"Symmetrix: Remote Connection Console (RCC) is unable to establish a connection to SSC enabled box"

ID: Usage: emc170633 5

Date Created: 09/21/2007 Last Modified: 11/24/2008 STATUS: Audience: Approved Support

Knowledgebase Solution Environment: Environment: Environment: Problem: Problem: Product: Symmetrix DMX-3 Enginuity: 5772.59.53 EMC SW: Secure Service Credential (SSC) Login to SSC enabled SP fails Remote Connection Console (RCC) is unable to establish a connection to SSC enabled box The following messages appear in G:\gina.log Problem: User name not NULL

Login Failed: aaMwp421LxWs request to log into application GINA authentication code: Login Failed: ADMIN request to log into application GINA authentication code: The following messages appear in C:\Program Files\EMC\SymmRemote\PWHOST.Log 1326

2633

yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 connected. Role - CE. Activity - Upgrade/Install. yyyy/mm/dd hh:mm:ss Status: Remote control session active yyyy/mm/dd hh:mm:ss Status: Connection lost Problem: yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 lost connection. Connection time: 00:-54:-36

yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 connected. Role - CE. Activity - Upgrade/Install. yyyy/mm/dd hh:mm:ss Status: Remote control session active yyyy/mm/dd hh:mm:ss Status: Remote control session closed yyyy/mm/dd hh:mm:ss Access: Remote user GECSMUENCNL2C:966 disconnected. Connection time: 00:00:15 Root Cause: Error code 2633 shown in the gina.log file means that the token record that the credential is trying to validate against could not be found. Fix 1 - Check to make sure that the expected tokens are on the machine. Users can do this by opening Key Client on the desktop, click next, and then click show installed tokens. This will list what is on the machine. If there is a difference between the Service Processor and the Central Manager, follow instructions in the User Guide or CSP 2089 to remove tokens and install tokens. These are available by clicking the link below.

Fix 2- Check Central Manager to make sure that the tokens and set to Install and there is no issue with them. Go to Token Manager-->Installed token Fix: viewer. Then enter in the serial number of the Symm you are working on. All the tokens should be there and set to Active. Make sure that they match what is on the Service Processor as well. If there is a difference between the Service Processor and the Central Manager, follow instructions in the User Guide or CSP 2089 to remove tokens and install tokens. These are available by clicking the link below.

Fix -3 Temporary workaround:

The root cause is still unknown. As a temporary workaround you can change the time on the SP, so that it is ahead of UTC. In this case it has been

changed from UTC to UTC+2 to temporarily solve the problem.

Again, this is just a temporary workaround. Development is still investigating. Coordinated Universal Time (UTC) replaced Greenwich Mean Time (GMT) as the World standard for time in 1986. UTC is based on atomic measurements rather than the earth's rotation. UTC uses 24-hour (military) time notation and is based on the local standard time on the 0 longitude Notes: meridian which runs through Greenwich, England. Midnight in Greenwich corresponds to 00:00 UTC, noon corresponds to 12:00 UTC, and so on.

You can verify the current UTC (or GMT) time at the following link: http://tycho.usno.navy.mil/cgi-bin/timer.pl Notes: All documentation can be fould by clicking here: CS Security Operations

"Partners with Powerlink User IDs longer then 22 characters cannot authenticate back to EMC with their RSA Credentials from the SSC Key Client Application."
ID: Usage: emc176166 1

Date Created: 12/11/2007 Last Modified: 11/24/2008 STATUS: Audience: Approved Support

Knowledgebase Solution

Environment: Environment: Environment: Environment: Problem: Root Cause:

Enginuity: 5772.83.75 and below Product: Symmetrix DMX-3 Product: Symmetrix DMX-4 EMC SW: Secure Service Credential (SSC) Partners with Powerlink User IDs longer then 22 characters cannot authenticate back to EMC with their RSA Credentials from the SSC Key Client Application. The User name field in SSC Key Client is not long enough for Partner User Names that exceed 22 characters. The fix is downloadable from Partner Web (Home > Support > Software Downloads and Licensing > Downloads D-R > Enginuity Packs)

This fix will increase the User Name field in SSC Key Client from 22 characters to 55 characters to match Powerlink

Instructions:

Fix:

1- Download SSCKC117.zip from Partnerweb

2- Extract the two files (slckeyclient.exe and keyclient.forms.dll)

3- Copy them into the diectory C:\EMC\SLC\SLCKeyClient directory and overwrite the current two files that are currently installed

Notes:

This is not required for EMC Field users this only affects Partners

"Symmetrix DMX-3 and DMX-4: SSC tokening on Symmetrix gives Token Transaction Decryption error"
ID: Usage: emc178766 5

Date Created: 02/04/2008 Last Modified: 03/11/2012 STATUS: Audience: Approved Support

Knowledgebase Solution Question: Environment: Environment: Environment: Environment: Environment: Problem: Deleting or adding SSC token Product: Symmetrix DMX-3 Product: Symmetrix DMX-4 Enginuity: 5772 Enginuity: 5773 EMC SW: Secure Service Credential (SSC) SSC tokening on Symmetrix gives Token Transaction Decryption error.

