Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Administration

Quick Start

search

Please Note:

Quick Start

This article covers the steps required to perform standard installation of CDP for DB2.

Prerequisites

Download and extract the CDP for DB2 file

Download and extract the software. Extracting the software creates the following structure:

The following table provides description of each file that are included in CDP_for_DB2.

FilenameDescription
check_erase.batAssures the existence of a file before deleting it.
cryptix-jce-api.jarJava component of the Cryptix JCE API.
cryptix-jce-provider.jarJava component of the Cryptix JCE Provider.
demoTable.sqlScript used to create the demo table.
IngrianDB.jarJava components of CDP.
install.batFile used to install CDP components in Windows environments.
install.shFile used to install CDP components in Linux/UNIX environments.
loadjce.batFile used to load JCE components in Windows environments.
loadjce.shFile used to load JCE components in Linux/UNIX environments.
CDP_DB2.propertiesProperties file used to configure CDP settings.
install.propertiesProperties file used to configure the silent installation for CDP.
CDPDropFunctions.sqlScript used to remove functions.
CDPDropProcedures.sqlScript used to remove procedures.
CDPDropSchema.sqlScript used during installation to drop any existing metadata tables.
CDPDropUtil.sqlScript used to remove the utility procedures.
CDPLargeUDF.sqlScript used to create UDFs for BLOB/CLOB.
CDPLargeX64UDF.sqlScript used to create UDFs for BLOB/CLOB on 64-bit systems.
CDPProc.sqlScript used to create procedures.
CDPSchema.sqlScript used to create metadata tables.
CDPUDF.sqlScript used to create UDFs.
CDPUpgradeFPEFormat.sqlScript to add FPE_ENC_FORMAT column in ingrian table.
CDPUpgradeFSchema.sqlScript used to upgrade CDP for format preservation encryption support.
CDPUpgradeMetaTableIndices.sqlScript to upgrade indices of metadata tables
CDPUpgradeSchema.sqlScript used to upgrade CDP.
CDPUtil.sqlScript used to create utility procedures.
CDPVargraphicUDF.sqlScript used to create UDFs for GRAPHIC and VARGRAPHIC data types.

Verify the DB2 and JDK versions

  • CDP for DB2 supports all versions of DB2 starting 9.7 to 11.5.

  • JDK 1.6 and above must be installed.

Enable SSL

When using IBM JDK, to enable SSL between the database and the NAE Server, ibmjsse.jar must be installed. Thales does not distribute this file; obtain it from IBM.

Set the PATH variable

The PATH environment variable must contain a path to the “db2” command. In UNIX/Linux, the PATH environment variable must contain a path to the awk command. To add the default path, issue the following command: 

        export PATH=/bin:$PATH`

Set the VWSPATH variable in the UNIX/Linux and AIX operating systems

In UNIX/Linux, the VWSPATH environment variable must be set to point to the target instance path, (the path on which the database instance is installed). For example, the default target instance path is /opt/home/db2inst1/sqllib.

For reference, some of the other DB2 instance owner environment variables are:

  • DB2INSTANCE=db2user: Here, db2user is the name of the database instance owner.

  • INSTHOME=/usr/db2user: Here, INSTHOME points to the home directory of the database instance owner.

  • VWSPATH=/usr/db2user/sqllib: Here, VWSPATH points to the sqllib directory under the home directory of the database instance owner.

Set the DB2PATH variable in the Windows operating systems

In Windows, the DB2PATH environment variable must be set to point to the target instance path, which is the path on which the database instance is installed. For example, the default target instance path is C:\Program Files\IBM\SQLLIB.

Check the page size requirements

To accommodate the width of the ING_ERROR_LOG table, make sure that the tablespace in which CDP for DB2 is being installed uses a buffer pool with a page size of 8KB or greater.

Check the shell

On UNIX/Linux, the install script assumes that the bourne shell is installed in /bin/sh. If it is not installed there, modify the script accordingly.

Create the ingrian user with dba privileges

Before installing CDP for DB2, the database must have an ingrian user (all lowercase) with CREATETAB, BINDADD, CONNECT, CREATE_NOT_FENCED_ROUTINE, IMPLICIT_SCHEMA, LOAD, CREATE_EXTERNAL_ROUTINE, QUIESCE_CONNECT, and SECADM permissions on the database containing tables to be encrypted. Also, the ingrian user should have USE privilege on REGULAR TABLESPACE of the same database.

Change permissions for the lib/ext folder

The user running the install.sh script must have write access to the IBM Java Home directory. For this, change permissions for the <VWSPATH>/java/jdk64/jre/lib/ext folder.

