Symmwin

"Symmetrix: Remote Connection Console (RCC) is unable to establish a connection

to SSC enabled box"

ID: emc170633

Usage: 5

Date

Created:09/21/2007

Last

Modified:11/24/2008

STATUS: Approved

Audience: Support

Knowledgebase

Solution

Environment: Product: Symmetrix DMX-3

Environment: Enginuity: 5772.59.53

Environment: EMC SW: Secure Service Credential (SSC)

Problem: Login to SSC enabled SP fails

Problem: Remote Connection Console (RCC) is unable to establish a connection to SSC enabled box

Problem:

The following messages appear in G:\gina.log

User name not NULL

Login Failed: aaMwp421LxWs request to log into application GINA authentication code: 2633

Login Failed: ADMIN request to log into application GINA authentication code: 1326

Problem:

The following messages appear in C:\Program Files\EMC\SymmRemote\PWHOST.Log

yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 connected. Role - CE. Activity - Upgrade/Install.

yyyy/mm/dd hh:mm:ss Status: Remote control session active

yyyy/mm/dd hh:mm:ss Status: Connection lost

yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 lost connection. Connection time: 00:-54:-36

yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 connected. Role - CE. Activity - Upgrade/Install.

yyyy/mm/dd hh:mm:ss Status: Remote control session active

yyyy/mm/dd hh:mm:ss Status: Remote control session closed

yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 disconnected. Connection time: 00:00:15

Root Cause:Error code 2633 shown in the gina.log file means that the token record that the credential is trying to validate against could not

be found.

Fix: Fix 1 - Check to make sure that the expected tokens are on the machine. Users can do this by opening Key Client on the desktop,

click next, and then click show installed tokens. This will list what is on the machine. If there is a difference between the Service

Processor and the Central Manager, follow instructions in the User Guide or CSP 2089 to remove tokens and install tokens. These

are available by clicking the link below.

Fix 2- Check Central Manager to make sure that the tokens and set to Install and there is no issue with them. Go to Token

Manager-->Installed token viewer. Then enter in the serial number of the Symm you are working on. All the tokens should be

there and set to Active. Make sure that they match what is on the Service Processor as well. If there is a difference between the

Service Processor and the Central Manager, follow instructions in the User Guide or CSP 2089 to remove tokens and install tokens.

These are available by clicking the link below.

Fix -3 Temporary workaround:

The root cause is still unknown. As a temporary workaround you can change the time on the SP, so that it is ahead of UTC. In this

case it has been changed from UTC to UTC+2 to temporarily solve the problem.

Again, this is just a temporary workaround. Development is still investigating.

Notes:

Coordinated Universal Time (UTC) replaced Greenwich Mean Time (GMT) as the World standard for time in 1986. UTC is based on

atomic measurements rather than the earth's rotation. UTC uses 24-hour (military) time notation and is based on the local

standard time on the 0° longitude meridian which runs through Greenwich, England. Midnight in Greenwich corresponds to 00:00

UTC, noon corresponds to 12:00 UTC, and so on.

You can verify the current UTC (or GMT) time at the following link: http://tycho.usno.navy.mil/cgi-bin/timer.pl

Notes: All documentation can be fould by clicking here: CS Security Operations

"Partners with Powerlink User IDs longer then 22 characters

cannot authenticate back to EMC with their RSA Credentials from the SSC Key

Client Application."

ID: emc176166

Usage: 1

Date

Created:12/11/2007

Last

Modified:11/24/2008

STATUS: Approved

Audience: Support

Knowledgebase

Solution

Environment: Enginuity: 5772.83.75 and below




Problem: Partners with Powerlink User IDs longer then 22 characters cannot authenticate back to EMC with their RSA Credentials from the

SSC Key Client Application.

Root Cause: The User name field in SSC Key Client is not long enough for Partner User Names that exceed 22 characters.

Fix:

The fix is downloadable from Partner Web (Home > Support > Software Downloads and Licensing > Downloads D-R > Enginuity

Packs)

This fix will increase the User Name field in SSC Key Client from 22 characters to 55 characters to match Powerlink

Instructions:

1- Download SSCKC117.zip from Partnerweb

2- Extract the two files (slckeyclient.exe and keyclient.forms.dll)

3- Copy them into the diectory C:\EMC\SLC\SLCKeyClient directory and overwrite the current two files that are currently installed

Notes: This is not required for EMC Field users this only affects Partners

"Symmetrix DMX-3 and DMX-4: SSC tokening on Symmetrix gives Token

Transaction Decryption error"

ID: emc178766

Usage: 5

Date

Created:02/04/2008

Last

Modified:03/11/2012

STATUS: Approved

Audience: Support

Knowledgebase

Solution

Question: Deleting or adding SSC token



Environment: Enginuity: 5772



Problem: SSC tokening on Symmetrix gives Token Transaction Decryption error.

