Configuring TrueSight Operations Management Report Engine to enable TLS

Perform the following steps to enable the Infrastructure Management server main cell to Reporting engine communication to be TLS compliant:

• Step 1:To configure the Infrastructure Management server cell component
• Step 2:To configure the Report Engine component

To configure the Infrastructure Management server cell component

1. Using a text editor, open the mcell.dir file on the BMC TrueSight Infrastructure Management Server host computer. The file is located in the <Infrastructure Management server Install Directory>\pw\server\etc directory.

2. Check for the instance of the code line having encryption key value as shown in the following code block:

   gateway.reportengine bpre.<fullyQualifiedHostName> <encryptionKey> <fullyQualifiedHostName>:<3783>

   #Example

   gateway.reportengine bpre.vs-pun-tsim-bp03.bmc.com mc vs-pun-tsim-bp03.bmc.com:3783

3. Modify the existing value of encryption key to *TLS as shown in the following example:

   gateway.reportengine bpre.vs-pun-tsim-bp03.bmc.com *TLS vs-pun-tsim-bp03.bmc.com:3783
4. Save and close the file.

5. Reload the mcell.dir file by entering the following command from a command line:

   #Syntax

   mcontrol -n cellName reload dir

   #Example

   mcontrol -n pncell_vm-w23-rds1016 reload dir

   Note

   pncell_vm-w23-rds1016 is the name of the cell.

   
   

To configure the Report Engine component

1. Navigate to the reportsCLI directory by running the following command:

   # Microsoft Windows operating system

   CurrentDirectory>cd <TrueSight Operations Management Reporting Install directory>\bin\reportsCLI

   # Unix operating system

   $cd <TrueSight Operations Management Reporting Install directory>/bin/reportsCLI

2. Initiate the configuration settings by running the following command:

   #Syntax

   tls_config init -truststore <truststore file> -truststorepassword <truststore password> [-keystore <keystore file> -keystorepassword <keystore password>][-SqlAnywhereCert <trust certificate path>]

   #Example

   tls_config init -truststore cacerts -truststorepassword <truststore password> -keystore cacerts -keystorepassword <keystore password> -SqlAnywhereCert <BMC TrueSight Operations Management Report Engine Install Directory>\ReportEngine\tools\jre\bin

   When you run the tls_config script, you are prompted to confirm the restart of the Reporting Engine. The TLS configurations are applied only when the Reporting Engine restarts.

   Parameter description

    The following notes describe the key parameters used in the preceding command:

   • cacerts: Name of the keystore and truststore file of the Report Engine.
   • <truststore password>: Password for the keystore/truststore. changeit is the default password for the cacerts keystore. If you have changed this password, use the current password.
   • <BMC TrueSight Operations Management Report Engine Install Directory>\ReportEngine\tools\jre\bin: The directory path where the cacerts truststore file is located.

3. Enable the TLS configuration by running the following command:

   tls_config enable -component cell

Perform the following steps to enable the Infrastructure Management server SQL Anywhere database to Report Engine communication to be TLS compliant:

Step 1: To configure the SQL Anywhere database on Windows operating system /To configure the SQL Anywhere database on Unix operating system

Step 2: To configure the Report Engine component 

Before you begin

Ensure that the SQL Anywhere security certificates are procured and placed in the relevant directory paths. For more information, see Importing-security-certificates-for-the-TrueSight-Operations-Management-Report-Engine.

To configure the SQL Anywhere database on Windows operating system

Logon to the Infrastructure Management server computer where the SQL Anywhere database is installed, and perform the following steps:

1. Stop the database by running the following command: 

   pw p r dbsrv
2. Using a text editor, open the pndbsrv.conf file located in the <Infrastructure Management server Install Director>\TrueSight\pw\pronto\conf directory.

3. Add the following lines into pndbsrv.conf file.

   #Syntax

   COMDefine -es

   COMDefine -ec "TLS(identity=<identify_file_dir_path>\<identity_file>;identity_password=<password provided for protecting the private key>)"

   #Example

   COMDefine -es

   COMDefine -ec "TLS(identity=<Infrastructure Management Server Install Directory>\pw\pronto\conf\id.pem;identity_password=pwd)"

   id.pem : Name of the identity file. If the name of the identity file is different, use the relevant file name in the preceding command.

   <Infrastructure Management Server Install Directory>\pw\pronto\conf : The directory path where the identity file is located. If the identity file is located in a different directory, use the relevant path in the preceding command.

