SSL support for natvie DB2 LUW (non-SQLJ/JDBC)

[Christian T]

Hallo,

Is SSL protocol in LUW only supported for IBM DB2 Driver for JDBC and SQLJ
type 4 ?
I want my NATIVE DB2 client to connect to DB2 server using SSL protocol (not
using SQLJ/JDBC)

Is this supported yet?
If yes, can someone point me to a HOWTO

I'm using Data Server 9.5 for Unix and Data Server Runtime Client 9.5 for
Windows

Grüße,

Christian Tanner

[Lennart]

On Jul 22, 10:26 am, "Christian T" <[e-mail]:

Hallo,

Is SSL protocol in LUW only supported for IBM DB2 Driver for JDBC and SQLJ
type 4 ?
I want my NATIVE DB2 client to connect to DB2 server using SSL protocol (not
using SQLJ/JDBC)

Is this supported yet?

Not that I'm aware of. In situations like yours I have used stunnel,
perhaps it is worth a look (http://www.stunnel.org/)?

/Lennart

[...]

[Darin McBride]

Christian T wrote:

Hallo,

Is SSL protocol in LUW only supported for IBM DB2 Driver for JDBC and SQLJ
type 4 ?
I want my NATIVE DB2 client to connect to DB2 server using SSL protocol
(not using SQLJ/JDBC)

Is this supported yet?

It appears to be, yes.

If yes, can someone point me to a HOWTO

http://publib.boulder.ibm.com/infoce...searchWord=ssl

You should be able to set DB2COMM to SSL (or TCPIP,SSL if you want both).
At least, that's the server side. I'm pretty sure it's available for the
client side, too.

I'm using Data Server 9.5 for Unix and Data Server Runtime Client 9.5 for
Windows

You may need to get the GSKit to get the runtime client to do SSL (it's not
included by default as not many people need it and it's fairly large).

[Christian T]

Darin,

That is just the point where i got stuck.
On the client side there is only SSL support for SQLJ and JDBC :-(

I think i have a look at STUNNEL, that might work i hope...

thanks,

Christian

"Darin McBride" <dm******@naboo.to.org.no.spam.for.mewrote in message
news:LRohk.23379$nD.22873@pd7urf1no...

Christian T wrote:

>Hallo,

Is SSL protocol in LUW only supported for IBM DB2 Driver for JDBC and
SQLJ
type 4 ?
I want my NATIVE DB2 client to connect to DB2 server using SSL protocol
(not using SQLJ/JDBC)

Is this supported yet?

It appears to be, yes.

>If yes, can someone point me to a HOWTO

http://publib.boulder.ibm.com/infoce...searchWord=ssl

You should be able to set DB2COMM to SSL (or TCPIP,SSL if you want both).
At least, that's the server side. I'm pretty sure it's available for the
client side, too.

>I'm using Data Server 9.5 for Unix and Data Server Runtime Client 9.5 for
Windows

You may need to get the GSKit to get the runtime client to do SSL (it's
not
included by default as not many people need it and it's fairly large).

[Darin McBride]

Christian T wrote:

Darin,

That is just the point where i got stuck.
On the client side there is only SSL support for SQLJ and JDBC :-(

After a bit of investigation, it seems that this should be added soon,
possibly as soon as 9.5FP2, due out in August.

I think i have a look at STUNNEL, that might work i hope...

Good luck :-)

[Darin McBride]

Christian T wrote:

Darin,

That is just the point where i got stuck.
On the client side there is only SSL support for SQLJ and JDBC :-(

I found it... with a bit more help.

http://publib.boulder.ibm.com/infoce...c/t0053518.htm

Apparently, this is in v9.1FP5. You may need to upgrade a bit.

[Frank Swarbrick]

>>On 7/23/2008 at 10:39 AM, in message <a9Jhk.128399$gc5.8952@pd7urf2no>,
Darin McBride<dm******@naboo.to.org.no.spam.for.mewrote:

Christian T wrote:

>Darin,

That is just the point where i got stuck.
On the client side there is only SSL support for SQLJ and JDBC :-(

I found it... with a bit more help.

http://publib.boulder.ibm.com/infoce...om.ibm.db2.udb
.uprun.doc/doc/t0053518.htm

Apparently, this is in v9.1FP5. You may need to upgrade a bit.

This is a little weird. This link talks about cataloging a server like so:

catalog TCPIP NODE <nodename REMOTE <ipaddr SERVER <portSECURITY SSL
But in DB2 9.5 there does not appear to be an option of SECURITY SSL.

