Important Updates to Cybersecurity Software
HelpSystems is updating the names of our cybersecurity software, including the Powertech product line. Don’t worry—the functionality of your products won’t change.
See the new names here > New, Clearer Names for HelpSystems Security Software.
Please review the following information before updating Compliance Monitor 3. If you are upgrading Compliance Monitor from, for example, version 2 to version 3, see Upgrading Compliance Monitor).
Compliance Monitor requires the following:
- IBM i version 7.2 or higher
- Java 1.6 32-bit (required minimum)
- Java 1.7 32-bit or Java 1.8 32-bit for 7.3
- Library QICU – International Components for Unicode for 7.2 and 7.3, option 39
- 256 MB of disk space
- PASE (Portable Applications Solutions Environment), option 33
- A fully-qualified hostname or IP address in the Host Name Table (CFGTCP - option 10)
- IBM V7R2: PTF SI54166
When updating Compliance Monitor in an HA environment:
- Stop the replication of user profiles from production to HA system by either ending the replication software or ending the replication of the user profiles.
- Stop the replication of objects in the product libraries (PTCMT2 and PTCMT3).
- Upgrade Compliance Monitor on the HA and production systems.
- Setup Compliance Monitor replication per the HA Setup instructions. To view these instructions, download Compliance Monitor 3 HA Setup
- Start replication (including the user profiles and objects in the product library).
Before starting your update
- End the Compliance Monitor Consolidator and Endpoints using the following commands:
- Consolidator: ENDPTCMCSL
- Endpoint: ENDPTCMEPT
- Enter the following command to check for locks on the Compliance Monitor library or objects in the library. Resolve any locks before proceeding with the upgrade.
WRKOBJLCK PTCMT2 *LIB
It is Powertech’s goal not to change system values on customer systems because we recognize that security-conscious organizations have rigorous change control processes in place for even small changes to system values. Therefore, we ask you to make any system value changes that are needed.
To update Powertech Compliance Monitor on your system, the following system values that control object restores must be configured as shown.
- Set QALWOBJRST to *ALWPGMADP (at a minimum) to allow the system to restore programs that adopt authority. Many Powertech Compliance Monitor programs adopt the authority of the product owner, rather than forcing you to give authority directly to administrators and end users. (Note: For some system configurations, *ALL is required temporarily.)
- QALWUSRDMN controls which libraries on the system can contain certain types of user domain objects. You should set the system value to *ALL or include the name of the Compliance Monitor product libraries (PTCMT2 [Consolidator], PTCMT3 [Endpoint], and QTEMP as a minimum) for the product to function properly.
- Set QVFYOBJRST to 1, 2, or 3. This allows Compliance Monitor to restore all objects regardless
of their signature.
- Set QFRCCVNRST (Force conversion on restore) to 0, Do not convert anything.
Updating Compliance Monitor
Ensure the system is not in a restricted state and that the following servers are available and running prior to updating:
- FTP Server
- Remote Command Server
If FTP is not available, you must install the product manually. See Manual Installation of Powertech IBM i Products.
To update Compliance Monitor 3, you run the Compliance Monitor installation process. The update process is completely automated. Do the following to update Compliance Monitor:
- Download the Compliance Monitor Installer from the Compliance Monitor download page.
- Make sure no users are currently using the product.
- Double-click the .exe file to start the Installation Wizard. When prompted, enter the name of the system on which you want to upgrade Compliance Monitor, a user profile, and password. Note: Make sure the user profile is a member of the user class *SECOFR and has at least the following special authorities: *ALLOBJ, *SECADM, *JOBCTL, *IOSYSCFG, and *AUDIT. The user profile should have Limit capabilities set to *NO.
- Specify how you want to load Compliance Monitor on your system, from the following:
- Consolidator only
- Endpoint only
- Both (Installs both the Consolidator and Endpoint programs on the same system; this is the default selection. Note: The Consolidator does not have to be an Endpoint.)
When the confirmation window displays, click Start to upload and upgrade Compliance Monitor on your system.
If the Compliance Monitor monitor job, QP0ZSPWT in the PTWRKMGT subsystem, is active when the update starts, the update process ends the job, updates Compliance Monitor, and attempts to restart the job. After the update completes, check to see if the job is active. If it isn’t, enter the following command to start the monitor job:
- When the update completes on the system, you can view the install log or select “Restart and load another system” to update another system. Follow the instructions to update the Endpoint program on your Endpoint systems.
- When you are finished updating all systems, click Finish to remove the Wizard from your PC.
- The Compliance Monitor Installer displays the job log name, user, and job log number. Use the WRKSPLF command to display the job log for complete information on the Compliance Monitor update.
Also check the HLPUPD12P spooled file to make sure all Compliance Monitor objects were updated properly.
Note: The Compliance Monitor Administrator's Guide can be found at Powertech Product Manuals.