Problem: Error Msg: Failed to process token transaction. Token transaction decryption error. Padding is invalid and cannot be removed.

Change: Removing or installing SSC token, such as EMC Default, using the "disconnected, no SP file available" method.

Root Cause:

Standard procedures state that the "disconnected, no Service Processor available" method should be used in the SSC Central

Manager website to generate a removal token. Adding tokens is also often done by the "disconnected" method. If any of the SSC

"bind data" (The Service Processor part number, serial number and other details) has a mismatch with the data in

CSI, then adding\removing a token will not work. See Note 1 below for details.

Fix:

If you experience this issue and cannot use one of the other methods ("connected" or "disconnected, SP file available") then:

1. Compare and correct the SP part number and serial number in CSI if incorrect. This may take up to 2 hours to process in

CSI (CSI feeds are updated hourly).

2. Repeat the token add\removal procedure from the beginning (i.e., generate new files for token add or removal).

If this does not fix the issue, contact the CS Sec Ops group to investigate and reference this solution. They can see all the bind

data and compare.

Notes:

Note 1:

In the example seen in the field, the CPU details had changed for some reason as below:

SP Bind Data mismatch - Different image being used - CPU ID is different that default value

For Part Number 090-000-158

SP SN CK290100380 - From Field

2146942976090-000-158WCAFN053305237111f15f3290100380x86 Family 15 Model 4 Stepping 1

CM Bind Data for SN = CK290100380

2146942976090-000-158WCAFN053305237111f15f3290100380x86 Family 15 Model 2 Stepping 9

Notes:

Note 2:

Link your SR to this solution if you experience this issue. Further investigation will occur only if this happens multiple times in the

field.

"

I cannot see the EMC Default token in Central Manager?

"

ID: emc177893

Usage: 2

Date

Created:01/14/2008

Last

Modified:05/23/2012

STATUS: Approved

Audience: Support

Knowledgebase

Solution





Problem: I cannot see the EMC Default token in Central Manager?

Problem: I cannot create SSC Credentials against the EMC Default Token?

Problem: The EMC Default Token Type is missing in Central Manager

Change: A fix was installed in Central Manager on 1/17/2008 at 9:00pm EST to remove the ability to create Credentials against the EMC

Default token. Users will be allowed to install the EMC Default token, but will no longer be able to create Credentials against it.

Root Cause:The EMC Default token was developed to ensure a successful release of 5772 in Q1 '07. EMC has determined the EMC Default

Token is no longer needed and is a Security Risk to both the Customer and to EMC.

Fix:

Users are now required to Create Credentials against Serial or Site if installed.

The Serial token must be installed on all DMX-3/DMX-4 systems running 5772 Enginuity. The site token can be installed by

Customer Engineers if allowed by the customer and if there are more then one Symmetrix running 5772 or above at a given CSI

Party Number.

Fix:To ensure that the Customer is protected in the event of a Central Manager outage, Field Engineers must install the RSA SecurID

Application for Windows as documented in the FUI 0111, the New Install Procedure from Proc-Gen and in the SSC User Guide.

Notes:

It is important that users follow the instructions from the procedure generator for upgrades to 5772 and new installs of

DMX-3/DM-4 systems to ensure that all the pre-work within CSI is completed for successful token installation and generation of

Credentials.

Notes:

The EMC Default Token is being scheduled for removal/retirement. An FCO is being written to install the Emergency Solution and

remove the EMC Default Token from the DMX-3/DMX-4 field population. Please review the SSC User Guide which is located on the

main page of Central Manager or from the GTS Intranet. Also review FUI-0111 from the GTS Intranet for more information about

installing tokens, the Emergency Application and how to generate Credentials.

"Symmetrix DMX-3: SSC log on error"

ID: emc160715

Usage: 5

Date

Created:05/08/2007

Last

Modified:11/24/2008

STATUS: Approved

Audience: Support

Knowledgebase

Solution




Problem: SSC log on error.

Problem:Error Msg: Windows cannot copy file C:\Documents and Settings\Default User\Application Data\Microsoft\CLR Security Config\

v1.1.4322\security.config.cch.****.****** to location C:\documents and Settings\62\Application Data\Microsoft\CLR Security

Problem:Error Msg: Windows cannot load the user's profile but has logged you on with the default profile for the system. DETAIL - Access is

denied.

Change: Upon logging into a Symmetrix at Enginuity 5772, the two pop-up error messages occur.

Fix:No action is required. These errors occur only after a user initially logs on to the Symmetrix. Log on will progress normally. After a

reboot, any subsequent log on for that user will post no errors.

Notes: OPT 254135 has been opened for this issue.

Notes:

SSC Central Manager (inside EMC network): http://slc.emc.com/psscm/

SSC Central Manager (outside EMC network, requires SecureID fob): https://slc.emc.com/psscm/

CS Security Operations: 1-800-782-3797 x25427 or [email protected]