vpd.properties file by locating the line that 
               corresponds to the line shown in the example.  You can 
               uniquely identify the line by the following string:

               SCMProductName
            
            The example shows a version 5.1.0.2 being changed to 5.1.0.0.
            Each instance of the following separate patterns are changed: 

               5.1.0.2 to 5.1.0.0 

               |5|1|2|0| to |5|1|0|0|


            Note:  This line was split for readability in this document.
            Do not split the line in the vpd.properties file.


IBMTivoliSecurityComplianceManager|5|1|2|0|5.1.0.2|1=SCMProductName|
            IBM Tivoli Security Compliance Manager|
            IBM Tivoli Security Compliance Manager Version 5.1|
            International Business Machines, Inc.|
            http://www.ibm.com|IBMSCM501000|D:\Program Files\IBM\SCM|0|0|1|
            IBMTivoliSecurityComplianceManager|5|1|2|0|5.1.0.2|1|0|false|
            "_uninst" "uninstall.jar" "uninstall.dat" ""|true|3|
            IBMTivoliSecurityComplianceManager|5|1|2|0|5.1.0.2|1

            The line should be changed to look like the following by
            changing the version number patterns previously described.


IBMTivoliSecurityComplianceManager|5|1|0|0|5.1.0.0|1=SCMProductName|
            IBM Tivoli Security Compliance Manager|
            IBM Tivoli Security Compliance Manager Version 5.1|
            International Business Machines, Inc.|
            http://www.ibm.com|IBMSCM501000|D:\Program Files\IBM\SCM|0|0|1|
            IBMTivoliSecurityComplianceManager|5|1|0|0|5.1.0.0|1|0|false|
            "_uninst" "uninstall.jar" "uninstall.dat" ""|true|3|
            IBMTivoliSecurityComplianceManager|5|1|0|0|5.1.0.0|1                


        3.  Run the base installation and install the desired component(s).

        4.  Repeat step 2, this time replacing the version number patterns
            with the original values (5.1.0.2 and |5|1|2|0| in this example).  
            Be sure to only change version for the above line at this step. 
            Do not replace the version for newly installed components. 



6.0 DOCUMENTATION UPDATES
-------------------------

  The following problems with the existing documentation have
  been identified.
  
6.1 IBM Tivoli Security Compliance Manager Administration Guide

  o In Appendix A "Administration command reference"

       These options are only available with fixpack 5.1.0-TIV-SCM-FP0009 and
       later.

       scmimportpolicy  command

             -update   updates existing polices 


       scminstallcollector  command

             -force    ignores collector version number 


6.2 IBM Tivoli Security Compliance Manager Installation Guide: All Components

  o In Chapter 2 "Installing the Tivoli Security Compliance Manager server" 
    in the "Before you begin" section, add the following note:

        NOTE: If your deployment will use a remote DB2 database, you need to
        install and configure that database using the Database Configuration
        Utility and the instructions in Chapter 5 "Using the Tivoli Security
        Compliance Manager database utilities" prior to installing the Tivoli
        Security Compliance Manager server.

  o In Chapter 2 "Installing the Tivoli Security Compliance Manager server" 
    in the "Before you begin" section, add the following bullet:

        o For deployments that will use a remote DB2 database, ensure that 
          the db2jd daemon or the DB2 JDBC APPLET SERVER is running on the 
          remote system before installing the server. See your DB2 product 
          documentation for instructions on checking and starting the daemon 
          or the applet server.


  o In Chapter 2 "Installing the Tivoli Security Compliance Manager server"
    in the "Using the InstallShield MultiPlatform package to install"
    section, the information provided in step 13 for configuring using a
    remote database is not clear.  Replace step 13 with the following
    two steps (13 and 13A):

    13.  For installations that use a remote database, you must copy the
         JDBC driver from the DB2 database server system to the Tivoli
         Security Compliance Manager server.  The typical location for
         this file on the DB2 database server is:

         Windows:    C:\Program Files\IBM\SQLLIB\java\db2java.zip

         UNIX and Linux:   /home/db2instl/sqllib/java/db2java.zip

         Copy the file to the Tivoli Security Compliance Manager
         server and record the directory and file name.  This
         information is needed when configuring the database
         connectivity in the next step.

