Date:   May 29, 2002

Patch:  3.7.1-TMF-0066

Component: Tivoli Framework 3.7.1

General Description:

    This patch fixes an endpoint distribution problem.  Although this is
    a 3.7.1 endpoint patch, it can be installed on 3.7 or 3.7.1 systems
    to allow for subsequent endpoint upgrades.  This patch supersedes
    all previous 3.7 and 3.7.1 endpoint patches, efixes, and fixpacks
    (a complete list is provided below).  If installed on a 3.7 system,
    then patch 3.7-TMF-0016 must be installed first.  The fixes in
    3.7.1-TMF-0066 are only applicable to endpoints. Since several fixes
    in this patch also affect TMR servers and managed nodes, then
    3.7.1-TMF-0067 should be installed if these fixes are also needed on
    TMR servers and managed nodes.

Problems Fixed:

  New Fixes in 3.7.1-TMF-0066:

    Internal CMVC Defect 140090
    Symptoms: The distribution process of an ITM 5.1 profile (via
    mdist2) on Unix endpoints core dumps when endpoint patches
    3.7.1-TMF-0044, 3.7.1-TMF-0055E, 3.7.1-TMF-0060, and 3.7.1-TMF-0062E
    are installed. 

  Fixes from 3.7.1-TMF-0062E:

    Internal CMVC Defect 131667
    Symptoms: The Distributed Monitoring 4.1 engine that runs on PC
    endpoints has a memory leak during upcalls.  This memory leak also
    affects Tivoli Enterprise Console 3.8.

    Internal CMVC Defect 134502
    Symptoms: If a program (e.g., TELNET or netcat) connects to an
    endpoint's main socket and does not send any data, it can create a
    situation in which the TMR will not be able to communicate across
    the connection to the TMA.  The fix for this includes the addition
    of three new parameters to the lcfd program to control the queue that
    lcfd uses to manage incoming requests:

      1) recvDataTimeout: How many seconds to wait for data on an
      incoming connection before requeuing the connection (Default = 2).
      2) recvDataNumAttempts: How many times to attempt to receive data
      on a connection before closing the connection (Default = 10).
      3) recvDataQMaxNum: How many connections to hold in the pending
      connection queue at one time (Default = 50).

    APAR IY16990
    Symptoms: A control character at the end of the lcf_env.sh and
    lcf_env.cmd files prevents them from terminating with a correct
    return code (0) even if successful.

    Additional Information: The fix for this APAR is included only in
    the InstallShield images provided in this patch for new endpoint
    installations.  This fix is not applicable to endpoints that are
    upgraded with the contents of this patch.

    APAR IY28146
    Symptoms: In an environment where the incorrect Windows 2000 context
    is set and a distribution with Tivoli User Admin 3.8 is done, the
    gateway eventually times out with a "communication reset by peer"
    message instead of displaying a popup error message.

    APAR IY28879
    Symptoms: When trying to do an installation with winstlcf for a NT
    endpoint using a proxy machine, there are errors on the
    CreateDirectory function if the share name does not contain a "$"
    (for example, "C$").

  Fixes from 3.7.1-TMF-0060:

    Internal CMVC defect 120559 / APAR IY28709
    Symptoms: When software distribution requires input from a user on a
    Windows XP target endpoint, the window on the endpoint is placed
    into the task bar, but the user cannot double click the window or
    open the window.

    APAR IY15375.1
    Symptoms: The execute bit is turned on for $LCF_DATDIR/lcfd.log for
    "others". The execute bit should be turned off for everyone on this
    file.

    APAR IY20655
    Symptoms: A upgrade failure can occur on Windows NT/2000/XP systems
    if TivoliAP.dll has been disabled.  The upgrade fails while
    attempting to copy file permissions from the previous version of
    TivoliAP.dll.  This should not be treated as a fatal error, but only
    as a warning, so the upgrade can continue.

    APAR IY23342
    Symptoms: The contents of the uninst.bat file (by default, found in
    "C:\Program Files\Tivoli\lcf") will point to the directory
    "C:\WINNT\Profiles\...", which does not exist.  Because of this,
    running "uninst RemoveTAP" and rebooting does not remove
    TivoliAP.dll from the System32 directory (and leaves DELTAP.bat in
    "C:\WINNT\Profiles\..." as well).

    Additional Information: The fix for this APAR is included only in
    the InstallShield images provided in this patch for new endpoint
    installations.  This fix is not applicable to endpoints that are
    upgraded with the contents of this patch.