I'm not understanding how this has changed between version 9.1 and version
9.5. Anyone know? Is it just missing documentation in V9.5?

Thanks,
Frank

[Darin McBride]

Frank Swarbrick wrote:

>>>On 7/23/2008 at 10:39 AM, in message <a9Jhk.128399$gc5.8952@pd7urf2no>,

Darin McBride<dm******@naboo.to.org.no.spam.for.mewrote:

>Christian T wrote:

>>Darin,

That is just the point where i got stuck.
On the client side there is only SSL support for SQLJ and JDBC :-(

I found it... with a bit more help.

http://publib.boulder.ibm.com/infoce...om.ibm.db2.udb
.uprun.doc/doc/t0053518.htm

Apparently, this is in v9.1FP5. You may need to upgrade a bit.

This is a little weird. This link talks about cataloging a server like
so:

catalog TCPIP NODE <nodename REMOTE <ipaddr SERVER <portSECURITY
SSL
But in DB2 9.5 there does not appear to be an option of SECURITY SSL.

I'm not understanding how this has changed between version 9.1 and version
9.5. Anyone know? Is it just missing documentation in V9.5?

9.5 is older than 9.1fp5 ;-) This should be there by 9.5fp2 as the feature
gets merged forward.

[Frank Swarbrick]

>>On 7/23/2008 at 11:33 PM, in message
<ruUhk.129910$gc5.114399@pd7urf2no>,
Darin McBride<dm******@naboo.to.org.no.spam.for.mewrote:

Frank Swarbrick wrote:

>>>>On 7/23/2008 at 10:39 AM, in message

<a9Jhk.128399$gc5.8952@pd7urf2no>,

>Darin McBride<dm******@naboo.to.org.no.spam.for.mewrote:

>>Christian T wrote:

Darin,

That is just the point where i got stuck.
On the client side there is only SSL support for SQLJ and JDBC :-(

I found it... with a bit more help.

http://publib.boulder.ibm.com/infoce...om.ibm.db2.udb

>>.uprun.doc/doc/t0053518.htm

Apparently, this is in v9.1FP5. You may need to upgrade a bit.

This is a little weird. This link talks about cataloging a server like
so:

catalog TCPIP NODE <nodename REMOTE <ipaddr SERVER <portSECURITY
SSL
But in DB2 9.5 there does not appear to be an option of SECURITY SSL.

I'm not understanding how this has changed between version 9.1 and

version

>9.5. Anyone know? Is it just missing documentation in V9.5?

9.5 is older than 9.1fp5 ;-) This should be there by 9.5fp2 as the
feature
gets merged forward.

Oh!

Where would be the best place to check for the newest fixpacks, so that I
can look for it when it comes out for 9.5?

Thanks,
Frank

[Frank Swarbrick]

I can't tell if this does or does not address .NET clients. Does it?

Thanks,
Frank

[louisem]

On Jul 24, 3:01 pm, "Frank Swarbrick" <[e-mail]>
wrote:

I can't tell if this does or does not address .NET clients. Does it?

Thanks,
Frank

Hi,

That support is available on V91 FP5:

http://publib.boulder.ibm.com/infoce...c/c0053516.htm

and will come out when FP2 is available.

[Darin McBride]

Frank Swarbrick wrote:

Where would be the best place to check for the newest fixpacks, so that I
can look for it when it comes out for 9.5?

http://www-933.ibm.com/eserver/support/fixes/

Select "Information Management", then "DB2", then "9.5.*", then your
platform, and hit continue. Then select "Recommended", "continue" (this
selects the most current fix pack). Then select the group (there should
only be one, I think) - you should be able to just hit "select all". Now
you have a choice - use Download Director (IBM's Java applet that can
download a file in a swarm mode similar to peer-to-peer, but all
connections will be to IBM, not to others, so it's not really peers - can
help maximise your bandwidth usage to get the file as fast as possible),
or, if Java doesn't work well for you, regular HTTP mode. Select one (DD
is default), and hit "continue." Now you'll have a list of everything for
your platform in the latest 9.5 fix pack. Choose what to download, and
you're off.

Alternately, instead of selecting "recommended", if you want a particular
fix pack, you can try selecting "Text" and putting in "FP2". That
currently will return nothing (FP2 isn't available yet), but once FP2 is
available, the search will return what you 're interested in. This works
fine when you want to know that a particular fix pack is out, but not as
useful when you just want the latest (as IBM suggests you do ;-) ).

