PowerVC 2.2.0 の Security iFix IT45538 の適用

#### はじめに


PowerVC 2.2.0 の導入のマニュアルで推奨がある Security iFix IT45538 を適用したログです。


マニュアル：[Installing from download](https://www.ibm.com/docs/en/powervc-cloud/2.2.0?topic=uninstalling-installing-from-download)


> To get the latest security fixes for PowerVC 2.2.0, it is highly recommended to install the OpsMgr iFix [IT45538](https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/PowerVC&release=2.2.0&platform=Linux+64-bit,pSeries&function=fixId&fixids=2.2.0-PowerVC-RHEL-SLES-NOARCH-APAR-IT45538&includeRequisites=1&includeSupersedes=0&downloadMethod=http).



<br>

手順は、APAR の README を元に実行しています。

[IT45538-2.2.0-OPSMGR-README.txt](https://ak-delivery04-mul.dhe.ibm.com/sar/CMA/OSA/0c63b/4/IT45538-2.2.0-OPSMGR-README.txt)

----

#### 環境

PowerVC 2.2.0 on RHEL 8.6 ppc64le


----

#### 準備

:::note warn
前提
途中で createrepo コマンド導入操作があるため、対象サーバーに createrepo コマンドが存在しない場合は、RHEL 8.6 App Stream の dnf リポジトリー設定が必要です
:::

<br>

APAR をPowerVC サーバーに配置します。


・iFix モジュールの展開

```
# ls -ltr
total 224556
-rw-r--r-- 1 root root 229942083 Jun  3 00:49 IT45538-2.2.0-OPSMGR.tgz
# tar -zxf IT45538-2.2.0-OPSMGR.tgz
# echo $?
0
```

・iFix の確認

```
# ls -l
total 224556
drwxr-xr-x 4 root root       167 Apr 15 07:00 IT45538-2.2.0-OPSMGR
-rw-r--r-- 1 root root 229942083 Jun  3 00:49 IT45538-2.2.0-OPSMGR.tgz
# cd IT45538-2.2.0-OPSMGR/
# ls -l
total 44
-rw-r--r-- 1 root root 12624 Apr 15 07:00 IT45538-2.2.0-OPSMGR-README
drwxr-xr-x 7 root root   110 Apr 10 06:30 packages
-rw-r--r-- 1 root root   957 Mar 29 02:38 patch_opsmgr_post.yml
-rwxr-xr-x 1 root root 12389 Apr  2 21:59 patch_opsmgr.sh
-rw-r--r-- 1 root root  2747 Apr  8 12:43 post_ifix.yml
-rw-r--r-- 1 root root  1085 Apr  2 22:00 pre_ifix.yml
drwxr-xr-x 2 root root    52 Apr  9 02:42 templates

```


クラスター名の確認

```
# powervc-opsmgr inventory -l


+--------------------------------------------------------------------------------+
|                           PowerVC Inventory - pvc220                           |
+--------------------------------------------------------------------------------+
	Cluster Name              : pvc220
	Cluster ID                : aaab1b1f-234c-40be-a039-750c6f5a55c5
	Install Method            : cluster
	Edition                   : private_cloud
	Firewall Config           : True
	Login User                : root
	Virtual IP                : 172.16.100.xxx
	Primary/Bootstrap Host    : 172.16.100.xxx
	Hosts                     : 172.16.100.xxx
+--------------------------------------------------------------------------------+
|                   *** End of PowerVC Inventory - pvc220 ***                    |
+--------------------------------------------------------------------------------+

```

Cluster Name は pvc220 です。


---

####  iFix 適用実行

実行コマンド

```
# time ./patch_opsmgr.sh pvc220 /work/APAR/IT45538-2.2.0-OPSMGR.tgz
```


