Update: Patch links from both IBM  and Perzl  at the bottom of this post.
Below I detail how I patched over 800 AIX LPAR’s that were exposed by CVE-2014-6271  and CVE-2014-7169 , also known as shellshock, using the NIM server.
From everything that I’ve been reading on IBM’s Knowledge Centre, creating an LPP source containing only RPM’s isn’t possible. To patch my AIX environment, I decided to use the “script” resource available to the NIM master, along with the pre-existing NFS mounts that I had configured.
We recently upgraded the firmare on our Power frame, which required shutting down some of our AIX LPAR’s. The firmware upgrade went well, as did starting up all the AIX LPAR’s, except for one. This particular LPAR booted to HMC LED code 2700 and hung there. I restarted the partition to the Open Firmware (OF) prompt, and tried booting again using verbose mode to see where the boot process was hanging.
Having the pleasure of working across many client accounts, it’s funny to see some of the convoluted scripts people have written to receive alerts from the AIX error log daemon. Early in my AIX career, I used to do the exact same thing, and it involved a whole bunch of SSH keys, some text manipulation, crontab, and sendmail. Wouldn’t it be nicer if AIX had some way of doing all of this for us? Well, you know I wouldn’t ask the question if the answer wasn’t yes!
AIX has an Error Notification object class in the Object Data Manager (ODM). By default, there are a number of predefined errnotify entries, and each time an error is logged via errlog, it checks if that error entry matches the criteria of any of the Error Notification objects. What we’re about to do, is add another entry into the errnotify object class to be checked and actioned upon.
I think at some point during a systems administrators life span, they see the below error message when trying to mount a filesystem.
# mount /test
Replaying log for /dev/fslv01.
mount: /dev/fslv01 on /test: Unformatted or incompatible media
The superblock on /dev/fslv01 is dirty. Run a full fsck to fix.
I’ve been doing many AIX server migrations lately. Some which involve taking a mksysb and restoring, others which involve presenting LUN’s from a SVC and then doing a migratepv. The latter can result in a large number of disks presented on the host, so I wrote a quick basic script which gives me the details that I need – hdisk name, size, vg, pvid and serial number.
Maybe someone out there will find it useful.