AIX

Hi

I have a question with regards to AIX 5.3 & TCB. I have a client that is requesting TCB to be installed in AIX. However it seems that the perception of TCB is that it causes major headaches when it comes to configuring the system in real world environments, such as large scale Oracle database's with multiple legacy clients using various interfaces. I have surfed to the end of the web and back, as well as exhausting all other avenues to find info about TCB. I understand how it works and to install, etc. However I can not find any views or reviews on expected performance overhead, or even comments on whether it is a good tool or not worth all the effort.
Does anybody have personal experience working with TCB in AIX or know of a secret cave out there on the web with info that I have missed?

System to be configured:
migrating P5-570 AIX 5.3 Oracle 9I to P6-595 (I am aware that I will have to re-install or do a preservation install to enable TCB)
AIX NIM client
All LPAR's AIX 5.3 (app limitation, no AIX 6.1)
No VIO
Boot from internal SCSI(customer request, YES I know that is already an issue with TCB being part of rootvg and will effect I/O performance)
All other VG's SAN

I am looking specifically for info with regards to CPU & MEM overhead. I know I have not provided much info into this forum, but I would appreciate any feedback.


regards

I have little experience with TCB, but found it cumbersome to work with in daily operations. You might be better off using AIXpert.

HI

Thanx for the feedback, really appreciate it. I have done some checking on your recommended AIXpert. It looks good and is part of AIX from what I can see. It's also continued in AIX 6.1, so that's great, although AIX 6.1 now has a revised upgraded version of TCB. Now I just need to convince the client AIXpert a better way to go and find out how to use/config it.

As for TCB on AIX 5.3, the best info I could find was actually in the AIX 4.3 Elements of Security red book
http://www.redbooks.ibm.com/redbooks/pdfs/sg245962.pdf
And with speaking to IBM it seems like there is not much support/knowledge of/for TCB. This is understanable as not many systems like to be limited to a feature that would reaquire a re-install to disable. However if security is your top concern then there will be sacrifies.

AIX TCB details
regards

You might want to read this personal account of mine about TCB and the troubles arising when doing an alternate disk migration.

One aspect of having TCB is: alternate disk installation is impossible.

I hope this helps.

bakunin

Well, that's not entirely true.

Starting with AIX v5.3 TL6, with APAR IY87344 installed, you can perform migrations of TCB enabled systems if the caching option to nimadm is used. For those that aren't aware, nimadm stands for Network Installation Manager Alternate Disk Migration.

The following redbook has some information on using this tool:

IBM Redbooks | NIM from A to Z in AIX 5L

Cheers.

I am a bit confused with regards to this NIM alternate disk install. In the AIX 5L NIM redbook it says:
"Some limitations apply when using the nimadm utility:
1. If the client's rootvg has TCB turned on, you will need to either disable it (permanently) or perform a conventional migration (for example, using CD or NIM. Refer to 4.4, “Using NIM to perform AIX migrations of the NIM master and clients” on page 153). This limitation exists because TCB needs to access file metadata which is not visible over NFS"
They then go through an example that shows TCB being switch off with odmget, migrated and then enabled again. They specifically state showing an example that "If you try to enable TCB again after the migration you may run into some trouble with files being deactivated which may cause havoc to your running system."
So I think yes you can do an alternate disk install, BUT your alternate install will not have TCB active?

would you agree ?

Yes. This is what i meant above: when you go through all the trouble to have TCB enabled during installation you presumably want to retain that feature after the update. But you can only do either a NIM alt-disk-install update and disable TCB permanently or do a conventional update with CDs and retain TCB - these options are, to my knowledge - gibbos information are news to me - mutually exclusive.

I hope this helps.

bakunin