Date: June 8, 2007
(C) Copyright International Business Machines
Corp., 2005 All rights reserved.
Hints and Tips for using the new web-based
user interface
This user interface is comprised of several major
components: the Banner, the Task bar, the Navigation pane, the Work pane, and
the Status bar. The Banner, across the top of the workplace window,
identifies the product and logo. It is optionally displayed and is set by using
the Change User Interface Settings task. The Task bar, located
below the Banner, displays the name(s) of any tasks that are running, the user
ID you are logged in as, online help information, and the ability to logoff or
disconnect from the console. The Navigation pane, in the left portion of
the window, contains the primary navigation links for managing your system
resources and the Hardware Management Console. The items are referred to as
nodes. The Work pane, in the right portion of the window, displays
information based on the current selection from the Navigation pane. For
example, when Welcome is selected in the Navigation pane, the Welcome
window content is displayed in the Work pane. The Status bar, in the
bottom left portion of the window, provides visual indicators of current
overall system status. It also contains a status overview icon which may be
selected to display more detailed status information in the Work pane.
The System p Operations Guide for the Hardware Management Console and Managed Systems can be accessed online on the HMC. Select Welcome in the Navigation pane. The Welcome window content is displayed in the Work pane. Select HMC Operations Guide to view it.
Additional
education, support, tutorial and technical information can also be accessed
online on the
To log on the HMC from a remote browser, the HMC must
first be configured for web browser access.
See appendix C of the System p Operations Guide for the Hardware Management Console and
Managed Systems for
instructions on how to configure the HMC for remote web browser access. After the HMC has been properly configured,
from your web browser enter the URL of the HMC using the format https://xxx.xxx.xxx.xxx.
Upgrade Hints
Certificates and keyring files generated
by the System Manager Security application (on HMC Version 6) will not be
migrated to HMC Version 7. Applications such as remote 5250, which import the
public key ring file to establish a secure connection with HMC, will need to
import a new public key ring file. The new file, SM.pubkr, will
be generated and stored on HMC V7 under /opt/ccfw/data directory. User can copy
this file, using the scp or sendfile command.
For further information on how to setup
remote 5250 using SSL, see support document located on the System i Technical
Support website at the URL
http://www-03.ibm.com/servers/eserver/support/iseries/index.html.
This document and many others can be found by selecting the "Technical
databases" link.
The most significant
and the most noticeable change in the HMC for 7.310 is the move to a new
Web-based User Interface both locally and remote. This interface uses a tree style navigation
model providing hierarchical views of system resources and tasks using drill-down
and launch-in-context techniques to enable direct access to hardware resources
and task management capabilities. It
provides views of system resources and provides tasks for system
administration.
HMC 7.310 can manage
both Power5 and Power6 servers.
On Power6
servers the following new features/enhancements have been added.
Translation language packs are not available at this time.
will release the translation language
time. In the initial release there are some locale specific issues,
i.e., decimal
issues will be addressed
in the translation language
Known Issues:
Web Browser Requirements
Hardware Management Console web browser support requires
HTML 2.0, JavaScript™ 1.0, Java Virtual
cookie support in browsers that will connect to it.
Contact your
support personnel to
is configured with a Java
Virtual Machine. It is required that the
web browser uses the HTTP 1.1 protocol and if you are using a
proxy server,
the HTTP 1.1 protocol is enabled for
connections. Additionally, pop-ups must be enabled for all
Hardware Management Consoles
running with pop-ups disabled. The following browsers have
been tested:
.
Other Web Browser
Considerations
Session cookies need to be
enabled in order for ASMI to work when connected to HMC remotely. The asm proxy code
saves session information and uses it.
Using
Internet Explorer
1. Select Tools -> Internet Options
2. Select Privacy tab and select 'Advanced'.
3.
Check if 'Always allow session cookies'
4. If not
checked, check 'Override automatic cookie handling' and check 'Always allow
session cookies'
5. You can
choose how you want to handle First-party Cookies and Third-party Cookies,
block or prompt or accept. (prompt is preferred in which case you will be prompted every
time a site tries to write cookies. It
may be a little annoying, but it is the safe thing to do. Some sites need to be allowed to write
cookies)
Using Firefox
1. Tools -> Options
2.
Select Cookies Tab
3. Select
check box Allow sites to set cookies.
4. If you
want to allow only specific sites then select 'Exceptions' and then you can
just add this HMC to allow.
Other
Issues
Configuration rules:
1.
The maximum Virtual I/O Slot Number
should be set to (at least) 10 plus the number of virtual I/O slots desired by
the customer.
Note that setting the maximum
higher is OK, the danger is setting it too low. Setting it below 10 will cause a
compatibility issue with newer levels of HMC code. Excess virtual slots use a small amount of
additional memory, but otherwise have no impact.
