For use with Version 8 Release 8.6.0 Service Pack 1

Date: 20 June 2017

Contents

The information in this Readme contains the fix list and other package information about the Hardware Management Console.

• PTF MH01703
• Package information
• Enhancements and new function
• List of fixes
• Installation
• Additional information

This package includes fixes for HMC Version 8 Release 8.6.0 Service Pack 1. You can reference this package by APAR MB04090 and PTF MH01703. This image must be installed on top of HMC Version 8 Release 8.6.0 Service Pack 1 (PTF MH01656)  with or without additional fixes.

Note: This PTF supersedes MH01695 and MH01698.

Security fixes

• Removed support for all ciphers that use a Diffie-Hellman modulus of 1024 bits or less from HMC ports 9920, 9960 and 12443.  This change was made to address the following vulnerability: SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam)
• Disabled client-initiated renegotiation for HMC port 9960

General fixes

• Fixed a problem that caused the restart of the OpenSSH server to fail when the chhmcencr command was used to change the supported ciphers for the HMC SSH interface.  Without this fix, you must restart the HMC for the change to take effect.
  
• Fixed various issues with the enhanced GUI partition activation wizard.
  
• Fixed a problem causing NTP service enablement from the HMC GUI to silently fail even though the GUI indicated the NTP service was  successfully enabled and started. 
  
• Fixed a problem that caused Fibre Channel mappings for devices assigned to a running partition to be removed using force when a virtual optical device is added to or removed from a running partition using the Enhanced GUI. Since the mappings are removed using the force option, this can cause a running partition to crash.
  
• Fixed an issue that caused the generation and call home of SRC E212E134 to report that the HMC /var file system size exceeded the threshold limit of 80%.  This problem can only occur if the HMC is configured to transmit performance management information to a service provider and the HMC is managing a large number of partitions.
  
• Fixed a problem where using the chsacfg command to add an email address for event notification failed with the error "An invalid parameter value was entered.  The parameter -a is empty or not valid.  Please check your entry and retry the command.".  This problem only occurs when the domain name in the email address starts with a number.
  
• Increased the internal HMC timeout that affects all REST API and enhanced GUI operations from 10 minutes to 1 hour.  When this timeout occurs, an error such as "502 Proxy Error" or "The proxy server received an invalid response from an upstream server." is returned although the operation that was started continues to run.  Note that many REST API and enhanced GUI operations have separate timeouts that are shorter than 1 hour and those timeouts are not affected by this change.
  
• Fixed another problem with the View Network Topology GUI task that can cause the IP address and managed system information to be missing for the configured HMC Ethernet interfaces.
  
• Fixed a problem that caused RMC issues after updating the HMC to V8R8.6.0 Service Pack 1.  Symptoms include failing DLPAR and partition migration operations, inactive RMC daemons on partitions that won't stay active after they have been restarted, and numerous B303000F errors logged in the console event log due to RMC nodes going up and down.
  
• Fixed a rare issue that can cause a server to go into Incomplete state after installing the HMC due to missing virtual Switch IDs in a partition profile.
  
• Fixed a problem where the GUI Console > Open Terminal Windows (vterm) task used a different URL then the URL of the GUI session.  Symptoms may include:
  
  • A vterm connection error due to resolving an incorrect HMC ip address with errors such as "The connection has timed out.   The server at x.x.x.x is taking too long to respond" where "x.x.x.x" is not the HMC's open interface used for remote access"
  • Certificate errors/warnings regarding the certificate host name such as "Your connection is not secure. The owner of <hmc ip address> has configured their website improperly. <hmc ip address> uses an invalid security certificate
    The certificate is only valid for the following names : <hmc host name>
    Error code: SEC_ERROR_UNKNOWN_ISSUER" 
    
• Fixed another problem that resulted in the false report of SRC E2FF1800 when transmitting performance management information from an HMC that was managing a large number of partitions.
  
• Fixed an issue that could cause Live Kernel Update to fail if any partition on any server managed by the HMC has one or more virtual NICs configured.
  
• Fixed a problem with remote restart where partition settings stored in NVRAM were not copied to the destination server. This can result in multiple symptoms such as partition date/time being reset to epoch (1st jan 1970) and/or cloud init being re-run resulting in loss of settings such as the partition IP address.  The current version of AIX supported for Cloud-init are:
  AIX 7.1 TL3 SP5 (7100-03-05)
  AIX 6.1 TL9 SP5 (6100-09-05)
  These two latest service packs of AIX introduce a new device attribute on sys0 device called clouddev. The role of the clouddev attribute is to replace the ghostdev attribute which is used to reset ODM customization when virtual machine is booted on another host or with a different lpar id, for example a remote restart operation or an inactive live partition mobility operation.
  
• Fixed the HMC LDAP configuration to ignore the case of LDAP user names when LDAP is already configured on the HMC.
  
• Fixed a problem where after applying PTF MH01698, HMC users configured for LDAP authentication cannot log into the HMC if the LDAP user DN includes special characters.
  
  
  

Installation instructions for HMC Version 8 upgrades and corrective service can be found at these locations:

Upgrading or restoring HMC Version 8

Installation methods for HMC Version 8 fixes

Instructions and images for upgrading via a remote network install can be found here:

HMC V8 network installation images and installation instructions

Notes:

1. The Install Corrective Service task now allows you to install corrective service updates from the ISO image files of these updates. You can download these ISO image files for the HMC, and then use the ISO image file to install the corrective service update. You no longer need to burn CD-R or DVD-R media to use the ISO image file to install corrective service.
2. This image requires DVD -R media.
3. To install updates over the network, select the *.iso file on the "Select Service Package" panel of the Install Corrective Service task. The HMC application extracts the files needed to install the corrective service. If you are using USB flash media, copy the *.iso file to the flash media, and then select the file when prompted.
4. The updhmc command line command has also been modified to use the *.iso file. To use the command, follow the syntax in this example:
   updhmc -t s -h <myservername> -f </home/updates/corrrective_service.iso> -u <HMC_username> -i

In all cases, the HMC application extracts the files needed to install the corrective service.