    APAR IY25091
    Symptoms: The "wep <ep> set_config" and "wep <ep> set" commands can
    be used to set the "lcs.unique_machine_id=<28_char_value>" on an
    endpoint.  However, these commands only alter the value in the
    endpoint's lcfd cache or the endpoint manager.  Since the last.cfg
    file on the endpoint is not updated, then the old id value will be
    read back into cache and used when the endpoint is restarted.

    Additional Information: This fix is only applicable to AIX and PC
    (i.e., Windows, OS/2, and NetWare) endpoints.  This fixes for
    IY25091 are applicable to both TMR Servers / managed nodes and
    endpoints.  Thus, both 3.7.1-TMF-0067 (for TMR Servers / managed
    nodes) and 3.7.1-TMF-0066 (for endpoints) must be installed for this
    fix.

    APAR IY27844
    Symptoms: Certain 3.7.1 endpoints do not run the login_policy when
    they do a normal login to their assigned gateway.

  Fixes from 3.6.5-TMF-0020:

    APAR IY20655
    Symptoms: A upgrade failure can occur on Windows NT/2000/XP systems
    if TivoliAP.dll has been disabled.  The upgrade fails while
    attempting to copy file permissions from the previous version of
    TivoliAP.dll.  This should not be treated as a fatal error, but only
    as a warning, so the upgrade can continue.

  Fixes from 3.6.5-TMF-0019 and 3.7.1-TMF-0041E:

    (Note: The Framework 3.7.1 release contains binaries for endpoints
    at version 80 or later in the lcf_bundle.40 directory and binaries
    for earlier endpoint versions in the lcf_bundle directory.  This
    patch provides updates to both of those directories.  The updates in
    the lcf_bundle directory are the binaries that were released with
    patch 3.6.5-TMF-0019. Specifically, the fix for IY25410 in patch
    3.6.5-TMF-0019 will be needed for Distributed Monitoring releases
    that are linked with 3.6.x libraries, and the fix for IY22626 in
    3.6.5-TMF-0019 will be needed for upgrading 3.6.x versions of OS/2
    endpoints.)

    APAR IY25410, Internal CMVC defect 128312
    Symptoms: The lcfd process on an endpoint binds to its assigned
    port, and applications like Distributed Monitoring (DM) can reuse
    that same port.  This causes a problem for DM applications by
    allowing multiple processes on the same listening port, which
    results in multiple dm_ep_engine's.

    APAR IY22626
    Symptoms: An attempt to upgrade an OS/2 endpoint using the command
    "wadminep <ep> upgrade" where the endpoint version number is 64 or
    less results in a failure. Error SYS3175 is reported in lcfd.log.

  Fixes from 3.7.1-TMF-0055E:

    Internal CMVC defect 128312
    Symptoms: The lcfd process on an endpoint binds to its assigned
    port, and applications can reuse that same port.  This causes a
    problem for the applications by allowing multiple processes on the
    same listening port.

    Additional Information: Patch 3.7.1-TMF-0044 contained a fix for
    128312 that was applicable to Distributed Monitoring (DM).  The fix
    in this efix extends that earlier fix to applications other than
    DM.

    Internal CMVC defect 131553
    Symptoms: Enable customers to control access to the the TMA
    information presented on the TMA's web pages by requiring the user
    to authenticate to the TMA using the HTTP userid and password for
    the TMA in the TMR.

    Additional Information: Currently, the TMA controls access to this
    information through the use of the http_disable option.  The current
    options for http_disable are:

      0 - Default.  Anyone can see the web pages and, if they know the
          HTTP userid and password, can make changes to the options for
          the TMA and restart it. 
      1 - Anyone can see the web pages, but no changes can be made.
      2 - The web pages are not displayed at all.

    The fix for this defect adds another value:

      3 - User must authenticate to the TMA using the HTTP userid and
          password (as seen on the "wep <TMA-label>" command) before any
          of the web pages are presented, or else no pages are
          displayed.  This means that the browser function is available,
          but protected, using the userid and password.  If
          http_disable=3 is set, the user is allowed to change any
          configuration parameters (just like the http_disable=0
          setting) since the user is already authenticated.

    Internal CMVC defect 131696
    Symptoms: Initial logins and migration logins using TCP/IP should
    respect the udp_attempts and udp_interval settings to allow the
    endpoint to retry logins destined for a gateway.  Adding this
    capability brings the TCP/IP logins into functional alignment with
    the udp broadcast model and makes logins work consistently with the
    way they worked prior to the addition of TCP/IP login functionality.

