Sametime 9.0 Upgrade (poodle patch) of System Console fails

IBM announced new updates of Sametime because of SSLv3 vulnerability (PODDLE) for all Sametime comoponents on february this year

Security Bulletin: Vulnerability in SSLv3 affects Sametime (CVE-2014-3566)

After two month of upgrading today i got this strange error if i try to upgrade the Sametime System Console.

„A problem occurred during the execution of the ….WebSphere\STSCCell\build_meeting.xml file“

Analyzing the xml file (build_meeting.xml) there was a problem starting the application server STConsoleServer within the upgrade phase.
So i checked if there are problems with the registered os services to start – but this was not the problem (upgrade also failed). Looking inside the application server configuration i found out that the application server was  set to have dependencies with its nodeagent (monitoring policy = RUNNING).

So therefore the upgrade fails because of waiting for the nodeagent to start. You need – only for the upgrade process – to set the setting from RUNNING to STOPPED.

There is an IBM technote with a little more information about this setting.

Using the Monitoring Policy to automate the server startup may interfere with Application updates

 

Sametime Proxy – expired APNS certificate drops down STProxy application

IBM announced that the Apple Push Notification Service (APNS) certificate within the Sametime 8.5.x/9.0.x Proxy installation will get expired on june, 19th 2014

Updated security certificate for Push Notifications (iOS)

So please make a update NOW !!!

If you do not update the certificate (or forgot) your Sametime Proxy webchat client will not work anymore. You should get error messages inside the
proxy log (systemout.log) like this.

APNSService   W   com.ibm.collaboration.realtime.stproxy.services.APNS.APNSService.isPushAvaialble() – Connection to APNS Failed. Returning false. Exception thrown
                                 java.net.SocketException: Connection reset
    at java.net.SocketInputStream.read(SocketInputStream.java:179)
    at com.ibm.jsse2.b.a(b.java:146)
    at com.ibm.jsse2.b.b(b.java:174)
    at com.ibm.jsse2.b.a(b.java:38)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:209)
    at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:643)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:106)
    at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:304)
    at com.ibm.collaboration.realtime.stproxy.services.APNS.APNSService.getSSLConnection(APNSService.java:429)
    at com.ibm.collaboration.realtime.stproxy.services.APNS.APNSService.testConnection(APNSService.java:507)
    at com.ibm.collaboration.realtime.stproxy.services.push.PushService$1$1.run(PushService.java:84)

Another problem coudl be that you can´t change the Samtime Proxy configuration inside the Sametime System console, after saving you get an error

AIDSC1608E: Unable to reach the Sametime Proxy host name
Sametime Proxy error

This could be solved by updating the APNS key OR i had the same problem at a customer because the APNS Servernames

feedback.push.apple.com
gateway.push.apple.com

could not be resoved by DNS (so i added tha APNS addresses to the local hostfile).

Sametime 9 Hotfix(es)

IBM brought some Hotfixes for IBM Sametime 9 which are resolving some problems found in 9.0 Gold (Sept. 2013).

Sametime 9.0 – generelly Hotfix 1 (04-01-2014)

Sametime 9.0 – Hotfixes for Proxy (18-12-2013)

9000-ST-Proxy-FP-JCHG-9EGGAT

Sametime 9.0 – Hotfix for Media Server (30-01-2014)

9000-ST-Media-FP-RVVV-9FELQY

Sametime 9.0 – Hotfix for Client (31-01-2014)

9001-ST-Client-FP-LQIU-9FK83A

If you plan to install Sametime 9 as new – you do not have to install 9.0 Gold first, you just need to download ST 9 Hotfix 1 from IBM Fixcentral
and just add/insert the file repository.config to the IBM Installation Manager repository.

e.g. …/SametimeProxyServer/disk1/STProxy/respository.config

Sametime 8.5.2.x DB2 Migration to Sametime 9

IBM published the document for migrate your DB2 data (like SSC policies or Meeting DB) to the new Sametime 9 enviroment.

Sametime 8.5.2.x Migration to Sametime 9

Migrating from Sametime 8.5.2x (Wiki Doku)

You can either stay on DB2 Version 9.5 (Sametime 8.5.0/8.5.1) or 9.7 (Sametime 8.5.2) or you can upgrade DB2 to Version 10.1 (see the IBM statement)

„Please note that none of the deprecated or discontinued features in 10.1 have a direct impact on Sametime deployments.“

Here is a „shorcut“ for the steps

Because IBM references directly to the DB2 documentation i will give you a indeep migration step.

Keep Sametime Community Server before upgrading

  • unregister ST Community Server(s)/MUX from ST System Console
    • check entries in  …/domino/console/productconfig.properties & console.properties
    • …/domino/console/unregisterproduct.bat > should remove ST Community Server from SSC
    • Deregistration will you disconnet from SSC policies and policies in stpolicy.nsf will take place !!!

