Important Updates to Cybersecurity Software

HelpSystems is updating the names of our cybersecurity software, including the Powertech product line. Don’t worry—the functionality of your products won’t change.

See the new names here > New, Clearer Names for HelpSystems Security Software.

--------------------

Please review the following information before upgrading Authority Broker from a previous version. If you are updating Authority Broker 4 from, for example, version 4.05 to 4.10, see Installing or updating Authority Broker 4. 

When installing Authority Broker in an HA environment

1. Stop the replication of user profiles from production to HA system by either ending the replication software or ending the replication of the user profiles.
2. Stop the replication of objects in the product libraries (PLABROKER and PTWRKMGT).  
3. Install Authority Broker on the HA and production systems.
4. Setup Authority Broker replication per the HA Setup instructions. To view these instructions, download Authority Broker 4 HA Setup.
5. Start replication (including the user profiles and objects in the product libraries).

Before starting your upgrade

• The following user profiles were used in prior versions of Authority Broker. They are reused in the new version:
  • PLABOWN
  • PLABADM 
• The following authorization lists were used in prior versions of Authority Broker. They are reused in the new version:
  • POWERABADM
  • POWERABDTA
  • POWERABFL
  • POWERABFO
  • POWERABPGM
  • POWERABRPT

• The library has been renamed in the Authority Broker upgrade. The user configuration is copied to the new library during the upgrade process.

  Previous versions	Authority Broker 4
  PLABROKER	PTABLIB

• The upgrade from Authority Broker 3 will not copy the existing license code to the new version of Authority Broker 4. On the download page you will see a link to request a license code. If you are upgrading from an earlier version of Authority Broker you must request a new license code. Contact Powertech at [email protected] to request a new license code.
• It is Powertech’s goal not to change system values on customer systems because we recognize that security-conscious organizations have rigorous change control processes in place for even small changes to system values. Therefore, we ask you to make any system value changes that are needed. However, the Authority Broker installation process could change a system value to allow the install to proceed if a system value is not set as specified below. If the Installation wizard changes a system value during install, it changes it back to its original value when the install completes.

To install Powertech Authority Broker on your system, the system values that control object restores must be configured as follows.

• Set QALWOBJRST to *ALWPGMADP (at a minimum) to allow the system to restore programs that adopt authority. Many Powertech Authority Broker programs adopt the authority of the product owner, rather than forcing you to give authority directly to administrators and end users.

  Note: The install will work if QALWOBJRST is set to *ALL, but Powertech does not recommend using this value.

• QALWUSRDMN controls which libraries on the system can contain certain types of user domain objects. You should set the system value to *ALL or include the name of the Authority Broker product library (PTABLIB and QTEMP as a minimum) for the product to function properly.
• Set QVFYOBJRST to 1, 2, or 3. This allows Authority Broker to restore all objects regardless of their signature. (Note: If you normally check signatures, remember to check this system value after the Authority Broker install process completes.)
• Set QFRCCVNRST (Force conversion on restore) to 0 or 1, Do not convert anything.
• Set QALWJOBITP (Allow jobs to be interrupted) to 1. This allows job to be interrupted to run user-defined exit programs. All new jobs that become active will default to be uninterruptible.

History in Authority Broker 3

The upgrade process needs to process the history records in version 3 in order to convert them into version 4 formatting. If many history records exist, the upgrade process can be very time consuming. If you have Authority Broker history in version 3 that is older than you need, contact HelpSystems Support for assistance purging your history on the system.

Back up your previous version

As in any upgrade, it’s highly recommended you back up the previous version. Authority Broker 3 was designed as an IBM License Program Product (LPP). The IBM and Powertech recommended method for backing up an LPP type application is to use the SAVLICPGM command to a save file. Should any reason to return to the prior version occur, the save file can be easily restored. 

Create a save file with the name of your choosing to be used and save the prior version using something similar to this sample command: 

SAVLICPGM LICPGM(3PLAB00) DEV(*SAVF) SAVF(QGPL/yoursavefilename)

System Requirements

Authority Broker 4 requires the following:

• IBM i version 7.2 or higher
• 206 MB of disk space
• PTF SI30894

Upgrading to Authority Broker  4

Ensure the following servers are available and running prior to upgrading:

• FTP Server
• Remote Command Server 

Upgrading to Authority Broker 4 is a simple three-step process:

1. End any existing swaps and stop any new ones during the upgrade process.
2. Run the install Wizard
3. Add the Authority Broker 4 license key

To stop any new users from making swaps while the upgrade process is occurring rename the program PABC1100 found in the PLABROKER library. As a suggestion, rename it to PABC1100X. (Caution: Note the SAVLICPGM command will fail if the PABC1100 program has been renamed first.) It’s generally not a good idea to eject any current users currently swapped since they may be working on critical projects. It would be preferred you send an email or call the system users who have been authorized to use the Authority Broker swaps and request they release their current swaps and also not attempt any new swaps. Should it become necessary to end any current Firecall swaps, access the product main menu and take options 5, 4. Use option 4=End a timed switch. It should be noted you cannot force an end of a non-Firecall swap.