[Frank Swarbrick]

>>On 7/25/2008 at 12:28 PM, in message <jXoik.93576$kx.93071@pd7urf3no>,
Darin McBride<dm******@naboo.to.org.no.spam.for.mewrote:

Frank Swarbrick wrote:

>Where would be the best place to check for the newest fixpacks, so that

I

>can look for it when it comes out for 9.5?

http://www-933.ibm.com/eserver/support/fixes/

Select "Information Management", then "DB2", then "9.5.*", then your
platform, and hit continue. Then select "Recommended", "continue" (this
selects the most current fix pack). Then select the group (there should
only be one, I think) - you should be able to just hit "select all". Now
you have a choice - use Download Director (IBM's Java applet that can
download a file in a swarm mode similar to peer-to-peer, but all
connections will be to IBM, not to others, so it's not really peers - can
help maximise your bandwidth usage to get the file as fast as possible),
or, if Java doesn't work well for you, regular HTTP mode. Select one
(DD
is default), and hit "continue." Now you'll have a list of everything
for
your platform in the latest 9.5 fix pack. Choose what to download, and
you're off.

Alternately, instead of selecting "recommended", if you want a
particular
fix pack, you can try selecting "Text" and putting in "FP2". That
currently will return nothing (FP2 isn't available yet), but once FP2 is
available, the search will return what you 're interested in. This
works
fine when you want to know that a particular fix pack is out, but not as
useful when you just want the latest (as IBM suggests you do ;-) ).

Thanks.

This actually led me to a page that seems even more useful:
http://www-1.ibm.com/support/docview...id=swg21293566

This is the page for "DB2 Version 9.5 for Linux, UNIX and Windows APARs by
fix pack".
Nice!

Frank

[louisem]

Hello,

Version 9.5 Fix Pack 2 is available. You can download it using the
links listed in earlier postings. The V9.5 Information Center has
been updated as well:

http://publib.boulder.ibm.com/infoce.../c0053323.html

Links for the SSL support are available from there.

[Frank Swarbrick]

>>On 8/26/2008 at 3:06 AM, in message
<5d**********************************@59g2000hsb.g ooglegroups.com>,
louisem<lo*****@ca.ibm.comwrote:

Hello,

Version 9.5 Fix Pack 2 is available. You can download it using the
links listed in earlier postings. The V9.5 Information Center has
been updated as well:

http://publib.boulder.ibm.com/infoce.../com.ibm.db2.l
uw.wn.doc/doc/c0053323.html

Links for the SSL support are available from there.

Great!

Now I have a question... I have DB2 9.5 Express-C installed on my
workstation. We also have DB2 9.5 ESE (I think) installed on some Linux
servers. Assuming we get FP2 loaded on the Linux servers, what can I do to
get this functionality on my PC from a client perspective? I'm not
concerned about the server part of FP2 on my workstation. I know that
Express-C doesn't offer (free) fix packs. But I do want to be able to
connect using SSL from my workstation to the Linux servers.

Thanks,
Frank

[Darin McBride]

Frank Swarbrick wrote:

>>>On 8/26/2008 at 3:06 AM, in message

<5d**********************************@59g2000hsb.g ooglegroups.com>,
louisem<lo*****@ca.ibm.comwrote:

>Hello,

Version 9.5 Fix Pack 2 is available. You can download it using the
links listed in earlier postings. The V9.5 Information Center has
been updated as well:

http://publib.boulder.ibm.com/infoce.../com.ibm.db2.l
uw.wn.doc/doc/c0053323.html

Links for the SSL support are available from there.

Great!

Now I have a question... I have DB2 9.5 Express-C installed on my
workstation. We also have DB2 9.5 ESE (I think) installed on some Linux
servers. Assuming we get FP2 loaded on the Linux servers, what can I do
to
get this functionality on my PC from a client perspective? I'm not
concerned about the server part of FP2 on my workstation. I know that
Express-C doesn't offer (free) fix packs. But I do want to be able to
connect using SSL from my workstation to the Linux servers.

Option 1: Wait for Express-C at FP2 or later level. I have no idea if this
is planned or not, so you may be waiting a looooong time.

Option 2: Buy Express-C FTL. This will give you the ability to use the
general fix packs.

Option 3: Download and install Data Server Client. This is free and DOES
come with fix pack support. You'll have to install it to a new location,
say /opt/ibm/db2/9.5.client. And then you'll have to create a new instance.
But that instance will have SSL support.

Non-Option 4: grab the client libraries from the server and copy them over.
Not really sure how this works, but it may work. Not recommended because
it's unlikely to be supported. Mind you, neither is Express-C, so it's not
going to jeopardise anything that way.