      NOTE:  Although the information requested is the same, the
             order in which the information is displayed by the
             installation program differs based on operating
             system.  The procedure that follows uses the order
             on Windows systems.

    13A. The Database Configuration window is displayed.  Enter the
         following information:

         o The DB2 user ID and password.

         o The location of the JAR or ZIP file containing the DB2 JDBC
           driver.  This file was obtained from the DB2 database server
           in step 13.

         o The name of the DB2 JDBC driver.  A default DB2 JDBC name
           is displayed.

         o The URL to use for database connectivity.  The URL is of the
           form:
                    jdbc:db2://<server-name>:6789/JAC

           where <server-name> is the fully qualified name of the DB2
           database server, 6789 is the port number to use, and JAC is
           the name of the database.

           Confirm the information with your DB2 administrator if
           you are uncertain what values to use.

         Click Next to continue.

6.3 IBM Tivoli Security Compliance Manager Administration Guide

  o In Chapter 5 "Managing clients and client groups" in the "Displaying
    unregistered clients" section, add the following note to the beginning
    of the section.

      NOTE: The list of unregistered clients is built up over time and
      cached in the server. When the server is restarted the list is 
      rebuilt over time.

  o  In Chapter 15 "Installing and Using Proxy Relays"

     Note:  It is not recommended to configure a Proxy Relay on a client
     if that client is also a Tivoli Security Compliance Manager server.

6.4 IBM Tivoli Security Compliance Manager IISSCN Extension Release Notes

  o The files mentioned in the step 5 (test_ca.cer, server.cer and server.pvk)
    are missing in FP0009. Please find them in the FP0029. 

  o Replace step 10 & 11 of the ACS configuration guide with following :

    10. Next you need to add the IBM SCM attributes to the ACS. Copy the
        avplist5.txt file that is included with Tivoli Security Compliance
        Manager IISSCN Extension Pack 1 for TCM to the C:\temp directory on
        the ACS server machine.

    11. Add the IBM SCM attributes to ACS by running the following command: 

C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -addavp C:\temp\avplist5.txt 

        where avplist5.txt is a file containing the IBM SCM attribute
        information. On a ACS 4.0 system use the avplist5_40.txt file supplied
        with FP0029. Once the Tivoli Security Compliance Manager Policy Version
        and Violation Count attributes are added to the ACS server, they can be
        used along with the other Cisco posture attributes to build ACS local
        rules and a policy

6.5 Expiration of the original IBMJCE certificates.

    The JCE shipped with the TSCM 5.1.0 contains certificates which expired on
    May 18th 2006. Although TSCM itself wasn't affected by this, some of the
    collectors developed by a third party vendors uses them on. Expiration of
    the above mentioned certificates causes components relying on JCE to stop
    working. In this case we reccomend upgrade of the JCE to the version 1.2.1.
    The separate bundle containing JCE 1.2.1 and the installation instructions
    was prepared and is available on the TSCM Utilities page. 
    http://www-1.ibm.com/support/docview.wss?rs=0&q1=compliance&uid=swg24007082&loc=en_US&cs=utf-8&cc=us&lang=en

    Fixpack FP0029 contains one change related to this update - the jacgui.bat
    script used to start administration console was updated to include new
    jar files shipped with JCE 1.2.1. Scripts for other OSes are universal and
    doesn't need update.

6.6 win.any.FilePermsV1 collector changes
      
         win.any.FilePermsV1 - With version 9 of the win.any.FilePermsV1 
         collector it will now attempt to retrieve security information from 
         Windows even in cases where the user or domain cannot be found, or 
         the domain cannot be contacted.  In situations where a domain cannot 
         be reached or found the domain name returned will be "UnknownDomain".
          