Uninstall Sametime 8.5.2.x enviroment

  1. Start Installation Manager and deinstall all components within
  2. Deinstall Installation Manager 1.4.2
  3. Delete or Move kept Installation folder \Websphere\*

in-place DB2 Server Upgrade to Version 10.1 (or you can stay on Version 9.5 or 9.7)

  1. Check if databases are DB2 V10.1 compatible
    • Extract DB2 V10.1 Installation package
    • C:\install\db2v10setup\WSER\image\db2\Windows\utilities\db2ckupgrade.exe STMS -L c:\db2.log -u db2admin -p passwort
      Message should be like this >> DBT5508I  The db2ckupgrade utility completed successfully. The database or databases can be upgraded.
  2. Check/Show DB2 instances C:\IBM\SQLLIB\BIN>db2ilist
  3. Install/Update DB2 to Version 10.1
  4. Install DB2 NetExtender Addon

Upgrade DB2 database(s) to Version 10.1

  1. Drop/Disconnet all connections to DB2
    • C:\IBM\SQLLIB\BIN>db2stop force    >>> Disconnects all users and stops the instance
      SQL1064N  DB2STOP processing was successful.
      C:\IBM\SQLLIB\BIN>db2 terminate   >>> Terminates back-end process
      DB20000I  The TERMINATE command completed successfully.
  2. Check if upgrade of DB2 is needed
    • C:\IBM\SQLLIB\BIN>db2level
      DB21085I  Instance „DB2“ uses „64“ bits and DB2 code release „SQL10010“ with
      level identifier „0201010E“.
      Informational tokens are „DB2 v10.1.0.872“, „s120403“, „NTX64101“, and Fix Pack  „0“.
      Product is installed at „C:\IBM\SQLLIB“ with DB2 Copy Name „DB2COPY1“.
    • Otherwise use C:\IBM\SQLLIB\BIN>db2iupgrade DB2 /u:db2admin.password
  3. Upgrade Sametime DB2 database – otherwise you get the error message „The database must be upgraded to the current release.
    • C:\IBM\SQLLIB\BIN>db2 upgrade database STMS
    • C:\IBM\SQLLIB\BIN>db2 upgrade database STADV

System Console (you will loose all your configuration, so you have to document it first and then reasign it to the new SSC)

==> NOVI recommendation: Write down all Policy Settings and recreate the settings in the new STSC DB in Sametime 9 SSC

  • >>> Miss Step 1 & 4
  1. Export Policy Tables POLICY.TEMPLATE & POLICY.ASSIGNMENT from ST 8.5 SSC
  2. Backup/Delete old STSC database
    • Backup/Rename STSC database if needed
      • create db2rename.cfg file manually
           DB_NAME=STSC,STSC85
           DB_PATH=c:\
           INSTANCE=DB2
           NODENUM=0
      • C:\IBM\SQLLIB\BIN>db2stop
      • C:\IBM\SQLLIB\BIN>db2relocatedb.exe -f c:\install\db2rename.cfg
        Files and control structures were changed successfully.Database was catalogued successfully.DBT1000I  The tool completed successfully.
    • Delete STSC database
      • C:\IBM\SQLLIB\BIN>db2 drop database STSC
  3. Create a NEW SSC Database (e.g. STSYCON)
  4. Import Policy Tables into ST 9 SSC
    >> Just check before if you need this step or if it is faster to recreate the policies again
  5. Install new Sametime 9 System Console Server (with the new STSYSCON DB)
    • Install Installation Manager 1.6.2 (IM)
    • Import Websphere 8.5.5 & WAS iFixes for Sametime into IM
    • Install Websphere without config
    • Install ST System Console Server

Meeting Server

==> If you change the DB2 to other operating system you have to move the db2 completly – see this link about it

  1. Update schema for Meeting DB to get new tables for the Sametime 9 features
    >> C:\install\st9meetingsetup\….DatabaseScripts\….\applyDDLUpdate.bat migration_meetingServer_85x-90.dll STMS db2admin
  2. Add the Meeting DB to the Sametime Configuration Application (deployment plan)
  3. Create a new Meeting Server deployment plan and add the existing Meeting DB
  4. Install new Sametime 9 Meeting Server
    • Install Installation Manager 1.6.2 (IM)
    • Import Websphere 8.5.5 & WAS iFixes for Sametime into IM
    • Install Websphere without config
    • Install ST Meeting Server

Proxy Server

  1. Shut down the Sametime 8.5.x Proxy Server to get exclusiv access to the Proxy DB
  2. Drop the Proxy DB and create a new Proxy DB with the Sametime 9 database script
    !!! Please use the database create scripts from the actual Sametime proxy package – otherwise you will loose tables you need !!!
    I had to learn this the hard way because i used the db scripts from 9.0 gold release with the 9.0 Fix1 :-((
  3. Add the Proxy DB to the Sametime Configuration Application (deployment plan)
    THATS a NEW one (in ST 8.5 you had to start db2 scripts yourself)
  4. Create a new Proxy Server deployment plan and add the existing Proxy DB
  5. Install new Sametime 9 Advanced Server
    • Install Installation Manager 1.6.2 (IM)
    • Import Websphere 8.5.5 & WAS iFixes for Sametime into IM
    • Install Websphere without config
    • Install ST Proxy Server

