Readme file for:

IBM Content Collector

Product or component release:

Version 4.0

Update name:

Fix Pack 3

Fix ID:

4.0.0.3-IBM-ICC-FP003

Publication date:

18 December 2014

Last modified date:

18 December 2014

Online version of readme file:

Readme files for IBM Content Collector Version 4.0 Fix Pack 3

Important: The most current version of the readme file can always be found online.

Download location

Known problems, restrictions, and solutions

To review all known problems, restrictions, and solutions that affect Version 4.0.0 fix packs, use the following link to query the product support knowledge base: View all techdocs for IBM Content Collector 4.0.

Prerequisites for Version 4.0.0 Fix Pack 3

The server package of IBM Content Collector V4.0 Fix Pack 3 requires the IBM Content Collector V4.0.0.0, V4.0.0.1, or V4.0.0.2 server package as a prerequisite.

For complete details about the hardware and software requirements for IBM Content Collector, see http://www.ibm.com/support/docview.wss?uid=swg27039384 .

Installing IBM Content Collector V4.0 Fix Pack 3

Prior to installation

Before you install the fix pack in a production environment, make sure that you have a complete backup or snapshot of your system so that you can roll back the fix pack installation if a problem should arise.

If you have modified any configuration files, make a backup copy of the modified files before installing the fix pack.

Installing

To update IBM Content Collector V4.0.0.0, V4.0.0.1, or V4.0.0.2 with IBM Content Collector V4.0 Fix Pack 3, complete the following steps:

• For IBM Content Collector Server:
  1. Back up your configuration store.
  2. Make sure that all IBM Content Collector services are stopped.
  3. Install IBM Content Collector Server V4.0.0.3.

     Do not change the host name of the IBM Content Collector Web Application during installation. Changing the host name will make all previously created stub links unusable.

     Do NOT run the Initial Configuration Wizard.

  4. If the licensing tool is not started automatically, select All Programs > IBM Content Collector > Set-up Tools > Licensing from the Windows start menu. Check the settings and make sure that the correct license is selected.
  5. If Lotus® Domino® is one of your source systems and your Domino template contains IBM Content Collector functionality, re-enable the existing template. From the Windows start menu, select All Programs > IBM Content Collector > Set-up Tools > Domino Template Enablement.
  6. Optional: If you use self-signed certificates, run the tool afu_ewas_exchange_cert.bat from the AFUWeb folder to replace the existing self-signed certificates with new self-signed certificates that use a key size of 2048 bit.
  7. Adjust the Windows Service users for the IBM Content Collector services as described in the documentation.
  8. Optional: If you deploy any of the IBM Content Collector web applications to an external web application server, make sure that the afu.bootstrap.properties file exists in the AFUWeb subdirectory of your web application server profile directory. Copy the SolidDriver2.0.jar file from the ICCinstallDir\ctms directory to the directory profile\installedApps\cell\afu_metadata_web.ear\afu_metadata_server.war\WEB-INF\lib of the respective web application server instance.
  9. Restart the Configuration Manager to reconfigure the database connection of the IBM Content Collector Web Application and upgrade the configuration.
  10. If you run IBM Content Collector in a cluster and used the Cluster Tool afuClusterTool.exe to configure the cluster, you must reconfigure the cluster after upgrading. To do so, run afuClusterTool.exe with the appropriate options to make sure that the cluster is configured to fit your environment, for example that the first and secondary configuration hosts are set correctly.
  11. Restart the Task Routing Engine and the IBM Content Collector Web Application service.
• For IBM Content Collector Microsoft SharePoint Support, apply IBM Content Collector for Microsoft SharePoint V4.0 Fix Pack 3 on one Microsoft SharePoint Web Front End server. For upgrade installations, this must be the Microsoft SharePoint Web Front End server on which IBM Content Collector for Microsoft SharePoint V4.0.0.0, V4.0.0.1, or V4.0.0.2 is currently installed.
• For Content Search Services Support, apply IBM Content Collector P8 Content Search Services Support V4.0 Fix Pack 3.
• For all other components, install the respective IBM Content Collector V4.0 Fix Pack 3 package.

Fixes and changes made in version 4.0.0.3

Changes in IBM Content Collector to address the POODLE attack

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack (CVE-2014-3566), which is a man-in-the-middle attack affecting IBM Content Collector. IBM Content Collector communications that use the SSLv3 protocol were exposed to the POODLE attack. For more details, see the following security bulletin: Security Bulletin: Vulnerability in SSLv3 affects IBM CommonStore and IBM Content Collector (CVE-2014-3566) (www.ibm.com/support/docview.wss?uid=swg21692480).

To remove this security vulnerability, using the SSLv3 protocol and downgrading from TLS are now disabled in IBM Content Collector. For IBM Content Collector communications, the TLS 1.0 protocol or a higher level protocol is used.