    Internal CMVC defect 132265
    Symptoms: During initial login processing, the TMA cycles through
    its list of known gateways, contacting them in the order in which
    they were specified on the command line options.  However, the first
    gateway in the list is tried twice.

    APAR IY17830
    Symptoms: When browsing an endpoint directory, a filename with more
    than 24 characters will be truncated.  This can happen when
    importing a Software Package into a Software Package Profile with
    the Import dialog box and in the Location of Input File group box,
    selecting an endpoint and browsing. 

  Fixes from 3.7.1-TMF-0044:

    Internal CMVC defect 128718
    Symptoms: The updata directory on the endpoint should not be created
    when LCFD starts.  The updata directory is used to store upcall data
    files when allow_proxy_upcalls is TRUE and filefree_upcalls is
    FALSE.  The updata directory should only be created when it is
    needed, i.e., when allow_proxy_upcalls is TRUE, filefree_upcalls is
    FALSE, and an upcall is performed).

    Internal CMVC defect 129269
    Symptoms: Allow the command "wep <ep> set_config log_threshold=x" to
    dynamically change the logging level on the endpoint without having
    to restart the TMA.

    APAR IY03771
    Symptoms: Windows 95 endpoints report their hostnames as fully
    qualified names with the network name included.  The hostname should
    not include the network name.

    APAR IY19899
    Symptoms: If the Locale setting for the decimal point is not a full
    stop (i.e., the English number setting), then the values entered for
    Event IDs are incorrectly converted.  This can happen on non-US
    machines.

    Additional Information: The fix in 3.7.1-TMF-0044 is for endpoints.
    A similar fix for TMR servers / managed nodes is in 3.7.1-TMF-0043.

    APAR IY23751
    Symptoms: The endpoint binaries in patch 3.7.1-TMF-0005 display
    unnecessary debug information on the NetWare console screen.

    APAR IY24353
    Symptoms: If the 3.7 dm_ep_engine is running on an endpoint and the
    lcfd process tries to start, lcfd will not successfully bind to a
    port and, therefore, will not start properly.  Also, the endpoint
    does not try to use the alternate port listed in the last.cfg file.

  Fixes from 3.7.1-TMF-0033:

    Internal CMVC defect 119088
    Symptoms: Add support for Chinese National Standard GB18030 since
    new products released to the China are required to support this code
    page.

    Additional Information: This fixes for 119088 in this fixpack are
    only applicable to endpoints.  Fixes for TMR Servers and managed
    nodes are in fixpack 3.7.1-TMF-0032.

    APAR IY16042
    Symptoms: When a command like "wadminep view_version" or "wadminep
    view_cache_index" is executed on a Unix endpoint, a file with
    endpoint status information like "cache_hits" is created in the
    "/tmp" directory, but never deleted.

    APAR IY19078
    Symptoms: When multiple tasks are run simultaneously on an endpoint,
    an error message similar to:

        run_task ** Exception caught in run_impl: remove
        (E:\Tivoli\lcf\Tiv16E.SH) failed errno=2

    can be generated.

    Additional Information: During the testing of IY19078, the reported
    problem with errno=2 was verified as fixed.  However, in some cases
    with a large number of of tasks (500+), an errno=9 was observed both
    on systems which had this fixpack and systems which did not have this
    fixpack.  Internal defect 127582 has been created for this errno=9
    problem and will be addressed in a future patch or fixpack.

    APAR IY22155
    Symptoms: Windows 95/98 endpoints can hang the Windows shutdown when
    an endpoint cannot establish a connection with its gateway.  An "LCF
    not responding" message is displayed, which requires user
    intervention to continue the shutdown process.

    APAR IY25259
    Symptoms: Endpoint version 94 from patch 3.7.1-TMF-0021 does not use
    alternate gateways.  For an isolated endpoint login, the endpoint
    fails to cycle through the list of alternate gateways.

  Fixes from 3.7.1-TMF-0021:

    Internal CMVC defect 124050
    Symptoms: Add a routine to the mdist2 net_stream API that allows
    applications to set an error message that will be displayed by the
    Mobile GUI in the event of a failure.

    Additional Information: The fix for defect 124050 is in an endpoint
    library that is used by the Mobile subsystem and is a prerequisite
    of patch 3.7.1-TMF-0024.  Patch 3.7.1-TMF-0024 contains a fix for
    defect 124061, which corrects a problem with Mobile distributions.
    Thus, both patches 3.7.1-TMF-0021 and 3.7.1-TMF-0024 must be
    installed to have the fix for 124061.

