Updating firmware using the HMC hard drive

This is a really interesting way of applying firmware updates:

https://www.ibm.com/developerworks/community/blogs/brian/entry/doing_power_system_firmware_updates_from_the_hmc_hard_drive?lang=en

Heartbleed - Checking your OpenSSL version

The OpenSSL project describes HeartBleed as follows:

"“A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server,”

Unfortunately it is quite normal to have multiple versions of openSSL installed on your system, as well as multiple certificates and keys, therefore you may have to check in several places:

1. To check the version installed as a standard IBM LPP (Licenced program product):

# lslpp -l openssl.base
  Fileset                      Level  State      Description
  ----------------------------------------------------------------------------
Path: /usr/lib/objrepos
  openssl.base             1.0.1.500  COMMITTED  Open Secure Socket Layer

Path: /etc/objrepos
  openssl.base             1.0.1.500  COMMITTED  Open Secure Socket Layer
[root@p520-aix61:/opt/syslog-ng]
 
# /usr/bin/openssl version
OpenSSL 1.0.1e 11 Feb 2013


2. To check the version installed using an RPM:

# rpm -qi openssl
Name        : openssl                      Relocations: (not relocateable)
Version     : 1.0.1g                            Vendor: (none)
Release     : 1                             Build Date: Tue Apr  8 18:49:04 CEST 2014
Install date: Mon Apr 14 11:59:33 CEST 2014      Build Host: aix51.perzl.org
Group       : System Environment/Libraries   Source RPM: openssl-1.0.1g-1.src.rpm
Size        : 56530184                         License: OpenSSL License
URL         : http://www.openssl.org/
Summary     : Secure Sockets Layer and cryptography libraries and tools
Description :
The OpenSSL Project is a collaborative effort to develop a robust,
commercial-grade, fully featured, and Open Source toolkit implementing the
....
..


# /opt/freeware/bin/openssl version
OpenSSL 1.0.1g 7 Apr 2014



3. You should now use the find command to ensure that there are no manually installed versions.

4. Check which is your default version, ie the one that is called when you issue a call without specifying a pathname

# type openssl
openssl is /usr/bin/openssl

5. Finally visit IBM's security pages for the latest information:

http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq

In my example the LPP version 1.0.1.500 of OpenSSL is susceptible to heartbleed and should be replaced with version v1.0.1.502, The RPM version 1.0.1g is not affected. The updated install package can be obtained from:

https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=aixbp&lang=en_US&S_PKG=openssl&cp=UTF-8

Once the update has been installed you need to configure your system as per the instructions in the IBM security bulletin:

http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq?mode=18&ID=3494&myns=pwraix71&mync=E

Once you have completed the update you can use this site to test your system:
https://filippo.io/Heartbleed/


It is worth remembering that your data may already have been stolen and thus you still need to take action such as reseting all your web user accounts etc. and checking your system has not been compromised in other ways.

Useful AIX command (chdef)

I am always on the lookup for commands that can improve the way we work, and reduce time and mistakes. I recently found this blog from a fellow AIX professional that gives a really nide explanation of the chdef (Change Definitions command). If you don't have time to read the full article,  The chdef command modifies the default value of a predefined attribute of a specified device type. The idea is (for instance) that if you create a lot of fibre LUNS and always need to set the hcheck interval to 60, you can make this the default for every new device instead of having to remember to change it later.

https://www.ibm.com/developerworks/community/blogs/brian/entry/change_aix_device_default_attributes_with_chdef_command?lang=en

Processor Value Unit (PVU)

In 2006 IBM introduced the concept of a PVU, the idea being that all processors are not created equal and thus a Power-8 core is capable of doing much more work than an Intel Itanium. The PVU value of your system is then used to calculate the number of software licences you require.

This table provides a list of the power-ratings of each processor-type and enables you to calculate the PVU rating of your system:

http://www-01.ibm.com/software/passportadvantage/pvu_licensing_for_customers.html

Whilst this is a very handy reference I would still recommend that you contact IBM directly in order to negotiate a discount. Remember that you can also use virtualisation and workload management technologies to control the allocation of your resources in order to save money.

Power-8 Performance optimisation

I know that the Power-8 range has just been announced, however there is already a performance RedBook that has some interesting insights into the latest improvements:

http://www.redbooks.ibm.com/redpieces/abstracts/sg248171.html?Open

IBM Launches cloud marketplace

IBM is now a major player in the cloud market and you can expect to see a lot more announcements in this area:

http://www.computerweekly.com/blogs/cwdn/2014/04/ibm-cloud-marketplace-not-late-just-deeper.html

Interest article regarding IBM's possible future direction

This is an interesting article and I think that the survey results are accurate, and some of the feedback is also very imformative:

http://searchdatacenter.techtarget.com/opinion/What-will-power-IBM-Power-servers