Advanced Server

  1. Shut down the Sametime 8.5.x Advanced Server to get exclusiv access to the Advanced DB
    NO SCHEMA UPDATE NEEDED
  2. Add the Advanced DB to the Sametime Configuration Application (deployment plan) and add 3 NEW tables manually
    • INSERT INTO ORGCOL.PC_SETTING (SETTING_NAME,SETTING_TYPE,SETTING_VALUE) VALUES (‚admin.only.delete‘, 3, ‚false‘);
    • INSERT INTO ORGCOL.PC_SETTING (SETTING_NAME,SETTING_TYPE,SETTING_VALUE) VALUES (‚remove.invalid.members‘, 3, ‚true‘
    • INSERT INTO ORGCOL.PC_SETTING (SETTING_NAME,SETTING_TYPE,SETTING_VALUE) VALUES (‚wildcard.search.enabled‘, 3, ‚false‘);
  3. Create a new Advanced Server deployment plan and add the existing Advanced DB
  4. Install new Sametime 9 Advanced Server
    • Install Installation Manager 1.6.2 (IM)
    • Import Websphere 8.5.5 & WAS iFixes for Sametime into IM
    • Install Websphere without config
    • Install ST Advanced Server

    !!! If you restricted the ST Advanced Users because of license limitation in version 8.5  you have to change manually
           the table: ORGCOL.LICENSE
           the parameter: LIC_COUNT
           set from the number counted to ZERO (0)

The documentation also shows how you could change the data sources (e.g. for testing) for DB2 databases.
I think that is a bad idea because the DB name is also referenced inside the SSC application DB (see deployment name) and this could be a problem for further updates !!!

Sametime 9 ready for download

IBM announced the new version for Sametime today for download

Prepare your machines and get the software download (and extra harddisk space …)

BUT – you can´t update form earlier ST-Websphere Version (8.5.x) to 9.0 because of change of the IBM Websphere platform from 7.0.0.15+ to version 8.5.5.
Reason: WAS 7.X = 32Bit vs. WAS 8.5.5 = 64Bit

Only Sametime Community „Domino“ Server (for chat and awareness function) could be updated directly, BUT keep in mind –> NO „classic“ meeting in ST9Community Server.

Upgrade path should be available soon on IBM Wiki Administering Sametime 9.0 documentation – but here is a short snapshot.

Moving to Sametime 9 from an earlier release of Sametime involves leaving your Sametime 8.5.2 IFR1 environment as it is, creating a separate Sametime 9 environment with a fresh installation, reusing the DB2 database so all data is preserved, then migrating your WebSphere Application Server custom configuration settings from WebSphere Application Server 7 to WebSphere Application Server 8. In-place upgrades of data from earlier versions of Websphere Application Server are not supported. There is no automated tool for end-to-end migration and the manual steps are complicated, leading to error. To ensure a smooth transition to Sametime 9, best practice dictates that a new Sametime 9 environment be built from scratch and data be migrated using WebSphere Application Server 8.5 data migration tools.

Overview of migration steps:

  1. Leave the Sametime 8.5.2 IFR1 environment in-place while bringing up Sametime 9 in parallel.
  2. You can continue using Sametime 8.5.2 IFR1 while installing Sametime 9.
  3. Re-use the same DB2 data stores for all the product servers so data is preserved.
  4. Plan your deployment, install, and configure security. Certificates can be migrated but require manual changes if the host name changes.
  5. Configure Single Sign-On.
  6. Re-install portlets.
  7. Once Sametime 9 is functional, configure manually the same Websphere Application Server custom settings and tunings that you created on Sametime 8.5.2 IFR1.
  8. Modify load balancers, TURN servers, and re-configure proxies (SIP, HTTP)
  9. Transition any other Sametime custom configuration you have made in the 8.5.2 IFR1environment to Sametime 9.
  10. Shutdown Sametime 8.5.2 IFR1.

Internesting statement is point 3 „re-use … DB2 data store“ – i never could reuse STSC database with new installations because there where mapping problems within (table & schema) so the SSC Server gets error on it; my way was to CREATE a new & empty STSC databse an RE-CONFIGURE Sametime again – Meeting and Advanced Database could be migrated without problems.
Maybe there will be a sql script to get this ex/imported into the new ST9 SSC … to be continued ….

The biggest change will come with the licensing (Sametime Advanced is now part of the Community license – aka Sametime Standard) and the Media Server (mulitple Videos, mobile Support), but i am happy that IBM finally implemented the REMOTE CONTROL function inside the Websphere Meetings (juhuuu … some things take a little bit longer)

Sametime Next

I am happy that i am part of the Sametime Next beta community, so that i could test (since july 2013) the new version.

The first thing i am realy happy is that IBM updates with Sametime Next their Websphere Version to 8.5.x (beta release) and therefore you could use JVM with 64bit. I think this makes the product more scalable.

Also there will be a change in the Sametime product offering (communicate+conference = complete) – i am not quite sure if this is additional (entry, standard or advance license) or a replacement.

But prepare Your enviroment for more machines 🙂 a/v will use it ….

Just check this pic out (from Connect 2013)

More (in detail) information will be posted when Sametime Next will be officially released.