    The fix for 124050 in this patch is also a prerequisite of the
    Software Distribution patch 4.1-COU-0024 (specifically, for APAR
    IY22708 in 4.1-COU-0024).  Thus, both patches 3.7.1-TMF-0021 and
    4.1-COU-0024 must be installed to have the fix for IY22708.

    APAR 125453
    Symptoms: The fix for IY17872 in patch 3.7.1-TMF-0005 added changes
    to avoid a continuous loop when lcfd wakes up from a suspended
    state.  However, these changes can cause lcfd to be unresponsive for
    udp_interval seconds when an lcfd port is closed.

    APAR IY18726
    Symptoms: On an OS/2 Warp Server, an endpoint will install and run
    successfully.  However, once the config.sys file reaches a size of
    about 30K, it fails to start.  It appears as though the lcfd doesn't
    allocate enough space to read in the environment variables.

    APAR IY19684
    Symptoms: A Windows NT endpoint with two NIC cards fails its initial
    login to a gateway when using the "-D LOCAL_IP_INTERFACE=<SECOND NIC
    ADDRESS>" parameter.

    APAR IY20118 
    Symptoms: If you install an endpoint on Windows 98, the endpoint
    logs into the gateway correctly.  If you then log off the Windows 98
    session, the endpoint is disconnected and the lcfd.log (debug level
    3) contains the message "SystemEvent: Received WM_CLOSE event".  The
    customer must stop/start the lcfd locally after relogging to a
    Windows 98 session.

    APAR IY20800
    Symptoms: Bringing up an endpoint HTTP web access page using a
    string about 200-300 characters long following the port number
    specification can cause a buffer overflow.

    APAR IY20970
    Symptoms: The NetWare addadmin.nlm module allows a maximum of 61
    characters for the context name.  The fix for this APAR increases
    that limit to 256 characters.

    APAR IY21032
    Symptoms: After an OS/2 endpoint is installed and has logged into a
    gateway, the LCFD.ID file does not get created.  When the endpoint
    is rebooted, the LCFD.ID file is created, but it has a different ID
    then the ID in the endpoint manager database.

    APAR IY22926
    Symptoms: The lcfd executable can core dump after receiving an
    upcall_start command from Distributed Monitoring.  

    APAR IY24110
    Symptoms: A problem was introduced in patch 3.7.1-TMF-0005 in which
    endpoints with alternate gateways would not migrate to those
    alternate gateways when the primary gateway was down.

  Fixes from 3.7.1-TMF-0005:

    Internal CMVC defect 40354
    Symptoms: Add support for Secure Console, a NetWare feature that
    allows user to improve their network security.  Once activated: (1)
    Path specifiers are disabled, and (2) New search paths can not be
    created.  Thus, only the modules stored in a directory specified in
    a search path can be loaded, and to be loaded, the module must be
    named without its full path name.

    Internal CMVC defect 117297
    Symptoms: For the 3.7 release, the emx*.dll files are not present in
    the directory lcf_bundle.40/bin/os2-ix86/tools.  This defect was
    fixed in 3.7.1, but is provided in this patch for 3.7 installations.

    Internal CMVC defect 117565
    Symptoms: The lcf_bundle directory on Windows NT has a copy of the
    3.7 OS/2 tools, which are dependent on emx*.dll(s).  It should have
    the 3.6.5 tools.

    Internal CMVC defect 118030
    Symptoms: If you use winstlcf to install an endpoint to a Windows NT
    machine which does not have the "tmersrvd" account defined and which
    does not have TivoliAP.dll in the %SystemRoot%\system32 directory,
    the installation will be incomplete.

    Internal CMVC defect 118116, APAR IY15755
    Symptoms: When a task is launched on an endpoint and the root_user
    idmap is set to BuiltinNTAdministrator, the task execution fails
    with "user not found" error.

    Additional Information: The fix for 118116 in this patch is only
    applicable to endpoints.  A similar fix is made for TMR servers and
    managed nodes in patch 3.7.1-TMF-0003.

    Internal CMVC defect 118758
    Symptoms: If the TRAA account specified for use by TAP is disabled,
    and the administrator issues "wadminep <ep> view_version" (for
    example), LCFD traps attempting to spawn the admin method.

    Internal CMVC defect 119217
    Symptoms: On endpoints, lcfd has memory leaks in certain situations
    when connecting to a gateway.