         In cases where a user cannot be found, the user name returned 
         will be "UnknownUser". 

         In cases where win.any.FilePermsV1 does not have the permissions to 
         access the user’s security information, the user name returned will be
         "DeniedUser".  This situation is most likely to occur when the user is 
         not found on the local machine and the domain server prohibits access.

         These changes allow the collector to continue to gather security 
         information for a file rather than abort due to configuration problems.

         The win.any.FilePermsV1 collector will return the effective rights of 
         a user rather than specific rights as is common with some security 
         tools. Effective rights are calculated by the operating system and take
         into account group memberships; specific rights do not account for
         group membership when calculating permissions.
          
         Since version 11 the WIN_FILES_V1 and WIN_FILE_PERMS_V1 tables have
         a column called ERROR_CODE which will contain error codes returned by
         executables used by collector while running. If you install this
         collector over the old version supplied with the policy, the view
         associated with this table won't be upgraded automatically. To fix
         this problem use viewUpdateFilePermsV1v11.sql script located in the
         $SCM_HOME/sql folder (see 4.2.8 for more installation details).
 
6.7 any.any.CleanupClientCores collector
     
         The any.any.CleanupClientCores.jar collector has been provided to help
         resolve problems described in APAR IY74104. It requires no paramaters
         and will remove all javacore and  heapdump files from the directory
         <Install_Dir>\client.  This collector can be scheduled to run 
         regularly.

         The current implementation depends on clients having either patch 
         5.1.0-TIV-SCM-IF0001 or patch 5.1.0-TIV-SCM-FP0009 as a minimum.

6.8  win.any.GenericRegistryKeyV1 collector filtering

         The subkey parameter name can  include a list of registry-value names
         to include in the results. The list must be separated from the registry
         key name by a colon (:). The list can be comma (,) or colon (:)
         separated. This in particular, allows the customer to specify which
         registry-value name for the win.any.GenericRegistryKeyV1 collector to
         include.

         For example:
         HKEY_LOCAL_MACHINE\SOFTWARE\IBM\Java Plug-in\1.4.2:JavaHome,Hide System
         TrayIcon
         will result in values for "JavaHome" and "Hide System TrayIcon", but
         not "(DEFAULT)", etc.

         Note: wildcards are not currently supported when using filtered 
         parameters

6.9 win.any.GenericRegistryKeyV1 reporting of incorrect registry keys

         Versions prior to 8 incorrectly skipped nonexisting registry keys in a
         report. Design documentation requires this collector to report them
         in form of key name (in KEYNAME column) followed by empty keys.

6.10  win.any.NetStatV1 collector filtering

         The win.any.NetStatV1 collector can be configured to filter by each
         parameter.

         RESOLVE_ADDRESSES - Filtering parameter used to determine whether 
         the collector should return IP address or hostname.  This 
         parameter is not required and defaults to "false". 

         PROTOCOL - Filtering parameter specifying which protocol should 
         be returned.  Possible values are: TCP and UDP (For all Windows), 
         TCPv6 and UDPv6 (For Win XP and Win 2003).
         This parameter is not required and the default is all protocols.

         STATE - Filtering parameter specifying TCP connection states.
         Possible values are: ESTABLISHED, SYN_SENT, SYN_RECV, FIN_WAIT1, 
         FIN_WAIT2, TIME_WAIT, CLOSED, CLOSE_WAIT, LAST_ACK, LISTEN, 
         CLOSING and DELETE_TCB This parameter is not required.  The default
         is that all states are returned.

6.11  Collectors not getting updated on clients

         In section 2.6 of this README, APAR IY70709 describes a problem with 
         collectors not updating or only partially updating on the client. 
         This problem has been fixed but requires the client.jar included 
         with this patch. If the collector jar file or one of the executables 
         cannot be updated an error will be logged and the collector will 
         not be updated.