<details><summary>実行ログ</summary>



```
# time ./patch_opsmgr.sh pvc220 /work/APAR/IT45538-2.2.0-OPSMGR.tgz
Opsmgr IFIX Path: /work/APAR/IT45538-2.2.0-OPSMGR.tgz
Cluster Name: pvc220
/work/APAR/IT45538-2.2.0-OPSMGR.tgz is valid tar file
patch_opsmgr_pre.yml file not present, hence continuing
Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Configuring Yum repository for PowerVC-Opsmgr-IFix...
Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
ifix-IT45538-2.2.0-OPSMGR                                                                                   3.3 MB/s |  29 kB     00:00
python3-PyYAML                                                                                              418 kB/s |  27 kB     00:00
python39-cryptography                                                                                       4.6 MB/s |  27 kB     00:00
python3-PyNaCl                                                                                              3.9 MB/s |  27 kB     00:00
python3-bcrypt                                                                                              5.4 MB/s |  27 kB     00:00
POWERVC Openstack noarch                                                                                    2.5 MB/s | 374 kB     00:00
POWERVC Openstack ppc64le                                                                                   4.9 MB/s | 171 kB     00:00
POWERVC Opsmgr noarch                                                                                       2.4 MB/s | 143 kB     00:00
POWERVC Opsmgr ppc64le                                                                                      5.0 MB/s |  27 kB     00:00
POWERVC Openstack noarch                                                                                    4.7 MB/s | 492 kB     00:00
POWERVC Openstack noarch rhel8                                                                              707 kB/s |  20 kB     00:00
POWERVC Openstack multiarch rhel8                                                                            31 kB/s | 6.7 kB     00:00
POWERVC Openstack ppc64le                                                                                   2.8 MB/s | 139 kB     00:00
RHEL86_BaseOS                                                                                               5.5 MB/s | 2.0 MB     00:00
RHEL86_AppStream                                                                                             25 MB/s | 6.5 MB     00:00
RHEL86_Supplement                                                                                           1.9 MB/s |  21 kB     00:00
RHEL86_High_Availabilityt                                                                                    22 MB/s | 420 kB     00:00
IBM-Power-Managed                                                                                           797 kB/s |  23 kB     00:00
Deleting versionlock for: python3-pyOpenSSL-0:22.0.0-1.ibm.el8.*
Deleting versionlock for: python3-paramiko-0:2.9.0-2.ibm.el8.*
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Last metadata expiration check: 0:00:03 ago on Mon 03 Jun 2024 05:19:57 AM EDT.
Dependencies resolved.
============================================================================================================================================
 Package                           Architecture       Version                                    Repository                            Size
============================================================================================================================================
Upgrading:
 powervc-opsmgr                    noarch             2.2.0-202404121146.2.ibm.el8               ifix-IT45538-2.2.0-OPSMGR            1.8 M
 python3-paramiko                  noarch             3.4.0-2.ibm.el8                            ifix-IT45538-2.2.0-OPSMGR            313 k
 python3-powervc-opsmgr            noarch             2.2.0-202404121146.2.ibm.el8               ifix-IT45538-2.2.0-OPSMGR            270 k
 python3-pyOpenSSL                 ppc64le            23.3.0-4.ibm.el8                           ifix-IT45538-2.2.0-OPSMGR            104 k
 python39-cryptography             ppc64le            39.0.2-1.ibm.el8                           ifix-IT45538-2.2.0-OPSMGR            1.1 M
 zookeeper                         noarch             3.9.1-4.ibm.el8                            ifix-IT45538-2.2.0-OPSMGR             20 M

Transaction Summary
============================================================================================================================================
Upgrade  6 Packages

Total size: 24 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                    1/1
  Running scriptlet: python39-cryptography-39.0.2-1.ibm.el8.ppc64le                                                                     1/1
  Upgrading        : python39-cryptography-39.0.2-1.ibm.el8.ppc64le                                                                    1/12
  Upgrading        : python3-paramiko-3.4.0-2.ibm.el8.noarch                                                                           2/12
  Upgrading        : powervc-opsmgr-2.2.0-202404121146.2.ibm.el8.noarch                                                                3/12
  Running scriptlet: powervc-opsmgr-2.2.0-202404121146.2.ibm.el8.noarch                                                                3/12
  Upgrading        : python3-powervc-opsmgr-2.2.0-202404121146.2.ibm.el8.noarch                                                        4/12
  Upgrading        : python3-pyOpenSSL-23.3.0-4.ibm.el8.ppc64le                                                                        5/12
  Running scriptlet: zookeeper-3.9.1-4.ibm.el8.noarch                                                                                  6/12
  Upgrading        : zookeeper-3.9.1-4.ibm.el8.noarch                                                                                  6/12
  Running scriptlet: zookeeper-3.9.1-4.ibm.el8.noarch                                                                                  6/12
  Cleanup          : python3-powervc-opsmgr-2.2.0-202311020741.1.ibm.el8.noarch                                                        7/12