    Internal CMVC defect 119929
    Symptoms: Signaling the Service Control Manager that the service
    has stopped before completing all shutdown tasks causes an error
    dialog box to appear on Windows XP Beta 2.

    Internal CMVC defect 119930
    Symptoms: To run tasks and methods on endpoints in the more
    restrictive Windows 2000 / XP environment, a spawned process must
    have read and execute permission for its script or binary.

    Internal CMVC defect 119932
    Symptoms: When using the WIN32_WHOAMI_EFFECTIVE parameter,
    win32_whoami queries the current process security descriptor owner
    to see if the current user is a member of the Administrators
    group. This is not a reliable indicator (especially on Windows XP),
    so we must determine group membership explicitly.

    Internal CMVC defect 119933, APAR IY14574
    Symptoms: Since the default security settings for Windows 2000 and
    XP are more restrictive than NT, we can longer require Everyone to
    have read / execute access to System32 or add tmersrvd to Power
    Users.

    Internal CMVC defect 120948, APAR IY17084
    Symptoms: If the keyword "do_compress=yes" is set when creating a
    filepackage block with the 3.6.2 Object Packager, then the
    filepackage block will be created, but it will just consist of one
    line of text and not the expected file.

    Internal CMVC defect 122548
    Symptoms: Endpoint initial and isolated logins need to use TCP, not
    UDP.  The current endpoint code sends out a UDP packet for an
    endpoint's initial or isolated login attempts, but in firewall
    environments, most UDP operations are restricted.

    APAR IY08217 
    Symptoms: Endpoints cannot contact gateways through firewalls
    because they do not adhere to the port range restrictions like
    managed nodes do.

    Additional Information: The fix for IY08217 requires the
    installation of this patch, which is applicable to endpoints, and
    patch 3.7.1-TMF-0008, which is applicable to gateways.  Since patch
    3.7.1-TMF-0008 is only for 3.7.1, not 3.7, then the fix for IY08217
    is not available on 3.7, even though 3.7.1-TMF-0005 can be installed
    on 3.7 systems.

    APAR IY14451
    Symptoms: The oserv cannot be started if the TMERSRVD domain account
    is disabled.  (The fix for IY14451 affects TivoliAP.dll and is not
    applicable to endpoints.  However, it is included in this patch in
    case an endpoint is installed on a TMR or managed node.)

    Internal CMVC defect IY14630
    Symptoms: The "wep set interfaces" command cannot set the interface
    table with a gateway hostname for access through a NAT firewall.

    APAR IY16013
    Symptoms: When a "wadminep <ep_name> upgrade" command is issued for
    a Windows 95/98 endpoint, the endpoint automatically reboots.  A
    dialog box is needed on the endpoint that informs the user that a
    reboot will be happening.

    Additional Information: The fix for IY16013 affects binaries on the
    endpoint as well as the wadminep binary on the gateway.  Patches
    3.7-TMF-0028 and 3.7.1-TMF-0008 provide the wadminep binary for 3.7
    and 3.7 1, respectively.  Patch 3.7.1-TMF-0005 provides endpoint
    binaries for both 3.7 and 3.7.1.  Thus, for a 3.7 environment, both
    3.7-TMF-0028 and 3.7.1-TMF-0005 must be installed to have the fix
    for IY16013, and for a 3.7.1 environment, both 3.7.1-TMF-0008 and
    3.7.1-TMF-0005 must be installed to have the fix for IY16013.

    APAR IY16086
    Symptoms: Add the address_notif_retry_count lcfd parameter, which
    controls the number of retries that are made when the lcfd attempts
    to send its current IP address to the gateway (see
    address_notif_interval).  When the gateway cannot be contacted, the
    lcfd will wait the number of seconds specified by the udp_interval
    parameter and retry the connection to the gateway.  It will repeat
    this process of waiting and retrying until either the connection is
    made or the number of retries specified by this parameter are
    exhausted.  If the number of retries is exhausted, the lcfd will
    attempt to contact the next gateway in its list of gateways.

    APAR IY17872
    Symptoms: For endpoints, the lcfd executable on Windows 95 laptops
    goes into a continuous loop after the laptop wakes up from suspend
    mode.  System error 10050 may be reported.

    APAR IY18729
    Symptoms: On OS/2 Warp Server, patch 3.7.1-TMF-0001 installs
    endpoint version 92 correctly.  However, if no gateway is available,
    then after about 5 minutes, the endpoint times out and traps.  Thus,
    if a gateway goes down and no backup gateway exists, all endpoints
    have to be restarted after gateway is brought back up.