To disable the usage of the SSL protocol for all incoming requests, change the settings of the embedded WebSphere Application Server of IBM Content Collector as described. In the administrative console of the embedded WebSphere Application Server, navigate to Security > SSL certificate and key management > SSL configurations > NodeDefaultSSLSettings > Quality of protection (QoP) settings and select one of these protocols:

• TLS (enables TLS v1.0, defined in RFC2246).
• Not recommended: SSL_TLSv2 (enables all SSLv3 and TLSv1, TLSv1.1, TLSv1.2 protocols). In this case, access via SSL protocol is possible, but the highest TLS version possible (determined by the .Net or Java version) is used for internal IBM Content Collector communications.

Changes in IBM Content Collector to address security vulnerabilities in IBM Java Runtime Environment

The fix addresses the issues that are described in CVE-2014-4244 and CVE-2014-4263. For more details, see the following security bulletin: Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM CommonStore and IBM Content Collector (CVE-2014-4244, CVE-2014-4263) (www.ibm.com/support/docview.wss?uid=swg21692481).

Documentation

Online documentation and updates to the documentation

The IBM Content Collector product documentation is available on the web at http://www.ibm.com/support/knowledgecenter/SSAE9L_4.0.0/contentcollector_4.0.0.htm.

For product information that is missing or is incorrect in the IBM Content Collector documentation, see the technote about updates to the IBM Content Collector V4.0 documentation.

PDF documentation

The PDF documentation is at the level of IBM Content Collector V4.0.0.0.

See the IBM Content Collector publication library for links to PDF documentation in English and further languages: http://www.ibm.com/support/docview.wss?uid=swg27037952

Copyright and trademark information

Notices

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Other company, product, or service names may be trademarks or service marks of others.

THIRD-PARTY LICENSE TERMS AND CONDITIONS, NOTICES AND INFORMATION

The license agreement for this product refers you to this file for details concerning terms and conditions applicable to third party software code included in this product, and for certain notices and other information IBM must provide to you under its license to certain software code. The relevant terms and conditions, notices and other information are provided or referenced below. Please note that any non-English version of the licenses below is unofficial and is provided to you for your convenience only. The English version of the licenses below, provided as part of the English version of this file, is the official version.

Readme file for:

IBM Content Collector

Product or component release:

Version 4.0

Update name:

Fix Pack 3

Fix ID:

4.0.0.3-IBM-ICC-P8CSS-FP003

Publication date:

18 December 2014

Last modified date:

18 December 2014

Online version of readme file:

Readme files for IBM Content Collector Version 4.0 Fix Pack 3

Important: The most current version of the readme file can always be found online.

Download location

Known problems, restrictions, and solutions

To review all known problems, restrictions, and solutions that affect Version 4.0.0 fix packs, use the following link to query the product support knowledge base: View all techdocs for IBM Content Collector 4.0.

Prerequisites for Version 4.0.0 Fix Pack 3

The fix pack package does not require a specific version of IBM Content Collector P8 Content Search Services Support as a prerequisite for the installation.

For information about hardware and software compatibility, see the appropriate tab in the detailed system requirements document at http://www.ibm.com/support/docview.wss?uid=swg27039384.

Installing IBM Content Collector P8 Content Search Services Support Fix Pack 3

Apply this fix pack package to install IBM Content Collector P8 Content Search Services Support in FileNet® P8, Version 4.0 Fix Pack 3.

Installing

To install this fix pack, complete the following steps:

1. Extract the installation package to a temporary directory.
2. Stop all IBM Content Search Services instances.
3. Start the installer.

   On Windows, run install.exe, which is in the directory \\P8_CSS_Support\WIN.

   On AIX, Linux, Linux on System z, and Solaris, run install.bin, which is in the directory /P8_CSS_Support/operating_system where operating_system stands for the name of the operating system, for example, Linux.

   Answer the prompts as the installer guides you through the installation process.

   Note: If you are using an IBM Content Collector version before V3.0, you must use dummy values when specifying the web application service. Ignore the information message stating that the web application server cannot be validated. For details on using the constructors.xml file and not the Content Collector configuration database, refer to the section below about installing Content Search Services Support using your existing configuration files.
4. Run the deploy script for all instances on the server.
   Each time you run the deploy script, you must pass the full file name path to the instance. If you do not pass the path to an instance, the script uses the instance installation path that was specified when Content Search Services Support was installed. For example, on Windows, run:

   deploy.bat "C:\Program Files\IBM\ Content Search Services\ CSS Server New Instance\plugins"

   On AIX, Solaris, Linux, and Linux on System z, run:

   deploy.sh "/opt/IBM/ContentSearchServices/ CSS_Server_New_Instance/plugins"

5. If you are using more than one IBM Content Search Services instance on the server, make sure that all instances use the same configuration that is defined in the constructors.xml file in the ContentSearchServicesInstallDir\ config\ directory. Note that the deploy script only deploys the Content Search Services Support program files and not the configuration. You must make sure that the same configuration is used by each instance. For details on the Content Search Services Support configuration, see the section below about installing Content Search Services Support using your existing configuration files.
6. Start all IBM Content Search Services instances.