2.
All customer virtual I/O slots (virtual SCSI, virtual Ethernet or
virtual serial) must use virtual slot IDs 11 or greater.
3. The VASI adapter (used by the
Licenced Internal Code (
CAN-2003-0989 |
tcpdump
remote DOS |
CAN-2003-0190 |
OpenSSH:
info leak issue |
CAN-2004-0078 |
mutt
remote buffer overflow |
CAN-2004-0110 |
libxml2
URI Parsing Remote Buffer Overflow |
CAN-2004-0109 |
Kernel
ISO9660/JFS local privilege escalation, info leak |
CAN-2004-0183 |
tcpdump
ISAKMP remote DOS |
CA-2005-35 |
SSH Protocol 1 Weakness and Vulnerability |
CAN-2004-0427
|
Kernel
privilege escalation, local DoS |
CAN-2004-0554 |
Kernel "__clear_fpu()"
Macro local DoS |
CAN-2004-0523 |
kerberos
aname_to_localname remote root compromise |
CVE-2004-0493 |
Input Header Memory Allocation Denial of Service |
CVE-2004-0488 |
Apache mod_ssl FakeBasicAuth Buffer overflow |
CVE-2004-0747
CVE-2004-0748
CVE-2004-0751
CVE-2004-0786
CVE-2004-0809
|
Apache 2 Multiple Denial of Service |
CVE-2004-0942 |
Apache MIME Header Memory Consumption |
CAN-2004-0460 |
dhcp-server:
remote system compromise |
CVE-2002-1363 |
libpng
remote DoS |
CAN-2004-0590 |
Certificate
chain authentication in Openswan pluto |
CAN-2004-0649 |
L2tpd:
remote execution of arbitrary files w/ privs of l2tpd user |
VU#388984 |
libpng:
multiple vulnerabilities |
CAN-2004-0415
|
Kernel:
local privilege escalation, race condition in file offset pointer handling |
VU#550464
|
krb5:
remote unauthenticated DoS |
CAN-2004-0817 |
imlib:
local execution via heap overflow |
CAN-2004-0687 |
xf86:
multiple buffer overflows with malformed xpm images |
CAN-2004-0966 |
gettext:
Insecure temporary file handling |
CAN-2004-0804 |
tiff:
Buffer overflows in image decoding |
CAN-2004-0884
|
Cyrus-sasl2:
(ver2.1.7)Insecure handling of environment variable |
CAN-2004-0971 |
krb5:
krb5-workstation: Possible symlink attack, priv escalation via temproary file
mishandling |
CAN-2004-0989 |
libxml:
remote code execution, buffer overflow |
CVE-2004-0079 |
Openssl vulnerability |
CAN-2004-0975 |
Openssl:
possible symlink attack via temp file mishandling |
SUSE-SA:2004:041 |
xf86:
SuSE security updates for libxpm |
CAN-2004-0782 |
imlib:
xpm security updates in imlib |
CAN-2004-1010 |
zip:
buffer overflow in info-zip when using recursive folder compression |
CAN-2004-1308 |
tiff:
multiple buffer overflows |
CAN-2004-0986 |
iptables:
variable init failure can cause failure to load firewall rules |
CAN-2004-0883 |
Kernel
update for multiple local and remote DoS vulnerabilities |
CAN-2004-0079 CAN-2004-0112 |
OpenSSL
remote DOS |
CVE-2006-2937 CVE-2006-2940 CVE-2006-2969 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 |
OpenSSL vulnerability |
CAN-2005-0155
|
Perl:
Security update to address two priv escalation and a buffer overflow
condition |
CAN-2005-0449
|
Updates
for multiple issues on 2.4-2.6.11 kernels |
CAN-2005-1993 |
sudo:
vulnerabilities allow execution of arbitrary commands |
CAN-2005-1267 |
tcpdump:
fix for several DOS vulnerabilities |
CAN-2005-1151
|
tiff:
buffer overflow allows execution of arbitrary code |
CAN-2005-0109 |
OpenSSL
update |
CAN-2005-2969 |
OpenSSL
fix for potential SSL 2.0 Rollback vulnerability |
CVE-2001-0572 |
SSHv1
Protocol Available |
CVE-2004-0175 |
OpenSSH
SCP Client File Corruption Vulnerability |
CVE-2006-0225 |
OpenSSH
scp remote attack vulnerability |
CVE-2006-4924 CVE-2006-4925 |
Open SSH vulnerability |