4. Restart the database by running the following command:

   pw p r dbsrv

To configure the SQL Anywhere database on Unix operating system

1. Take a backup of the startdbsrv7 file located in the  <Infrastructure Management server Install Directory>/TrueSight/pw/pronto/bin directory.

2. Create an environment variable for the TLS configuration as shown in the following code block:

   #Syntax

   Setenv TLS_CONFIG -ec "TLS(identity=<identity_file_dir_path>\<identity_file>;identity_password=<password provided for protecting the private key>)"

   #Example

   Setenv TLS_CONFIG -ec "TLS(identity=<Infrastructure Management Server Install Directory>/pw/pronto/conf/id.pem;identity_password=pwd)"

   Parameter description

   <identity_file_dir_path> : The path where the identity file is located

   <identity_file> : The identity file name

3. Append the newly created environment variable into the startdbsrv7 file as shown in the following code block:

   if ($ip == "" || $ip == "localhost") then

   ${DBINSTALLDIR}/asa/bin/dbsrv -ud -x "tcpip(ServerPort=$port)" ${DBINSTALLDIR}/storm_${DBHOSTNAME}.db -n storm_${DBHOSTNAME} -c ${dbsrvicache}g -ch ${dbsrvhcache}p -cl ${dbsrvlcache}p -gp 4096 -gn 50 -ti 0 -tl 0 -gk all -os 20000000 -o ${SATMP}/storm_${DBHOSTNAME}db.log -ec ${TLS_CONFIG} set count=0

   else

   ${DBINSTALLDIR}/asa/bin/dbsrv -ud -x "tcpip(ServerPort=$port;MyIP=${ip})" ${DBINSTALLDIR}/storm_${DBHOSTNAME}.db -n storm_${DBHOSTNAME} -c ${dbsrvicache}g -ch ${dbsrvhcache}p -cl ${dbsrvlcache}p -gp 4096 -gn 50 -ti 0 -tl 0 -gk all -os 20000000 -o ${SATMP}/storm_${DBHOSTNAME}db.log -ec ${TLS_CONFIG}

   Endif

4. Restart the database by running the following command:

   pw p r dbsrv
5.  Verify that the process has started with new TLS_CONFIG option in the logfile located in the <Infrastructure Management server Install Directory>/TrueSight/pw/pronto/logs.

To configure the Report Engine component

1. Navigate to the <TrueSight Operations Management Report Engine Install directory>\bin\reportsCLI directory.

2. Initialize the configuration settings by running the following command:

   #Syntax

   tls_config init [-SqlAnywhereCert <trust certificate path>]

   #Example

   tls_config init -SqlAnywhereCert "<TrueSight Operations Management Report Engine Install Directory>\ReportEngine\tools\jre\lib\security\cert.pem"

   When you run the tls_config script, you are prompted to confirm the restart of Reporting Engine. The TLS configurations are applied only when the Reporting Engine restarts.

   Parameter description

    The following notes describe the key parameters used in the preceding command:

   • -SqlAnywhereCert: This option indicates that the SQL Anywhere database is been configured
   • cert.pem: Name of the certificate file procured from the SQL Anywhere database administrator. If the name of the procured file is different, use the relevant name in the preceding command.
   • <TrueSight Operations Management Report Engine Install Directory>\ReportEngine\tools\jre\lib\security\cert.pem: The complete directory path for the cert.pem certificate file. If this path different, use the relevant path in the preceding example.

3. Enable the TLS configuration by running the following command:

   tls_config enable -component TSIMDB [-port <2638>]

Perform the following steps to enable the Infrastructure Management server Oracle database to Reporting Engine communication to be TLS compliant:

Before you begin

• If the Oracle database is configured in TLS 1.2 mode, then perform the following steps to configure the Infrastructure Management Server in TLS 1.2 mode. 

  Note

  Oracle database version 12.1.0.2 is TLS 1.2 compliant.

• Ensure that the Oracle database security certificates are procured and placed in the relevant directory paths. For more information, see Importing security certificates for the TrueSight Operations Management Report Engine.

To configure the Reporting Engine component

1. Navigate to the reportsCLI directory by running the following command:

   # Microsoft Windows operating system

   CurrentDirectory>cd <TrueSight Operations Management Reporting Install directory>\bin\reportsCLI

   # Unix operating system

   $cd <TrueSight Operations Management Reporting Install directory>/bin/reportsCLI

2. Initiate the configuration settings by running the following command:

   #Syntax

   tls_config init -truststore <truststore file> -truststorepassword <truststore password>

   #Example

   tls_config init -truststore cacerts -truststorepassword <truststore password>

   When you run the tls_config script, you are prompted to confirm the restart of Reporting Engine. The TLS configurations are applied only when the Reporting Engine restarts.

