================================================================================
Sterling Secure Proxy (SSP) APAR IT08982 - Apr 2015 JRE Upgrade - July 2015
================================================================================

This APAR provides the Java Runtime Environment (JRE) only, with instructions 
on how to install it in the Customer's environment. This brings the JRE to the 
Java 1.7 SR9 fix level from the Oracle Java April 2015 security refresh.

Alternately, the Customer may check the fixlist of the latest iFix cumulative 
maintenance package on Fix Central to see if it includes this level of Java.  
If not, the Customer may contact Support to request that the latest build with
this Java Runtime Environment be placed on the ECuRep server.

===============================================================================
Additional Notes on this Java Runtime Environment (JRE) update
===============================================================================

APAR IT08982 (CM,Engine,PS,SEAS) - Upgrade SSP Engine, CM, and PS to
                               IBM JRE 1.7 SR9 for latest security patches.

  To address security vulnerability CVE-2015-2808 (Bar Mitzvah), RC4 cipher
  suites are disabled by default and Cipher-Block Chaining (CBC) protection
  is enabled for Sterling Secure Proxy 3.4.2.0 and all versions of Sterling
  External Authentication Server.

  With this JRE, Sterling Secure Proxy 3.4.2.0 and all versions of Sterling
  External Authentication Server will only allow TLS sessions by default and
  will reject SSLv3 sessions.  Sterling Secure Proxy releases prior to 3.4.2.0
  continue to allow SSLv3 sessions and RC4 cipher suites if they are coded
  explicitly in the netmap security tab.

  If the SSLv3 protocol is required on SSP3420 or any version of SEAS 
  until trading partners can switch to TLS, then for UNIX/Linux, add the
    -Dcom.ibm.jsse2.disableSSLv3=false
  property to the Java startup line(s) in the bin/startEngine.sh script.
  For Windows, add the property to the "lax.nl.java.option.additional="
  line  in the bin\SSPengine$.lax file.
  

===============================================================================
    IBM Sterling Secure Proxy Instructions for Installing a New JRE
          from IBM Fix Central for the Security Advisory.
===============================================================================

 This process will allow the Customer to pull a new JRE from the IBM Fix Central
 site and replace the existing jre directory in the various installed instances
 of Sterling Secure Proxy (SSP) Engine, SSP Configuration Manager CM, and SSP
 Perimeter Server (PS). The instructions are also valid for the Sterling External
 Authentication Server (SEAS).
 Steps 5 and following must be done for each instance of the SSP Engine, SSP CM,
 SSP PS, and SEAS.

 STEPS 1-3 ARE DONE ONCE AND CAN BE DONE WHILE THE PRODUCT IS RUNNING.

 1. Download the JRE refresh pack archive file from Fix Central to a work
    directory

 2. Extract the JRE refresh pack archive file in the work directory.
      On UNIX:
        cd <work>
        uncompress JRE.tar.Z
        tar -xvf JRE.tar
      Windows: 
        Use WinZip or equivalent to extract from the JRE.zip file.

 3. Verify the version of Java works and is the one expected by the Security
    Advisory:
    
    UNIX:    jre/bin/java -version
    Windows: jre\bin\java -version
    
    See the description at the top of this README file for the version.


 STEPS 4 AND FOLLOWING ARE DONE FOR EACH INSTANCE OF THE SSP ENGINE, SSP CM,
 SSP PERIMETER SERVER and STERLING EXTERNAL AUTHENTICATION SERVER (SEAS).

 4. Make a backup of your target <SSP Installation> directory.

 5. Take the target Sterling Secure Proxy Engine, Configuration Manager, 
    Perimeter Server and/or Sterling External Authentication Server instance
    down

 6. Rename the existing jre directory to jre_old.

 7. Copy the new jre directory from the <work> directory to your
    <SSP Installation> directory

 8. Copy 3 security policy files from the jre_old/lib/security directory
    to the new jre/lib/security directory:

       US_export_policy.jar
       java.security
       local_policy.jar

 9. If SSP3420, copy 2 jar files from the jre_old/lib/ext
    to the new jre/lib/ext directory:

       commons-ssl.jar
       ibmpemkeystore.jar

 10. Start the target SSP/SSPCM/PS/SEAS instance
  
 11. If there are issues starting up the target instance with the new JRE
    a) Save a copy of the bin/startEngine.out file. (startCM.out for the CM)
    b) Rename the jre directory to jre_new, and jre_old to jre, and restart.

 12. Duplicate this process (starting with step 4) for each SSP Engine, CM,
    SSP Perimeter Server, and Sterling External Authentication Server install.