CVE-2006-5051 |
Open SSH vulnerability not applicable to HMC due to GSSAPI being disabled |
CVE-2006-5794 |
Open SSH vulnerability |
CVE-2006-0058 |
Sendmail
remote code execution |
CVE-2006-1721 |
Cyrus-sasl
remote denial of service |
CVE-2006-2024 CVE-2006-2025 CVE-2006-2026 |
Libtiff:
various denial of service attacks |
CVE-2005-3352 CVE-2005-3357 |
Apache2
cross site scripting in mod_imap and mod_ssl |
CVE-2006-0455 |
Gpg
remote execution by signature checking |
CVE-2005-3353 CVE-2005-3389 CVE-2005-3390 CVE-2005-3391 CVE-2005-3392 CVE-2005-3883 |
Multiple
vulnerabilities in php4 |
CVE-2005-2970 |
Apache2
worker memory leak |
CVE-2005-2974 CVE-2005-3350 |
Libungif
denial of service attack/buffer overflow |
CVE-2005-2959 |
Sudo
environment cleaning privilege escalation vulnerability |
CAN-2005-2491 |
PCRE:
Integer overflow vulnerability |
CVE-2005-3119 CVE-2005-3179 CVE-2005-3180 CVE-2005-3181 |
Kernel
potential denial of service and information disclosure |
CAN-2005-2797 CAN-2005-2798 |
OpenSSH:
fixes to prevent escalation of privileges and bypass certain security
restrictions |
CVE-2005-2876 |
Util-linux
umount “-r” Re-Mounting security issue |
CAN-2005-2495 |
Xf86:
Fix remote command execution |
CAN-2005-2491 CAN-2005-2700 CAN-2005-2728 |
Apache2:
Security fixes |
CAN-2005-1761 CAN-2005-1768 CAN-2005-2500 |
Kernel:
Various Security Fixes |
CAN-2005-2452 |
Tiff:
Vulnerability allows DOS attack due to divide by zero error |
CAN-2005-2177 |
Net-snmp
remote attack vulnerability |
CAN-2005-0448 |
Perl
vulnerabilities |
CAN-2005-0758 CAN-2005-0988 CAN-2005-1228 CAN-2005-1260 CAN-2005-0953 |
Bzip2
vulnerability |
CAN-2004-1189 |
Krb5
multiple security issues |
CAN-2005-1849 CAN-2005-2096 |
Zlib
buffer overflow |
CAN-2005-2088 CAN-2005-1268 |
Apache2:
fix for multiple vulnerabilities |
CVE-2005-2970 |
Apache2: memory leak |
CVE-2005-3357 |
Apache2 Cryptographic problem |
CVE-2006-3747 |
Apache2: Off-by-one error in the ldap scheme handling in the Rewrite module |
CVE-2006-3918 |
Apache2 vulnerability |
CVE-2005-2728 |
|
CAN-2004-1453 CAN-2004-0968 CAN-2004-1382 |
Glibc:
Infoleak and symlink attack vulnerabilities |
CAN-2005-1111 CAN-2005-1229 |
Cpio
directory traversal and privilege escalation |
CAN-2005-0605 |
Xf86:
libXPM integer overflow |
CAN-2004-0970 |
Gzip:
temporary file mishandling |
CAN-2005-0160 CAN-2005-0161 CAN-2005-0961 |
telnet:
ENV buffer overflow |
CAN-2005-1704 |
Binutils
vulnerabilities |
CAN-2005-1993 |
Sudo:
race condition |
CAN-2005-0373 |
Cyrus-sasl,
cyrus-sasl2 remote code execution |
CVE-2005-0916 CVE-2005-2456 CVE-2005-2457 CVE-2005-2458 CVE-2005-2555 CVE-2006-0554 CVE-2006-0555 CVE-2006-0557 CVE-2006-0744 CVE-2006-1055 CVE-2006-1056 CVE-2006-1242 CVE-2006-1523 CVE-2006-1524 CVE-2006-1525 CVE-2006-1527 CVE-2006-1528 CVE-2006-1857 CVE-2006-1858 CVE-2006-1863 CVE-2006-1864 CVE-2006-2271 CVE-2006-2272 CVE-2006-2274 CVE-2006-2444 CVE-2006-2448 CVE-2006-2451 CVE-2006-2934 CVE-2006-2935 CVE-2006-3085 CVE-2005-3180 CVE-2006-3468 CVE-2006-3626 CVE-2006-3745 CVE-2006-4093 CVE-2006-4145 CVE-2006-4813 CVE-2006-4997 CVE-2006-5757 CVE-2006-5823 CVE-2006-6053 CVE-2006-2274 CVE-2006-2444 CVE-2006-2448 CVE-2006-2451 CVE-2006-2934 CVE-2006-2935 CVE-2006-3085 CVE-2005-3180 CVE-2006-3468 CVE-2006-3626 CVE-2006-3745 CVE-2006-4093 CVE-2006-4145 CVE-2006-4813 CVE-2006-4997 CVE-2006-5757 CVE-2006-5823 CVE-2006-6053 |
Kernel Vulnerabilities
|