To upgrade Authority Broker, run the installation process to install Authority Broker 4 on your system.

Do the following to perform the installation:

1. Download the Authority Broker Upgrade Installer from the Authority Broker download page. If you are upgrading to an older version of Authority Broker, download the appropriate installer (Authority Broker V6R1 Cutoff (v4.15) or Authority Broker V5R4 Cutoff (v4.06)).
2. After the previous steps on checking systems values, and after contacting your users and renaming the PABC1100 program, double-click the .exe file to start the Installation Wizard. When prompted, enter the name of the system (or IP address) on which you want to install Authority Broker, a user ID, and password.

   Note 1: Make sure the user profile used for the installation is a member of the user class *SECOFR and has at least the following special authorities: *ALLOBJ, *SECADM, *JOBCTL, *IOSYSCFG, and *AUDIT. The user profile should have Limit capabilities set to *NO.

3. The Wizard installs Authority Broker 4 on your System i and places a copy of the Administrator’s Guide on your PC. The path of the guide is Start/Programs/Powertech Authority Broker. When the installation completes, click Finish to remove the Wizard from your PC.
4. The installation process displays the job log name, user, and job log number. Use the WRKSPLF command to display the job log for complete information on the Authority Broker install.

Note 2: If you are running a version of Authority Broker below 3.1.1, the program objects will be converted to be V6R1 compatible. This conversion is a one-time process on each object. To provide an uninterrupted work environment, all program conversion occurs during the upgrade, which can extend the process as long as 90 minutes or more on some systems.

Note 3: What to do if the installation fails. The installation process runs a prechecker before the actual product install. The prechecker validates the system to see if it has the proper set up installed before it runs the product installation. The installation, whether it completes or fails, will generate a joblog and a prechecker log for your review. To review the prechecker use the WRKSPLF command for the user profile used during the install and look for an object with a name format PTABnnnnnn (where the nnnnnn is the time stamp of the install). If you see an ‘F’ for failure you may attempt to remedy the problem yourself or choose to contact Technical Support for assistance.

After install completes:

1. Verify that Authority Broker 4 installed successfully, access the product’s main menu using the LWRKAUTBKR command, and take menu options 5, 21. The RELMOD should show R04Mnn.
2. Add the Authority Broker 4 license key. Take menu options 5, 14 and paste your key in the supplied field.
3. Once the upgrade is complete and you verify the product is working to your satisfaction, you may choose to delete the old version library PLABROKER. It’s recommended the PLAUTBKRMN Job Queue entry is removed from the subsystem description in PTWRKMGT. The command to do so is supplied next: RMVJOBQE SBSD(PTWRKMGT/PTWRKMGT) JOBQ(PLABROKER/PLAUTBKRMN)

Note: The Authority Broker Administrator's Guide can be found at Powertech Product Manuals.

Objects Installed on System

1. Product Libraries: PTABLIB and PTWRKMGT
2. Profiles
   • PLABOWN, which has special authorities *ALLOBJ, *SECADM, *JOBCTL, *AUDIT, and *IOSYSCFG
   • PTABADM, which has no special authorities
   • PTWRKMGTOW, which has no special authorities

   (All these profiles are set to Password = *NONE so that they can’t be used to sign on to the system.)

3. Authorization Lists
   • POWERABADM - Powertech Authority Broker Administrators
   • POWERABDTA  - Powertech Authority Broker Data Objects
   • POWERABFL  - Firecall logs and reports menu
   • POWERABFO - Firecall operators commands and menu
   • POWERABPGM - Powertech Authority Broker Programs
   • POWERABRPT - Powertech Authority Broker Reports

4. Commands in QGPL:
   • LEVENTRPT - Run event reports from the command line
   • LFIRECALL - Display the FireCall assignments
   • LFRCLLMNU - Display the FireCall menu
   • LPRVRM -  Authority Broker product/version information
   • LRLSPRF - End a switch
   • LSWPPRF - Switch to a profile
   • LWHOAMI - Display the active profile
   • LWRKAUTBKR - Primary menu configuration and reporting options

5. Powertech-created Exit Points:
   • POWERLOCK_WRKMGT
   • POWERLOCK_AB

The installation program installs Authority Broker 4 and also automatically imports prior version setup configuration information. Once the license key has been added, users may begin immediately using the product information.

Remove Authority Broker 3

Version 3, LPP product 3PLAB00, and library PLABROKER remain on the system after the upgrade so that Authority Broker 3 remains available in case the upgrade to version 4 was unsuccessful. After you have verified a successful upgrade, do the following to remove version 3 of the Authority Broker LPP product:

RMVJOBQE PTWRKMGT/PTWRKMGT PLABROKER/PLAUTBKRMN

DLTLICPGM LICPGM(3PLAB00)