GSK - IBM Global Security Kit

Installing V11.50.XC4. I'm just wondering a few things about this IBM GSK - oh no it has IBM written on it :O And why is the Info Centre offline with the manual detailing it? To hard to ask for a 24x7 website from IBM? When you install Informix nowadays it seems to create /opt/ibm/gsk7 or gsk7_64 and link some things to it as well. Are we back to the old / usr/bin /usr/lib shared objects unable to install more than one version of Informix on a host. I noticed it when reading my $INFORMIXDIR/tmp/gskit.log install log - lots of errors. Also, if your hosts team use the "container clone method" to install then is /opt/ibm/gsk* required along with the /usr symlinks? Can you just clone the $INFORMIXDIR (I know unsupported)? Or will you run into errors, e.g. some internal part of the server requires a .so in /usr. Or is it just if you're using SSL and if not (whatever that may be) you can forget about the GSK? There is a blurb in the machine notes. But it's not 110% clear what uses it? IBM Informix Dynamic Server uses the libraries and utilities provided by the IBM Global Security Kit (GSKit) for data encryption and Secure Sockets Layer (SSL) communication. So Exactly what do I not have to be using to uninstall it or not care when cloning? And is it me or is this messy like Windows having to think about /usr/ lib versions and architectures?

Hi Peter, Gskit is what the PD team used to implement SSL and SSO for 11.50, as such it has to be installed. You can still install multiple versions of IDS on the same box, since gskit is in a separate directory, it shouldn't be a problem. So long as you clone all the files and directories in $INFORMIXDIR, you should not have a problem, though as you say this is unsupported. In one of those directories is the installation for gskit (in later versions of 11.50 that is) As I understand it, oninit is smart enough (in 11.50.xC2 and above, I believe) to install gskit if it is not installed. Hope this helps, Mark ________________________________ From: PeterP <peterpain@gmail.com> To: informix-list@iiug.org Sent: Tuesday, May 5, 2009 4:27:27 AM Subject: GSK - IBM Global Security Kit Installing V11.50.XC4. I'm just wondering a few things about this IBM GSK - oh no it has IBM written on it :O And why is the Info Centre offline with the manual detailing it? To hard to ask for a 24x7 website from IBM? When you install Informix nowadays it seems to create /opt/ibm/gsk7 or gsk7_64 and link some things to it as well. Are we back to the old / usr/bin /usr/lib shared objects unable to install more than one version of Informix on a host. I noticed it when reading my $INFORMIXDIR/tmp/gskit.log install log - lots of errors. Also, if your hosts team use the "container clone method" to install then is /opt/ibm/gsk* required along with the /usr symlinks? Can you just clone the $INFORMIXDIR (I know unsupported)? Or will you run into errors, e.g. some internal part of the server requires a .so in /usr. Or is it just if you're using SSL and if not (whatever that may be) you can forget about the GSK? There is a blurb in the machine notes. But it's not 110% clear what uses it? IBM Informix Dynamic Server uses the libraries and utilities provided by the IBM Global Security Kit (GSKit) for data encryption and Secure Sockets Layer (SSL) communication. So Exactly what do I not have to be using to uninstall it or not care when cloning? And is it me or is this messy like Windows having to think about /usr/ lib versions and architectures? _______________________________________________ Informix-list mailing list Informix-list@iiug.org http://www.iiug.org/mailman/listinfo/informix-list

On May 5, 2:27 am, PeterP <peterp...@gmail.com> wrote: > Installing V11.50.XC4. I'm just wondering a few things about this IBM > GSK - oh no it has IBM written on it :O > And why is the Info Centre offline with the manual detailing it? Too > hard to ask for a 24x7 website from IBM? > > When you install Informix nowadays it seems to create /opt/ibm/gsk7 or > gsk7_64 and link some things to it as well. Are we back to the old / > usr/bin /usr/lib shared objects unable to install more than one > version of Informix on a host. You have always been able to install more than one version of IDS on a host. You must be confusing it with another DBMS. Yes, IDS 11 uses GSKit 7. It needs one copy of it on the machine; it is quite happy to share it with any other application that also uses GSKit. > I noticed it when reading my > $INFORMIXDIR/tmp/gskit.log install log - lots of errors. Not so good. > Also, if your hosts team use the "container clone method" to install > then is /opt/ibm/gsk* required along with the /usr symlinks? When IDS is running, it needs the GSKit links on the target machine. If you copy $INFORMIXDIR around, you get a copy of the GSKit installer, precisely so that you can fix up the target machine. > Can you just clone the $INFORMIXDIR (I know unsupported)? You can clone it; you have to run the GSKit installer on the target. > Or will you > run into errors, e.g. some internal part of the server requires a .so > in /usr. Or is it just if you're using SSL and if not (whatever that > may be) you can forget about the GSK? Anything cryptographic uses GSKit; not just SSL. You might get away without it, but probably won't. And your system is prone to sudden errors even if you manage to start it without GSKit. Think of GSKit as part of the woodwork; it has to be there for IDS to work. > There is a blurb in the machine notes. But it's not 110% clear what > uses it? > > IBM Informix Dynamic Server uses the libraries and utilities provided > by >     the IBM Global Security Kit (GSKit) for data encryption and Secure > Sockets >     Layer (SSL) communication. > > So Exactly what do I not have to be using to uninstall it or not care > when cloning? IDS? AFAIK, you need GSKit. You might get away with it being absent, but I'd not bet on it and certainly don't recommend it. > And is it me or is this messy like Windows having to think about /usr/ > lib versions and architectures? I don't know whether it is you. Software like IDS sometimes has to build on other software - and using GSKit means you get FIPS 140-2 compliant encryption in IDS, and you get encryption software developed by professionals. If IDS did not use it, you would not get those benefits. It is also a carefully engineered, non-intrusive piece of software; the GSKit team has done an excellent job on the packaging of their product. And it is 'install and forget' too - it will be used by other IBM software that needs cryptographic support. You simply need to be aware that when you copy IDS to a 'virgin' machine that has not seen IDS before (not using the installer - that will deal with it for you), then you have to worry about installing GSKit. Once. This is better than the old days when IDS installed shared libraries into /usr/lib and you had to remember to set up the links from /usr/lib to the install location when you copied your software around. At least you get an installer to do the job for you. Thanks. -=JL=-