  Cleanup          : python3-paramiko-2.9.0-2.ibm.el8.noarch                                                                           8/12
  Cleanup          : python3-pyOpenSSL-22.0.0-1.ibm.el8.ppc64le                                                                        9/12
  Cleanup          : powervc-opsmgr-2.2.0-202311020741.1.ibm.el8.noarch                                                               10/12
  Running scriptlet: zookeeper-3.9.1-2.ibm.el8.noarch                                                                                 11/12
  Cleanup          : zookeeper-3.9.1-2.ibm.el8.noarch                                                                                 11/12
  Running scriptlet: zookeeper-3.9.1-2.ibm.el8.noarch                                                                                 11/12
  Cleanup          : python39-cryptography-36.0.1-2.ibm.el8.ppc64le                                                                   12/12
  Running scriptlet: python39-cryptography-36.0.1-2.ibm.el8.ppc64le                                                                   12/12
  Verifying        : powervc-opsmgr-2.2.0-202404121146.2.ibm.el8.noarch                                                                1/12
  Verifying        : powervc-opsmgr-2.2.0-202311020741.1.ibm.el8.noarch                                                                2/12
  Verifying        : python3-paramiko-3.4.0-2.ibm.el8.noarch                                                                           3/12
  Verifying        : python3-paramiko-2.9.0-2.ibm.el8.noarch                                                                           4/12
  Verifying        : python3-powervc-opsmgr-2.2.0-202404121146.2.ibm.el8.noarch                                                        5/12
  Verifying        : python3-powervc-opsmgr-2.2.0-202311020741.1.ibm.el8.noarch                                                        6/12
  Verifying        : python3-pyOpenSSL-23.3.0-4.ibm.el8.ppc64le                                                                        7/12
  Verifying        : python3-pyOpenSSL-22.0.0-1.ibm.el8.ppc64le                                                                        8/12
  Verifying        : python39-cryptography-39.0.2-1.ibm.el8.ppc64le                                                                    9/12
  Verifying        : python39-cryptography-36.0.1-2.ibm.el8.ppc64le                                                                   10/12
  Verifying        : zookeeper-3.9.1-4.ibm.el8.noarch                                                                                 11/12
  Verifying        : zookeeper-3.9.1-2.ibm.el8.noarch                                                                                 12/12
Installed products updated.

Upgraded:
  powervc-opsmgr-2.2.0-202404121146.2.ibm.el8.noarch                           python3-paramiko-3.4.0-2.ibm.el8.noarch
  python3-powervc-opsmgr-2.2.0-202404121146.2.ibm.el8.noarch                   python3-pyOpenSSL-23.3.0-4.ibm.el8.ppc64le
  python39-cryptography-39.0.2-1.ibm.el8.ppc64le                               zookeeper-3.9.1-4.ibm.el8.noarch

Complete!
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Last metadata expiration check: 0:00:27 ago on Mon 03 Jun 2024 05:19:57 AM EDT.
Adding versionlock on: python3-paramiko-0:3.4.0-2.ibm.el8.*
Adding versionlock on: python3-pyOpenSSL-0:23.3.0-4.ibm.el8.*
Adding versionlock on: python39-cryptography-0:39.0.2-1.ibm.el8.*
Adding versionlock on: zookeeper-0:3.9.1-4.ibm.el8.*
Adding versionlock on: python39-urllib3-1:1.25.10-1.ibm.el8.*
Running patch_opsmgr_post.yml

PLAY [install] *****************************************************************************************************************************

TASK [Gathering Facts] *********************************************************************************************************************
Monday 03 June 2024  05:20:38 -0400 (0:00:00.506)       0:00:00.506 ***********
[DEPRECATION WARNING]: Distribution rhel 8.6 on host 172.16.100.173 should use /usr/libexec/platform-python, but is using /usr/bin/python
for backward compatibility with prior Ansible releases. A future Ansible release will default to using the discovered platform python for
this host. See https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more information. This feature will
 be removed in version 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
ok: [172.16.100.173]

TASK [Check if directory present on non primary node] **************************************************************************************
Monday 03 June 2024  05:20:42 -0400 (0:00:04.436)       0:00:04.943 ***********
ok: [172.16.100.173]

TASK [Create directory] ********************************************************************************************************************
Monday 03 June 2024  05:20:43 -0400 (0:00:00.543)       0:00:05.486 ***********
skipping: [172.16.100.173]

TASK [sync version file] *******************************************************************************************************************
Monday 03 June 2024  05:20:43 -0400 (0:00:00.343)       0:00:05.830 ***********
ok: [172.16.100.173 -> 172.16.100.173] => (item=172.16.100.173)

PLAY RECAP *********************************************************************************************************************************
172.16.100.173             : ok=3    changed=0    unreachable=0    failed=0    skipped=1    rescued=0    ignored=0

Monday 03 June 2024  05:20:43 -0400 (0:00:00.537)       0:00:06.367 ***********
===============================================================================
Gathering Facts --------------------------------------------------------------------------------------------------------------------- 4.44s
Check if directory present on non primary node -------------------------------------------------------------------------------------- 0.54s
sync version file ------------------------------------------------------------------------------------------------------------------- 0.54s
Create directory -------------------------------------------------------------------------------------------------------------------- 0.34s
Successfully updated the PowerVC-OPS Manager RPM. Please proceed with the installation.

real	1m42.164s
user	0m35.306s
sys	0m2.323s
```