         The collector any.any.ClientCollectorVersions.jar has been provided to
         assist in verifying that a particular collector version is being used
         by the client.  This collector requires Patch 5.1.0-TIV-SCM-IF0001
         be installed on the client. Otherwise an error is returned stating 
         that a 5.1.0.1 client or higher is required.


         The any.any.ClientCollectorVersions collector returns the following
         data columns:

             COLLECTOR  - Name of the collector.

             CL_COL_INST  - Collector instance id.

             INSTANCE_NAME  -  Name of thection collector instance.

             ACTIVE   - Value of true indicates the collector was sucessfully 
             loaded.

             RELEASE  - Current release(version) number of the collector.  
             If the value of ACTIVE is false and the RELEASE number matches 
             the version number of collector on the server then this indicates
             collector did not properly update.

6.12 any.any.DisableClientUpdateV1 collector changes

         APAR IY81371 updates description of any.any.DisableClientUpdatesV1
         collector to clarify it's scope. The description after changes is:
         Permits an administrator to prevent updates from the server to the
         client component.
         
         Also additional clarifying note was added:
         Running this collector on a server machine that also has the client
         installed on it does not prevent the client from being updated when
         installing a fixpack on the SCM server manually, the installation
         wizard will identify which components are installed and updates all
         the components. Presence of disableupdate file in the client directory
         does not prevent manual updates.
 

7.0 SOFTWARE LIMITATIONS
------------------------
       None

8.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
------------------------------------------------

8.1  SQL scripts might produce errors after migration

     You might see one or more errors indicating a duplicate name or
     that no row was found. These messages can be ignored.

8.2  SUSE 9 for  IA32/xSeries startup link missing

     The problem described affects
     SUSE Linux Enterprise Server 9 for IA32/xSeries clients
     installed using IBM Tivoli Security Compliance Manager Version 5.1.

     You may find that for SUSE 9 X86 Clients installed using the base 
     product and the ISMP installer the startup link to the jacclient script 
     is not correctly configured.

     This can be corrected by manually creating the following links:

     ln -s  /opt/IBM/SCM/client/jacclient /etc/rc.d/rc3.d/S11IBMSCMclient
     ln -s  /opt/IBM/SCM/client/jacclient /etc/rc.d/rc5.d/S11IBMSCMclient

     This enables the  Tivoli Security Compliance Manager client to start 

8.3  SUSE 8 for iSeries/pSeries  startup link missing

     The problem described affects
     SUSE Linux Enterprise Server 8 for iSeries/pSeries  clients
     installed using IBM Tivoli Security Compliance Manager Version 5.1.

     You may find that for SUSE Power PC Clients installed using the base 
     product and the ISMP installer the startup link to the jacclient script 
     is not correctly configured.

     This can be corrected by manually creating the following links:

     ln -s  /opt/IBM/SCM/client/jacclient /etc/rc.d/rc3.d/S11IBMSCMclient
     ln -s  /opt/IBM/SCM/client/jacclient /etc/rc.d/rc5.d/S11IBMSCMclient

     This enables the  Tivoli Security Compliance Manager client to start 
     for either run state 3 or run state 5.

8.4  Parameter discrepancies with unix.any.AnonFtpFilePerms

     Internal CMVC Defect 62031
     If any of  the default values for the SYSTEM_DIRS parameter (which include:
     bin, etc and lib) are used as values for the EXCLUDE_DIRS parameters, the 
     unix.any.AnonFtpFilePerms collector returns a file listing from the client
     installation directory.

     This problem can be avoided by taking care to not specify bin, etc or lib
     as values in the  EXCLUDE_DIR parameter.  

8.5 Java startup script causes problems on SUSE Linux Enterprise Server 

     This known problem only affects clients on SUSE Linux Enterprise 
     Server 8 for pSeries.  
     
     The java startup script  <scm_inst_dir>/_jvm/jre/bin/java 
     sets the environment variable LD_ASSUME_KERNEL=2.4.1
     This is required by java but causes problems with native
     binary commands.  