For example, execute the following command:

        chmod 757 /home/db2inst1/sqllib/java/jdk64/jre/lib/ext

Steps

Standard installation of CDP involves the following:

  1. Selecting the installation mode

  2. Running the installation script

Selecting the Installation Mode

The installation script can be run in different modes for different purposes. The usage format is:

  • Windows: 

        install.bat <mode> <destination_db>

  • UNIX: 

        ./install.sh <mode> <destination_db>

Here destination_db represents the name of the database containing tables to be encrypted. Specify this parameter for the following modes:

ModesModesModes
installinstall_metadatauninstall
uninstall_metadataupgrade_metadataupgrade_db

The following table describes the available installation modes:

ModesDescription
installPerforms a fresh install. If an installation already exists and the script is run with the install option, an error message appears. In install mode, the script does the following:
• Loads the Java files associated with CDP.
• Creates stored procedures and User Defined Functions (UDFs) on the specified database in a schema called INGRIAN.
• Creates metadata tables for CDP.
• Generates and loads an Instance ID for this installation. Accept the default Instance ID or provide own ID when prompted.
install_metadataCDP for DB2 supports installation of CDP metadata on multiple databases in single DB2 instance. The install_metadata mode performs CDP metadata only installation on the database. In this mode, the script does the following:
• Creates stored procedures and User Defined Functions (UDFs) on the specified database in a schema called INGRIAN.
• Creates metadata tables for CDP.
Note: Before using the install_metadata mode, ensure that the full installation exists on another database in the same DB2 instance with the same version number.
uinstall_metadataRemoves the metadata from the database where it was installed using the install_metadata mode. The install.sh orinstall.bat program checks that all tables have been unmigrated in the corresponding database before uninstalling the metadata.
uninstallRemoves files and objects in the ingrian schema. The install.sh or install.bat program checks that all tables have been unmigrated before uninstalling the files.
install_filesCopies CDP files.
uninstall_filesRemoves CDP files. This mode is only available through install.sh.
upgrade_filesRemoves CDP files and copies upgraded files. The existing properties file is preserved.
upgrade_dbRemoves database programs and views in the ingrian schema and creates upgraded database programs and views in the schema. Updates metadata.
upgrade_metadataUpdates metadata on the database where CDP metadata was installed.
Note: Before using the upgrade_metadata mode, ensure that the full installation on another database in the same DB2 instance is upgraded to the same version number.

Running the Installation Script

Note

The user running the install.sh script must have write access to the IBM Java Home directory.

To run the installation script:

  1. Log on to the system.

    On RHEL or AIX:

    • Log in as a db2 instance owner to set the DB2 environment variables.

    • Switch to root (su) to ensure that the JDK can be accessed.

    On Windows:

    Log in as a user that is part of the DB2 admin group.

  2. Open the command prompt window, and navigate to the directory where you extracted the CDP for DB2.

  3. Execute the following commands based on the operating system.

    • Windows:

          install.bat <mode> <destination_db>

    • UNIX

          ./install.sh <mode> <destination_db>

    Here, <mode> is install and <destination_db> is the name of the database containing tables to be encrypted.

    The install script then does the following:

    • Confirms whether the OS user ingrian exists.

    • Confirms whether the specified database exists.

    Note

    If y is entered for the above confirmations, the installation continues. If n is entered in any of the above confirmations, the installation aborts and displays the corresponding error message.

    • Confirms the existing DB2 version. If DB2 version is 11.5, enter y; enter n for versions lower than 11.5.

    • Attempts to connect to the database as the ingrian user.

    • Prompts for the ingrian user password.

    • Locates the IngrianNAE.jar file.

    • Copies the CDP_DB2.properties file to the <DB2_HOME>/java/jdk/jre/lib/ext directory.

    • Locates the DB2 files.

    • Copies JDBC driver from <VWSPATH>/java/ to <VWSPATH>/java/jdk64/jre/lib/ext.

    • Attempts to locate the JAVA_HOME directory; if it cannot find it, the system prompts to provide the location.

    • Locates the JDK and JDK extension files.

    • Prompts for the NAE IP address.

    • Prompts for the full path and file name for the log file. Write access to this file is required.

    • Copies the .jar files to the client machine.

    • Loads the new schema.

    • Creates/updates the installationInfo.properties file in the JAVA_HOME/lib/ext directory to store the installation related information.

    Note

    While loading the new schema, the install script will prompt for an instance ID. Specify an instance ID.

  4. If the system uses IBM JDK, copy the ibmjsse.jar file to the JAVA_HOME/lib/ext directory and restart the database.

On this page