   Parameter description

    The following notes describe the key parameters used in the preceding command:

   • cacerts: Name of the truststore file.
   • <truststore password>: Password for the truststore. changeit is the default password for the cacerts truststore. If you have changed this password, use the current password.

3. Enable the TLS configuration by running the following command:

   tls_config enable -componentType REDB -port 2484

There are two types of Reporting databases used in the TrueSight Operations Management Reporting. They are:

• Oracle database
• SQL server

Perform the following steps to enable the Reporting Engine to Reporting database communication to be TLS compliant:

• Step 1: To configure the Reporting engine
• Step 2: To configure the Reporting database

To configure the Reporting engine

1. Ensure that TrueSight Reporting Engine is installed by disabling the encryption switch. For more information, see To disable the encryption switch before installing the Report Engine to support TLS.

2. Navigate to the reportsCLI directory by running the following command:

   # Microsoft Windows operating system

   CurrentDirectory>cd <TrueSight Operations Management Reporting Install directory>\bin\reportsCLI

   # Unix operating system

   $cd <TrueSight Operations Management Reporting Install directory>/bin/reportsCLI

3. Initiate the configuration settings by running the following command:

   #Syntax

   tls_config init -truststore <truststore file> -truststorepassword <truststore password>

   #Example

   tls_config init -truststore cacerts -truststorepassword <truststore password>

   When you run the tls_config script, you are prompted to confirm the restart of Reporting Engine. The TLS configurations are applied only when the Reporting Engine restarts.

   Parameter description

    The following notes describe the key parameters used in the preceding command:

   • cacerts: Name of the truststore file.
   • <BMC TrueSight Operations Management Report Engine Install Directory>\ReportEngine\tools\jre\lib\security: The directory path where the cacerts truststore file is located.

To configure the Reporting database

1. Navigate to the reportsCLI directory by running the following command:

   # Microsoft Windows operating system
   CurrentDirectory>cd <TrueSight Operations Management Reporting Install directory>\bin\reportsCLI
   
   # Unix operating system
   $cd <TrueSight Operations Management Reporting Install directory>/bin/reportsCLI

2. Enable the TLS configuration by running the following command:

   #Syntax

   tls_config enable -componentType <component> -port <TLS port>

   #For Oracle database

   tls_config enable -componentType REDB -port 2484
   

   #For SQL server

   tls_config enable -componentType REDB -port 2484
   

The Central Management Server communicates with the BI launch pad over https connection. Perform the following steps to enable this communication to be TLS compliant: 

To configure the Central Management Server and Repository 

1. To open the Central Configuration Manager (CCM), from the desktop or Start menu, navigate to Sap Business Intelligence -> SAP BusinessObjects Platform 4 -> Central Configuration Manager.
2. Stop the Tomcat web server.
3. Locate the server.xml file located in the <TrueSight Operations Management Report Engine Install directory>\SAP BusinessObjects\Tomcat6\conf directory.
4. Make a copy of this file and save it as  server.xml.bak
5. Using a text editor open the server.xml file.

6. Uncomment  the instance of the code line having the Connector port value as tcp as shown in the following code block:

   <Connector port="8443" ....

7. Add the attributes to the xml file as shown in the following code block:

   keystorePass="Password1" keystoreFile="C:\SSL\.keystore". <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" keystorePass="bmcAdm1n" keystoreFile="C:\SSL\.keystore" sslProtocol="SSL" sslEnabledProtocols="TLSv1.2"/>
8. Save and close the file.

9. Enable the following environment variables:

   set JAVA_HOME=C:\Java64\jdk1.8.0_60

   set PATH=%PATH%;C:\Java64\jdk1.8.0_60\bin

   set CATALINA_HOME=C:\apache-tomcat-7.0.64-64bit

   set JAVA_OPTS=-Djdk.tls.client.protocols="TLSv1.2" -Dsun.security.ssl.allowUnsafeRenegotiation=false -Dhttps.protocols="TLSv1.2"
10. Start the Tomcat web server. 

11. Open the Central Management Server, and the BI launch pad web client using the port that is used to configure the TLS. For example, in the preceding command port number 8443 is used to configure TLS, hence open the server and client as shown below:

    Https://<BO_Hostname>:8443/BOE/BI

    Https://<BO_Hostname>:8443/BOE/CMC