    Additional Information: The problem reported in IY18729 was caused
    by an incorrect fix in patch 3.7.1-TMF-0001.

    APAR IY19325
    Symptoms: During software distributions, an error similar to the
    following may appear in the software distribution log files:
    "Operation unsuccessful.  A checkpoint offset was not set for
    segment ID (SWDISEP_WIN95) version (1.0) because the segment was
    locked."

    Additional Information: The fix for IY19325 affects binaries on the
    endpoint as well as the gateway.  Patch 3.7.1-TMF-0008 provides the
    gateway binaries and patch 3.7.1-TMF-0005 provides the endpoint
    binaries.  For a 3.7.1 environment, both 3.7.1-TMF-0008 and
    3.7.1-TMF-0005 must be installed to have the fix for IY19325.

  Fixes from 3.7.1-TMF-0001:

    Internal CMVC defect 117780
    Symptoms: In Windows NT 4.0, running any task as the hidden user id
    "System" kills the lsaa.exe security program.  This prevents any
    security actions, like logins, from occurring until the system is
    rebooted.

    Additional Information: The fix in this patch is for endpoints.
    Patch 3.7.1-TMF-0003 contains this fix for TMRs and managed nodes.

    APAR IY14722
    Symptoms: The LCFD process on Windows NT leaks memory when it is
    trying to login to a gateway that is down, and it has no alternate
    gateways set in the last.cfg file.

    APAR IY16290
    Symptoms: The endpoint service (lcfd.exe) causes Windows 2000
    systems to reboot if the CrashOnAuditFail key is enabled.

Architecture(s):

    Solaris, AIX 4, HPUX 10, Windows NT, OS/2, NetWare
    Windows 95  (Endpoint Only)

    Note: This patch contains endpoint fixes for all the above platform
    types.  The first six platform types listed can also be gateways,
    and this patch can be installed on those gateways in order to
    upgrade endpoints of any of the above platform types with the fixes
    in this patch.

Patches superseded by this patch:

    3.7.1-TMF-0001
    3.7.1-TMF-0005
    3.7.1-TMF-0021
    3.7.1-TMF-0033
    3.7.1-TMF-0041E
    3.7.1-TMF-0044
    3.7.1-TMF-0055E
    3.7.1-TMF-0060
    3.7.1-TMF-0062E

Dependencies:

    TMF_3.7
    3.7-TMF-0016 (if installed on a 3.7 system)

Database Changes and Special Considerations:

    1) As noted in the Problems Fixed section above, the Framework 3.7.1
    release contains binaries for endpoints at version 80 or later in
    the lcf_bundle.40 directory and binaries for earlier endpoint
    versions in the lcf_bundle directory.  This patch provides updates
    to both of those directories.  The updates in the lcf_bundle
    directory are the binaries that were released with patch
    3.6.5-TMF-0019 plus one fix from the unreleased 3.6.5-TMF-0020.

    2) The NetWare Secure Console fix provided in defect 40354 enables
    Tivoli endpoints to run in Secure Console mode on NetWare servers.
    Secure Console is a NetWare operating system feature that allows
    users to improve their network security by preventing the execution
    of modules that are not stored in a secure path. Once Secure Console
    is activated, path specifiers are disabled and new paths cannot be
    added to search paths. In other words, the modules stored in a
    directory specified in the search path can be loaded, but must be
    named without specifying their full qualified pathname before being
    loaded.  To enable endpoints to work in a secured environment, all
    paths used to run methods must be defined as search paths. The
    system administrator must also perform the actions described below
    before  Secure Console can be activated.

    3.7.1-TMF-0066 provides updated endpoint modules, and the waddpath
    and wupdncf commands.  After this patch has been installed, the
    wupdncf command must be run to modify the SYS:SYSTEM\LCF.NCF startup
    script. The wupdncf command also performs the following tasks:

      - Removes the full path specification for the LCFUTILS and LCFD
        commands.

      - Adds a command to update the search path at the beginning of the
        endpoint startup script which will add the paths SYS:TEMP and
        $BINDIR to the search path.

      - Creates the SECCON file in the %BINDIR directory, which is used
        to control usage of Secure Console mode or standard mode.

    Note: The endpoint will start in secured mode if the SECCON file is
    present. If the endpoint does not find the SECCON file, it will
    automatically start in standard mode.