Installing Content Search Services Support using your existing configuration files

Starting with IBM Content Collector V3.0, the Content Search Services Support configuration options that are required for indexing items using IBM Content Search Services are stored in the IBM Content Collector configuration database and can be defined and changed using the IBM Content Collector Configuration Manager. The constructors.xml file no longer contains the configuration options. Instead, it contains the link to the configuration database where the configuration is stored. Before Content Collector V3.0, all Content Search Services Support configuration options were stored directly in the constructors.xml file.

The Content Search Services Support V4.0.0.3 configuration depends on the IBM Content Collector version that you have installed:

• For an IBM Content Collector version before V3.0, you must continue using the constructors.xml file. The Content Search Services Support configuration is not stored in the IBM Content Collector configuration database.
• For IBM Content Collector V3.0 and V4.0, the default and preferred method is to store the Content Search Services Support configuration in the Content Collector configuration database. If you do not want to store the Content Search Services Support configuration in the IBM Content Collector Configuration Manager, you can continue storing the Content Search Services Support configuration options in the constructors.xml file.

To upgrade to Content Search Services Support V4.0.0.3 and store the Content Search Services Support configuration options in the constructors.xml and not in the IBM Content Collector configuration database, carry out the following steps:

• Run the Content Search Services Support installation but use dummy values when specifying the web application service. Ignore the information message stating that the web application server cannot be validated.

  Remember that if more than one instance of the IBM Content Search Services is installed on the IBM FileNet Content Search Engine server, Content Search Services Support must be installed on each instance.

• When Content Search Services Support is installed, a backup is made of your existing configuration in the constructors.xml file in the directory ContentSearchServicesInstallDir\config\. The backup file is called constructors.xml.ICC.backup and is also located in the directory ContentSearchServicesInstallDir\config\.

  After the installation, replace the constructors.xml file in the ContentSearchServicesInstallDir\config directory (the constructors.xml file will have been modified by the installation to include the link to the 'dummy' configuration server) by the backup file constructors.xml.ICC.backup. Delete constructors.xml and rename the backup file constructors.xml.ICC.backup to constructors.xml.

  Remember that you must replace the configuration files on all IBM Content Search Services instances.

• If you used the configuration option *DumpDocuments for debugging purposes in your configuration files, change this option to DumpDocumentIds because the configuration option name *DumpDocuments was changed to DumpDocumentIds in V3.0.

Fixes and changes made in version 4.0.0.3

For a list of all APARs that are included in IBM Content Collector P8 Content Search Services Support V4.0.0.3, refer to the IBM Content Collector V4.0 Fix Pack 3 download page at http://www.ibm.com/support/docview.wss?uid=swg24039003.

Changes in IBM Content Collector to address the POODLE attack

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack (CVE-2014-3566), which is a man-in-the-middle attack affecting IBM Content Collector. IBM Content Collector communications that use the SSLv3 protocol were exposed to the POODLE attack. For more details, see the following security bulletin: Security Bulletin: Vulnerability in SSLv3 affects IBM CommonStore and IBM Content Collector (CVE-2014-3566) (www.ibm.com/support/docview.wss?uid=swg21692480).

To remove this security vulnerability, using the SSLv3 protocol and downgrading from TLS are now disabled in IBM Content Collector. For IBM Content Collector communications, the TLS 1.0 protocol or a higher level protocol is used.

Documentation

The following documentation is available:

Online documentation and updates to the documentation

The IBM Content Collector product documentation including the documentation for IBM Content Collector P8 Content Search Services Support is available on the web at http://www.ibm.com/support/knowledgecenter/SSAE9L_4.0.0/contentcollector_4.0.0.htm.

For product information that is missing or is incorrect in the IBM Content Collector documentation, see the technote about updates to the IBM Content Collector V4.0 documentation.

PDF documentation

The PDF documentation is at the level of IBM Content Collector V4.0.0.0.

See the IBM Content Collector publication library for links to PDF documentation in English and further languages: http://www.ibm.com/support/docview.wss?uid=swg27037952

Copyright and trademark information

IBM, the IBM logo, and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at http://www.ibm.com/legal/copytrade.shtml

Notices

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Other company, product, or service names may be trademarks or service marks of others.

THIRD-PARTY LICENSE TERMS AND CONDITIONS, NOTICES AND INFORMATION

The license agreement for this product refers you to this file for details concerning terms and conditions applicable to third party software code included in this product, and for certain notices and other information IBM must provide to you under its license to certain software code. The relevant terms and conditions, notices and other information are provided or referenced below. Please note that any non-English version of the licenses below is unofficial and is provided to you for your convenience only. The English version of the licenses below, provided as part of the English version of this file, is the official version.