     1. Uninstall fails to stop the client on SUSE Linux Enterprise 
        Server 8 for pSeries 

         During the process of uninstalling a Tivoli Security Compliance Manager
         client the following message may be seen:

         HCVIN0020I Stopping the Tivoli Security Compliance Manager client.
         HCVIN0027I The client stopped successfully.
         ps: error while loading shared libraries: libc.so.6: cannot open shared
         object file: No such file or directory

         If this error occurs the client will get removed from the system. 
         However the Java process may remain running.  If this happens the 
         client should be manually stopped by using the kill command.


    2.   Collectors that use /bin/ps are also affected and may see the
         error described above in part 1.  Currently there is no work 
         around for this issue.


8.6 Client service sometimes removed on Windows by patch installation

    The problem described below does not apply to clients updated 
    by liveupdate.

    Fix packs 5.1.0-TIV-SCM-FP0020 and later remove the "SCM Client" 
    service on Windows systems in order to install the service with 
    additional parameters.  The re-installation of the "SCM Client" 
    service sometimes fails because the removal of the service is 
    still pending.  This error has been observed on Windows 2000 
    systems when using the Windows services console to stop a Tivoli 
    Security Compliance Manager service and fail to exit the services 
    console before installing the Tivoli Security Compliance Manager 
    fix pack.  

    If the installation of the "SCM Client" service fails, the error
    should be recorded in the file (default path shown):

       \Program Files\IBM\tivoli\common\HCV\logs\msgHCV_jacservice.log

    If the service error occurs, you can correct the problem with the 
    following procedure:

    1) Exit the Windows services console.

    2) Change to the SCM\client directory and run the following command:

          jacservice.exe -install -desktop

       The above command will display a message that tells whether the
       service has been installed successfully.

    Note that it is not necessary to stop the Tivoli Security 
    Compliance Manager server or client before installing a fix pack
    because the fix pack installation stops the necessary components
    before performing the update.  



8.7 Known collector problems


    8.7.1 win.any.RegPermsV1

    The win.any.RegPermsV1 collector could return out of date permissions
    for keys retrieved from HKEY_CURRENT_USER hive. This issue has limited 
    impact, however the same information can be retrieved from the HKEY_USERS 
    hive.  Also use of HKEY_CURRENT_USER is limited to the System account (the
    default account the SCM Client is run under Windows).

    The win.any.RegPermsV1 collector returns key name followed by empty fields
    if it is not able to gather required data.  However, it is not logging 
    information about reason why data wasn’t gathered.  Common causes include: 
    non existant registry key or insufficient permissions to read the key.
  

9.0 NOTICES
------------
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Customers are responsible for ensuring their own compliance with various
laws such as the Graham-Leach-Bliley Act, the Sarbanes-Oxley Act, and the
Health Insurance Portability and Accountability Act.  It is the customer's
sole responsibility to obtain advice of competent legal counsel as to the
identification and interpretation of any relevant laws that may affect the
customer's business and any actions the customer may need to take to comply
with such laws. IBM does not provide legal, accounting or auditing advice,
or represent or warrant that its products or services will ensure that customer
is in compliance with any law.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.


9.1 Trademarks

The following terms are trademarks or registered trademarks of International
Business Machines Corporation in the United States, other countries, or both:

AIX
DB2
IBM
IBM logo
iSeries
pSeries
Tivoli
Tivoli logo
xSeries
zSeries

Java and all Java-based trademarks and logos are trademarks of Sun
Microsystems, Inc.
in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft
Corporation in the United States, other countries, or both.

Linux is a trademark of Linus Torvalds in the United States, other countries,
or both.

UNIX is a registered trademark of The Open Group in the United States and
other countries.

Other company, product, and service names may be trademarks or service marks
of others.


End of IBM Tivoli Security Compliance Manager, Patch 5.1.0-TIV-SCM-FP0029 README