    The LCF.NCF file must be executed before Secure Console is
    activated. Otherwise, the SEARCH ADD command will fail. The startup
    sequence of the server should be rearranged so that the LCF.NCF file
    is listed before the SECURE CONSOLE command.

    The waddpath command adds the paths needed to run other Tivoli
    applications that are designed to support Secure Console mode of
    operation. The waddpath command accepts a fully qualified pathname
    as a parameter and adds it to the search path. For example,

      load waddpath <path>

    adds the following line at the top of the LCF.NCF file:

      search add <path>

    The server must be powered off to activate the new search paths when
    Secure Console is active.

    Note: Search paths cannot be added if Secure Console is on. You must
    power off to remove Secure Console.

    3) Endpoint Upcall Firewall Enablement is provided in the fix for
    APAR IY08217.  See the Readme file for patch 3.7.1-TMF-0008 for a
    description of this fix.

Files Replaced by this Patch (for all supported values of INTERP):

    $BINDIR/../lcf_bundle.40/generic
    $BINDIR/../lcf_bundle.40/bin/%INTERP%/mrt
    $BINDIR/../lcf_bundle.40/bin/%INTERP%/endpoint
    $BINDIR/../lcf_bundle.40/bin/%INTERP%/upgrade
    $BINDIR/../lcf_bundle.40/bin/%INTERP%/PCagent_clis
    $BINDIR/../lcf_bundle.40/bin/%INTERP%/TAS/TASK_LIBRARY
    $BINDIR/../lcf_bundle.40/bin/os2-ix86/tools/emx.dll
    $BINDIR/../lcf_bundle.40/bin/os2-ix86/tools/emxlibcm.dll
    $BINDIR/../lcf_bundle.40/bin/os2-ix86/tools/emxlibcs.dll
    $BINDIR/../lcf_bundle.40/bin/w32-ix86/tools/wrunuiep.exe
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libccms60_lcf.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libcpl60.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libdes60.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libmd2ep60.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libmrt60.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libtcp60.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/ccms_lcf.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/lcpl.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/ldes_lcf.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/lmrt.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/lmd2ep.dll
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libccms272_lcf.SL
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libcpl272.SL
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libdes272.SL
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libmrt272.SL
    $BINDIR/../lcf_bundle.40/lib/%INTERPS%/libmd2ep272.SL
    $BINDIR/../lcf_bundle.40/msg_cat/C

    $BINDIR/../lcf_bundle/bin/%INTERP%/mrt
    $BINDIR/../lcf_bundle/bin/os2-ix86/tools
    $BINDIR/../lcf_bundle/lib/%INTERP%/libmrt.SL
    $BINDIR/../lcf_bundle/bin/%INTERP%/endpoint
    $BINDIR/../lcf_bundle/bin/%INTERP%/upgrade
    $BINDIR/../lcf_bundle/bin/%INTERP%/TAS

Patch Contents:

    - This README file
    - The cdrom image for this patch
    - The image report for this patch
    - The endpoint installation images for NetWare 4, OS/2, Windows NT,
      and Windows 95.  These installation images are in the directory
      371TMF66/PC/LCF that is created when the patch is extracted from
      the tar file.

Applying the Patch:

    1)  Extract the patch:

        On a Unix system:
        
        Extract the contents into a scratch directory. For the purpose
        of this release note, assume that the symbol $PATCH points to
        this directory.

        # cd $PATCH
        # tar xvf 3.7.1-TMF-0066.tar

        On a Windows NT system:

        Extract the contents into a scratch directory. For the purpose
        of this release note, assume that the symbol %PATCH% points to
        this directory. 

        > %SystemRoot%\system32\drivers\etc\Tivoli\setup_env
        > X:              
          ^-- 'X' is drive letter where %PATCH% is found
        > cd %PATCH%
        > tar xvf 3.7.1-TMF-0066.tar

        NOTE:  If you are extracting the tar image on a Windows NT
        system, you will find an executable for tar in the TME
        installation on Windows NT under bin/w32-ix86/tools/tar.exe.

    2)  If this patch is to be installed on a release level of 3.6 or
        greater, follow these instructions for using Software
        Installation Service (SIS).  If not, skip to step 3 below.

        NOTE: SIS can install Tivoli products on any hardware
              platform supported by Tivoli, but there are some
              hardware platforms on which SIS cannot be run. Please
              check your SIS User's Manual for the list of platforms
              on which SIS can be run.