</details>

所要時間2分弱でした。


<br>

---

#### 導入確認


```
# yum repo-pkgs ifix-IT45538-2.2.0-OPSMGR list --showduplicates
Updating Subscription Management repositories.

Repository dvd-BaseOS is listed more than once in the configuration
Repository dvd-AppStream is listed more than once in the configuration
Last metadata expiration check: 0:02:44 ago on Mon 03 Jun 2024 05:19:57 AM EDT.
Installed Packages
powervc-opsmgr.noarch                                    2.2.0-202404121146.2.ibm.el8                             @ifix-IT45538-2.2.0-OPSMGR
python3-paramiko.noarch                                  3.4.0-2.ibm.el8                                          @ifix-IT45538-2.2.0-OPSMGR
python3-powervc-opsmgr.noarch                            2.2.0-202404121146.2.ibm.el8                             @ifix-IT45538-2.2.0-OPSMGR
python3-pyOpenSSL.ppc64le                                23.3.0-4.ibm.el8                                         @ifix-IT45538-2.2.0-OPSMGR
python39-cryptography.ppc64le                            39.0.2-1.ibm.el8                                         @ifix-IT45538-2.2.0-OPSMGR
zookeeper.noarch                                         3.9.1-4.ibm.el8                                          @ifix-IT45538-2.2.0-OPSMGR
Available Packages
powervc-opsmgr.noarch                                    2.2.0-202404121146.2.ibm.el8                             ifix-IT45538-2.2.0-OPSMGR
python3-paramiko.noarch                                  3.4.0-2.ibm.el8                                          ifix-IT45538-2.2.0-OPSMGR
python3-powervc-opsmgr.noarch                            2.2.0-202404121146.2.ibm.el8                             ifix-IT45538-2.2.0-OPSMGR
python3-pyOpenSSL.ppc64le                                23.3.0-4.ibm.el8                                         ifix-IT45538-2.2.0-OPSMGR
python39-cryptography.ppc64le                            39.0.2-1.ibm.el8                                         ifix-IT45538-2.2.0-OPSMGR
python39-urllib3.noarch                                  1:1.25.10-1.ibm.el8                                      ifix-IT45538-2.2.0-OPSMGR
zookeeper.noarch                                         3.9.1-4.ibm.el8

```

無事適用 ifix が適用できたようです。



適用後には、ifix の dnf リポジトリーが追加されていました。

```
# dnf repolist | grep ifix
ifix-IT45538-2.2.0-OPSMGR             ifix-IT45538-2.2.0-OPSMGR
```

```
# cat /etc/yum.repos.d/ifix_IT45538-2.2.0-OPSMGR.repo
[ifix-IT45538-2.2.0-OPSMGR]
name=ifix-IT45538-2.2.0-OPSMGR
gpgcheck=1
enabled=1
baseurl=file:///opt/ibm/powervc-opsmgr/ifixes/2.2.0/opsmgr_ifix/IT45538/
priority=90
module_hotfixes=1
```

モジュールが "/opt/ibm/powervc-opsmgr/ifixes/2.2.0/opsmgr_ifix/IT45538/" にコピーされるので今後不要であれば削除しても良いものと思います。


<br>

以上です。