Problem: Change:

Error Msg: Failed to process token transaction. Token transaction decryption error. Padding is invalid and cannot be removed. Removing or installing SSC token, such as EMC Default, using the "disconnected, no SP file available" method. Standard procedures state that the "disconnected, no Service Processor available" method should be used in the SSC Central Manager website to

Root Cause:

generate a removal token. Adding tokens is also often done by the "disconnected" method. If any of the SSC "bind data" (The Service Processor part number, serial number and other details) has a mismatch with the data in CSI, then adding\removing a token will not work. See Note 1 below for details. If you experience this issue and cannot use one of the other methods ("connected" or "disconnected, SP file available") then:

1. Fix: 2.

Compare and correct the SP part number and serial number in CSI if incorrect. This may take up to 2 hours to process in CSI (CSI feeds are updated hourly). Repeat the token add\removal procedure from the beginning (i.e., generate new files for token add or removal).

If this does not fix the issue, contact the CS Sec Ops group to investigate and reference this solution. They can see all the bind data and compare. Note 1:

In the example seen in the field, the CPU details had changed for some reason as below:

SP Bind Data mismatch - Different image being used - CPU ID is different that default value Notes:

For Part Number 090-000-158

SP SN CK290100380 - From Field

2146942976090-000-158WCAFN053305237111f15f3290100380x86 Family 15 Model 4 Stepping 1

CM Bind Data for SN = CK290100380

2146942976090-000-158WCAFN053305237111f15f3290100380x86 Family 15 Model 2 Stepping 9 Note 2: Notes: Link your SR to this solution if you experience this issue. Further investigation will occur only if this happens multiple times in the field.

" I cannot see the EMC Default token in Central Manager? "
ID: Usage: emc177893 2

Date Created: 01/14/2008 Last Modified: 05/23/2012 STATUS: Audience: Approved Support

Knowledgebase Solution Environment: Environment: Environment: Environment: Problem: Problem: Problem: Change: EMC SW: Secure Service Credential (SSC) Enginuity: 5772 Product: Symmetrix DMX-4 Product: Symmetrix DMX-3 I cannot see the EMC Default token in Central Manager? I cannot create SSC Credentials against the EMC Default Token? The EMC Default Token Type is missing in Central Manager A fix was installed in Central Manager on 1/17/2008 at 9:00pm EST to remove the ability to create Credentials against the EMC Default token. Users will be allowed to install the EMC Default token, but will no longer be able to create Credentials against it. The EMC Default token was developed to ensure a successful release of 5772 in Q1 '07. EMC has determined the EMC Default Token is no longer needed and is a Security Risk to both the Customer and to EMC. Users are now required to Create Credentials against Serial or Site if installed. Fix:

Root Cause:

The Serial token must be installed on all DMX-3/DMX-4 systems running 5772 Enginuity. The site token can be installed by Customer Engineers if allowed by the customer and if there are more then one Symmetrix running 5772 or above at a given CSI Party Number.

Fix:

To ensure that the Customer is protected in the event of a Central Manager outage, Field Engineers must install the RSA SecurID Application for Windows as documented in the FUI 0111, the New Install Procedure from Proc-Gen and in the SSC User Guide. It is important that users follow the instructions from the procedure generator for upgrades to 5772 and new installs of DMX-3/DM-4 systems to ensure that all the pre-work within CSI is completed for successful token installation and generation of Credentials. The EMC Default Token is being scheduled for removal/retirement. An FCO is being written to install the Emergency Solution and remove the EMC Default Token from the DMX-3/DMX-4 field population. Please review the SSC User Guide which is located on the main page of Central Manager or

Notes:

Notes:

from the GTS Intranet. Also review FUI-0111 from the GTS Intranet for more information about installing tokens, the Emergency Application and how to generate Credentials.

"Symmetrix DMX-3: SSC log on error"

ID: Usage: emc160715 5

Date Created: 05/08/2007 Last Modified: 11/24/2008 STATUS: Audience: Approved Support

Knowledgebase Solution Environment: Environment: Environment: Problem: Problem: Enginuity: 5772 Product: Symmetrix DMX-3 EMC SW: Secure Service Credential (SSC) SSC log on error. Error Msg: Windows cannot copy file C:\Documents and Settings\Default User\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config.cch.****.****** to location C:\documents and Settings\62\Application Data\Microsoft\CLR Security

Problem: Change: Fix: Notes:

Error Msg: Windows cannot load the user's profile but has logged you on with the default profile for the system. DETAIL - Access is denied. Upon logging into a Symmetrix at Enginuity 5772, the two pop-up error messages occur. No action is required. These errors occur only after a user initially logs on to the Symmetrix. Log on will progress normally. After a reboot, any subsequent log on for that user will post no errors. OPT 254135 has been opened for this issue. SSC Central Manager (inside EMC network): http://slc.emc.com/psscm/

Notes:

SSC Central Manager (outside EMC network, requires SecureID fob): https://slc.emc.com/psscm/ CS Security Operations: 1-800-782-3797 x25427 or CSSEC_Ops@emc.com