        NOTE: You must have the install_product and super authorization
              roles to successfully install this patch.

        a)  From the Tivoli Desktop, pull down 
            Desktop --> Install --> Software Installation Service.
        b)  SIS will initialize, and bring up the Get Installation
            Password Dialog.  Enter your Installation Password.
        c)  Click the Install Button on the dialog which contains
            the Tivoli image.
        d)  Click the Select Product Button on the Install Spreadsheet
            Dialog.
        e)  Click the Import Product Button on the Select Product
            Dialog.
        f)  Locate the media to 3.7.1-TMF-0066 using the file browser,
            and select the PATCHES.LST file by double-clicking it.
        g)  Select 3.7.1-TMF-0066 in the Import Product Dialog, and
            click the Import Button.
        h)  When the import is complete, click the OK Button on the
            Global Progress Dialog.
        i)  Select 3.7.1-TMF-0066 in the Select Product Dialog, if it
            is not already selected, and click the OK Button.
        j)  Now click the Select Machine Button on the Install
            Spreadsheet Dialog.
        k)  Select the machine(s) you would like to install
            3.7.1-TMF-0066 on and click the OK Button.
        l)  Click the appropriate cell(s) in the Install Spreadsheet
            Dialog. (NOTE: This should yield an "X" in the cell(s)
            for the machines you want to install 3.7.1-TMF-0066 to).
        m)  Click the Install Button.
        n)  Select the install algorithm you want to use on the
            Installation Algorithm Dialog, and click OK.
        o)  SIS will perform the installation(s) you designated
            in the Install Spreadsheet Dialog.
        p)  Installation is complete. Check the Additional 
            Installation Instructions section below.

    3)  Use the following steps to install the patch using the Tivoli
        GUI install mechanism.
        NOTE: You must have the install_product and super authorization
        roles to successfully install this patch.

        a)  Select the "Install -> Install Patch..." option from the
           "Desktop" menu to display the "Install Patch" dialog.
        b)  Press the "Select Media..." button to display the "File
            Browser" dialog.
        c)  Enter the path to the directory containing the patch,
            $PATCH, in the "Path Name:" field.
        d)  Press the "Set Media & Close" button to return to the
            "Install Patch" dialog.
        e)  The patch install list now contains the name of the patch.
            Select the patch by clicking on it. 
        f)  Select the clients to install this patch on. This patch
            needs to be installed on gateway machines.
        g)  Press the "Install" button to install the patch.

Additional Installation Instructions:

    This patch upgrades the endpoints from earlier versions to version
    100.  In order to upgrade your endpoints: 

    1) Make sure the endpoint has logged into the TMR.

    2) Verify that the endpoint has logged in by using the "wep ls"
       command.

    3) Before the upgrade, do:
  
        wadminep <ep_name> view_version

       The version number returned should be a value less than 100,
       depending on which other patches affecting endpoint code have 
       been applied.

    4) From the TMR server or the gateway that the endpoint is logged
       into, do:

        wadminep <ep_name> upgrade.

    5) After the upgrade, do: 
 
        wadminep <ep_name> view_version

       It should return a 100.

    This patch contains the Windows NT library TivoliAP.dll.  Since
    TivoliAP.dll may already be in use by Windows NT, the Windows NT
    system must be rebooted after an upgrade (or a new installation
    where an older version of TivoliAP.dll was in use) so that this new
    version of TivoliAP.dll will be loaded into memory.  If you do not
    reboot, then Windows NT will continue to use the older TivoliAP.dll
    that was previously loaded.  This reboot also is also needed for
    Windows 2000 endpoints.

    (The TivoliAP.dll being replaced is used by the Windows NT security
    service.  Due to this library being locked, we must follow the
    Microsoft solution for handling locked libraries.  This solution
    dictates that we must reboot the Windows NT system to allow the
    locked library to be replaced at boot time.)

    Note: The version of TivoliAP.dll supplied in this patch is the same
    as the version supplied in endpoint patches:

      3.7.1-TMF-0005    (endpoint version 93)
      3.7.1-TMF-0021    (endpoint version 94)
      3.7.1-TMF-0033    (endpoint version 95)
      3.7.1-TMF-0044    (endpoint version 96)
      3.7.1-TMF-0055E   (endpoint version 97)
      3.7.1-TMF-0060    (endpoint version 98)
      3.7.1-TMF-0062E   (endpoint version 99)

    except for timestamp information.  Thus, if you are upgrading from
    one of the endpoint versions listed above to this patch, then it is
    not necessary to reboot the Windows NT or Windows 2000 endpoints.

Known Defects:

    None.
